MX Record Lookup

About DNS Lookup

One lookup returns the eight record types that answer most questions: A and AAAA for addresses, MX for mail routing, TXT for SPF and domain verification, NS for delegation, CNAME for aliases, SOA for the zone's authority and serial, and CAA for which authorities may issue certificates.

The query runs from the server rather than from your browser, so what you see is a public resolver's view of the zone — useful precisely when your own machine, VPN or corporate resolver is answering differently.

The answers come back as a table laid out the way a DNS manager lays one out: type, the name the record is actually attached to, the value written as a zone file writes it, and the TTL. The TTL is the reason for the table — it is the number people check before a migration, and Node's own resolver parses it out of the answer and then throws it away for every type except A and AAAA, so the query is sent on the wire and the whole answer kept. Anything under five minutes is marked, because a five-minute TTL is something somebody set deliberately and then, often, forgot to put back.

Where it helps

• Eight record types in one pass instead of eight separate dig invocations.
• A record table with the TTL on every row — type, name, value and TTL, the way a DNS manager lays a zone out.
• Answers come from outside your network, bypassing local caches and split-horizon DNS.
• TXT records are shown in full, so long SPF and DKIM values are readable.
• Record types with no answer are shown as empty rather than as an error.

Limits

• It uses the backend's resolver, so results reflect that resolver's cache, not necessarily the authoritative zone.
• It uses the backend's resolver, so a TTL is what is left of that resolver's cached copy rather than the zone's full value.
• No DNSSEC validation, and no arbitrary record types such as SRV or PTR (reverse lookups live in IP Lookup).
• It does not query a specific nameserver, so it cannot confirm one server in a set is out of sync.

Frequently asked questions

I changed a record — why do I still see the old value?

Propagation is just caching: resolvers hold the previous answer until its TTL expires. Lower the TTL before a planned change, then wait it out.

Why is the answer here different from dig on my laptop?

Different resolver, different cache — and corporate networks often override public zones. That difference is usually the useful finding.

Why does the domain resolve in my browser but show nothing here?

Check for a CNAME at the apex or a wildcard record. It is also worth confirming you queried the exact host name, including any www.

What does a CAA record do?

It names the certificate authorities allowed to issue for the domain. A wrong CAA record makes issuance fail even when everything else is correct.

Related tools

• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• WHOIS — Registry records for a domain, an IP address or an AS number
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is

More Network & DNS tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is
• Ping (TCP) — Measure connection latency with repeated TCP probes
• What Is My IP — Your public address, and what a browser reveals about you
• WHOIS — Registry records for a domain, an IP address or an AS number
• DNS Propagation Checker — The same name asked of resolvers worldwide, and of the zone's own servers
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DKIM Lookup — A domain's DKIM keys, for a selector or by trying the common ones, and whether each is worth anything
• DMARC Lookup — A domain's DMARC policy, and what it actually asks receivers to do
• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• IP Blacklist Checker — Whether an address is on the blocklists that actually stop mail
• Reverse IP Lookup — What an address says about itself: its name, its certificate, its network
• Traceroute — Every hop between this server and a host, with the time each one took
• Broadband Speed Test — Download, upload, latency and jitter, measured from this tab
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Redirect Checker — Follow a URL's redirects hop by hop, and flag loops, downgrades and temporary redirects doing a permanent job
• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• MAC Address Lookup — Find the manufacturer behind a MAC address, and see what kind of address it is
• MAC to IP Converter — Build the IPv6 address a MAC forms with SLAAC, recover the MAC from one, or find a MAC's IP in an ARP table
• IP to MAC Lookup — Find the MAC address behind an IP: computed for multicast and EUI-64 addresses, or read from an ARP table
• DNSSEC Checker — Whether a domain's DNSSEC validates, and if not, whether it is the DS, a key, an algorithm or an expired signature