DNS Compare

After moving a website or its email to a new provider, the question is whether everything was copied. Running a diff over two zone files is easy if you have both; usually you do not. This page does the comparison from the outside: it asks DNS for the same set of records at two names and shows what is the same and what is not.

What it compares

Enter two domain names and tick the record types you care about: A, AAAA, CNAME, MX, NS, TXT and CAA are offered. The page asks the chosen resolver, Cloudflare or Google, for each type at each name. The answers are normalised: sorted so order does not matter, converted to lower case, and with trailing dots removed, so Mail.Example.COM. equals mail.example.com. Then each section reports one of three verdicts: identical, different, or none on either side. Values that exist on only one side are labelled “(only here)” under the name that has them.

Using it for a migration

For a staging or new copy of a site, A, AAAA and NS are expected to differ: the new host has its own addresses and servers. What should match is everything that carries behaviour independent of the host: MX, so mail still arrives; the SPF, DKIM, DMARC and verification entries in TXT, so mail is still authenticated and services still trust you; CAA, so certificates can still be issued; and CNAME entries for subdomains such as www or autodiscover. A missing TXT value is the most common casualty of a quick zone copy.

Using it for two similar domains

Companies with several domains for the same brand want consistent mail and certificate settings. Comparing the main domain with each alias shows a missing DMARC policy marker, an extra SPF include, or a name server set that was never updated. The page lines up the values so that the single outlier is easy to spot. For deeper analysis of the mail records use the SPF Record Checker and DMARC Checker.

What is left out

TTLs are not compared because they count down in the resolver’s cache and would differ on every lookup. Records under subdomains other than the two names you typed are not examined, so compare www.example.com with www.example.net separately if you need that. DNSSEC records (DS and DNSKEY) are not part of this comparison; the DNSSEC Analyzer covers them.

A worked example

Press Sample to compare example.com and example.org. When this guide was reviewed the sections read: A records, different, each name with two addresses marked “(only here)”; AAAA, different; CNAME, none on either side; MX, identical, both with the null MX 0 .; NS, different, each pair at Cloudflare under separate server names; TXT, different, because each name has its own verification token even though both have v=spf1 -all; CAA, none on either side. Even for two sibling domains run by the same registry team, the tool shows exactly which records are shared.

Limits

The comparison uses one public resolver, so recently changed values may be stale for up to their TTL. Addresses that legitimately differ between two hosts appear as differences and need human judgement. The page cannot see records you have not asked about, or DNS data that only exists on internal networks.

Related tools

• DNS Propagation Checker compares one name across two resolvers.
• DNS Lookup shows all records of one domain.
• BIND Zone File Generator builds the zone file for a new provider.
• Diff Checker compares exported zone files or any other text.