DNS Lookup

What a DNS lookup tells you

DNS is the directory that turns a name into the facts a program needs to use it. Before your client can send a single byte to api.example.com, it has to ask DNS for an address, and a wrong or missing answer fails the request before HTTP is involved at all. A lookup shows you that answer directly, taken from outside your own network, so you can separate “the name is wrong” from “the server is down” from “my machine has something stale cached”.

The record types

“All common” runs the first eight in one go. SRV is left out of that set because its records live at service-specific names rather than at the domain itself, and PTR is used automatically when you enter an IP address.

Reading the results

TTL: how long an answer may be cached

Each record carries a time to live in seconds. A resolver that has fetched the record may reuse it for that long without asking again. The TTL shown here is what remains on the public resolver's cached copy, so it counts down between lookups and resets when the resolver refetches. This is the whole reason “DNS propagation” takes time: nothing is being pushed outward, old answers are simply expiring from caches at their own pace. Lower the TTL a day before a planned change, and the change will be seen everywhere within minutes.

“No records of this type” is not “does not exist”

A name can exist and have no record of the type you asked for. example.com may have an A record and no AAAA; that is an empty answer, and it is normal. NXDOMAIN is different: it means the name itself is not in DNS at all. If you expected it to be, the usual causes are a typo, a record created in the wrong zone, or a domain whose registration has lapsed.

A CNAME replaces everything else

A name that has a CNAME may not have any other record. Resolvers follow the alias, so a lookup for A on such a name returns the addresses of the target. Two consequences catch people out. A CNAME cannot be placed at the root of a domain, because the root must hold NS and SOA records; DNS providers offer flattening or ALIAS records to work around that. And a TXT verification record cannot be added to a subdomain that is already a CNAME.

TXT records worth recognising

DKIM and DMARC live at their own names, so looking up the bare domain will not show them. Enter the full name, underscore included.

Why this answer may differ from what your machine sees

This tool asks two large public resolvers. Your computer asks whatever resolver your network assigned, after first consulting its own cache and its hosts file. When the two disagree, the difference is the diagnosis.

• Correct here, wrong for you. Something local is stale or overridden: the operating system's DNS cache, the browser's own cache, a hosts file entry, or a company resolver serving an internal view of the name.
• Wrong here, correct for you. You are probably seeing an internal or split-horizon record that the public internet does not get, which is why a webhook provider cannot reach a host that works from your desk.
• Different addresses each time. Normal for large services. They return several addresses in rotating order, or different ones by region, to spread load.
• Old value here after a change. The previous record's TTL has not run out yet on the public resolver. Wait that long before concluding the change failed.

To see your own machine's view, use nslookup example.com on Windows or dig example.com on macOS and Linux. Adding a resolver address, dig @1.1.1.1 example.com, asks a specific public one and should match what you see here.

DNS problems that look like API problems

• “Could not resolve host.” The client's error for a failed lookup; curl reports it as exit code 6. Check the A record here. If it exists, the fault is in the client's resolver, not the API.
• A webhook that never arrives. The provider resolves your endpoint from the public internet. If the name has no public A or AAAA record, nothing can be delivered. See how webhooks are delivered, and use the webhook tester for a URL that is certainly reachable.
• A custom domain stuck on “pending”. The service is waiting to see a specific CNAME or TXT record. Look it up here to confirm it is published exactly as asked, at exactly the name asked.
• A certificate that will not issue. A CAA record that omits your certificate authority forbids it from issuing. Once the certificate exists, the SSL checker shows whether it is installed correctly.
• Right address, wrong response. If DNS is correct and the request still fails, the problem has moved up a layer. Send the request from the API tester and read the status code; a 502 or a Cloudflare 523 points at the server behind the name.

Frequently asked questions

Related tools and reference