Login

DNS lookup

Check a domain's DNS records on Cloudflare and Google at once.

Record types

How to read your result

  • Both agree. Same values from both. The TTLs can differ, and that's normal. Each number is how many seconds that resolver will keep its copy. Google caps its copies at about six hours, so a long TTL looks shorter there.
  • Records differ. One resolver has a value the other doesn't. Either one of them is still holding an older answer, or the domain hands out different addresses by location or in rotation. Google passes your approximate network to the domain's nameservers (a feature called EDNS Client Subnet) and Cloudflare doesn't, so domains that answer by location can split this way. "Likely rotation" means both returned the same number of records and every TTL is five minutes or less, which is how rotating and location-based domains usually look. "Likely a split TXT set" means each resolver returned part of a large TXT set, which is usually harmless.
  • No record, or no name. "No A record at this name" means the name exists and has nothing of that type. "Doesn't exist" means no records of any type: a typo, an unregistered domain, or a subdomain nobody has created yet. Resolvers keep that answer for the zone's negative-cache time (RFC 2308), so looking a name up before you create it can delay the new record by that long.
  • Couldn't check. A resolver didn't answer within 8 seconds, or your browser blocked the request. It says nothing about the domain.
  • SERVFAIL. The resolver got through, but the domain's nameservers didn't give it a valid answer, for example because its DNSSEC signatures don't check out.

Example: a name that doesn't exist, answered as if it did

Look up this-does-not-exist-29871.example.com. Both resolvers return NOERROR with an empty answer. That's the same reply a real name with no A record gets. example.com is hosted on Cloudflare's DNS with DNSSEC turned on. In signed zones, Cloudflare answers a missing name this way and adds a marker called NXNAME to the DNSSEC data. A made-up subdomain of google.com gets a plain NXDOMAIN instead.

A checker that reads only the status code would report the first name as having no A record, and you'd go looking for a record nobody needs. When every type comes back empty, our tool asks once more with DNSSEC data on and reads the marker, so it can tell you the name doesn't exist.

What to check in each DNS record

Type
What it holds
What to check
A
IPv4 address
It points at the server you expect. Several addresses are normal for big sites.
AAAA
IPv6 address
It matches your server, or there's none if your server has no IPv6 address.
CNAME
An alias pointing at another name
Nothing else sits at the same name, because a CNAME can't share its name with other records. That's why a bare domain, which always has NS and SOA records, can't use one.
MX
Mail servers, each with a preference number
The lowest number is the server mail tries first. A single "0 ." record means the domain accepts no email.
TXT
Free text: SPF, site verification strings
Exactly one record starts with v=spf1; two is an error. DMARC lives at _dmarc.yourdomain.com, as a TXT record starting with v=DMARC1.
NS
The nameservers that answer for the domain
They match the nameservers set at your registrar.
SOA
Primary nameserver, contact, serial number and timers
The serial is the zone's version number. The last number is the longest resolvers remember a "doesn't exist" answer.
CAA
Which certificate authorities may issue certificates for the domain
If there are any issue records, your certificate provider must be named in one. For wildcard certificates, issuewild records take precedence when present, so name it there too.

DNS propagation: how long a change takes

Nothing actually travels. Your DNS host serves the new record the moment you save it. Each resolver keeps its old copy until the TTL runs out, then asks again. So the wait depends on what you changed.

  • Changing a record (a new server IP, a new mail provider) takes at most the old record's TTL. At 3,600 seconds, every resolver that honors the TTL has the new value within an hour. Planning a move? Lower the TTL to 300 first, wait out the old TTL, then make the change. It reaches those resolvers within five minutes.
  • Changing nameservers is slower. The .com registry publishes every domain's nameservers with a 172,800-second TTL (two days), and a resolver can keep the old ones that long. That's why the usual advice is to allow 24 to 48 hours. Keep your old DNS host serving the same records for those two days so visitors reach you either way. If your domain uses DNSSEC, remove the DS record at your registrar and let its TTL run out before you switch. If you don't, resolvers that check signatures will return SERVFAIL for it. Our guide to changing nameservers at your registrar walks through it.

When one resolver shows the new value and the other still shows the old one, you're watching it happen: one cache has run out and the other hasn't yet.

How this DNS checker works

Your browser sends each query straight to Cloudflare's and Google's public DNS-over-HTTPS services, both at once. The queries don't pass through an American Cloud server. Cloudflare and Google see your IP address, as with any request your browser makes.

Limits: these are resolvers with caches, not your domain's own nameservers, so a record you saved a minute ago may not show yet. There's no SRV, reverse (PTR) or ANY lookup.

Sources (checked October 14, 2026)

Host your DNS with American Cloud

You're probably here because you changed something and want to see it take effect. If it doesn't, you want a person on the other end, and our median support response time is under 2 minutes. DNS hosting is free with every American Cloud account: unlimited zones, records and queries, and every record type this tool checks, plus SRV. Point your registrar at ns1.americancloud.org and ns2.americancloud.org, then come back here to watch the switch. Read how to set up a zone or see what's included.

Get started