Guide
Reading DNS answers: record types, status codes and TTLs
The Domain Name System answers questions about names, and nearly every troubleshooting session on websites, email and certificates starts with the same step: what does DNS say? The page asks a public resolver for the records you tick and lays the answers out as tables, with the status and timing information that dig would print.
How the lookup is made
Your browser sends a DNS-over-HTTPS request, in the JSON format both Cloudflare and Google provide, to the resolver you choose: cloudflare-dns.com for 1.1.1.1 or dns.google for 8.8.8.8. The resolver does the real work of walking from the root servers down to the domain’s authoritative servers and returns the result, usually from its cache. Nothing is sent until you press Look up, and nothing goes to openWorkstand. You can paste a web address or an email address as well as a plain name: the page strips the scheme, path, port and user name, and converts international domain names to their ASCII (punycode) form first.
The fourteen record types
The default selection covers A and AAAA (addresses), CNAME (aliases), MX (mail), NS (name servers), TXT (text, including SPF and verification strings), SOA (zone authority) and CAA (certificate policy). You can add SRV (service locations), PTR (reverse names), NAPTR (rewrite rules), DS and DNSKEY (DNSSEC) and HTTPS (service binding with hints such as supported protocols). One table appears per type with its name, type, TTL and data, or a note that there are none.
Status, TTL and the AD flag
Under each table the page prints which resolver answered, how many milliseconds it took, the DNS status and whether the resolver validated DNSSEC. NOERROR means the query worked, even if the table is empty. NXDOMAIN means the name does not exist. SERVFAIL means the resolver could not obtain a trustworthy answer. REFUSED means it declined the query. “DNSSEC validated (AD)” means the resolver checked the signatures and they were valid; it only appears for signed domains. The TTL is the number of seconds the answer may still be cached, so it falls between lookups.
A worked example
Press Sample to look up example.com, a name the IANA reserves for documentation. When this guide was reviewed, the answer had two A records and two AAAA records, no CNAME and no CAA, a name-server pair at Cloudflare, an SOA record naming one of those servers, and a TXT record v=spf1 -all, which says that no server may send mail for the domain. The MX table held a single record 0 ., a null MX (RFC 7505) that states the domain accepts no mail. Cloudflare reported NOERROR and DNSSEC validated for each type, and a response time of tens of milliseconds. Addresses and TTLs change over time; the structure does not.
What this page cannot do
A public resolver caches, so a record you changed minutes ago may not show yet; the DNS Propagation Checker compares two resolvers to spot this. The page cannot ask a particular authoritative server, show the delegation path or reveal records the resolver filters. Browsers allow cross-origin requests only to resolvers that permit them, which is why only these two are offered. Split-horizon or internal DNS names cannot be seen at all.
Related tools
- A Record Lookup focuses on IPv4 addresses and their kind.
- MX Lookup resolves the mail servers of a domain.
- TXT Record Lookup labels SPF, DMARC and verification strings.
- DNS Propagation Checker compares two resolvers after a change.
Checked against the current version of the DNS Lookup on .