What does the DNS lookup show?
DNS translates names into addresses and holds much more: where mail goes, which name servers are responsible, which CAs may issue certificates. The lookup queries the most important types at once, as a public resolver currently sees them.
The most important record types
- A / AAAA: IPv4 and IPv6 address of a name.
- CNAME: alias to another name. A name with a CNAME may not have any other records, which is why a CNAME does not work on the domain itself.
- MX: mail servers of the domain; the lowest priority is tried first. An MX pointing to “.” (null MX) means the domain does not receive mail.
- NS and SOA: responsible name servers and zone management data. The negative TTL in the SOA defines how long “does not exist” is cached.
- TXT: free text, today mostly SPF, DMARC, DKIM and domain verifications for cloud services.
- CAA: which certificate authorities may issue certificates.
- SRV, HTTPS: services with port (e.g. SIP, XMPP, Autodiscover) and connection hints for browsers.
Reverse DNS and cross-check
An IP address has a PTR record under in-addr.arpa or ip6.arpa. It is maintained by whoever owns the address range, usually the provider or host. For mail servers it is mandatory: many receivers reject mail if the IP has no PTR or the PTR name does not point back to the same IP. The tool does this cross-check (FCrDNS) automatically.
Why do I see different values than my colleague?
Resolvers cache answers until the TTL expires. After a change some resolvers still see the old value. The lookup here goes to Google Public DNS. The TTL column tells you how long an old value can still appear at most.
FAQ
Which resolvers are used?
Google Public DNS (dns.google), Cloudflare (1.1.1.1) if it fails. Both validate DNSSEC. The lookup runs via the hollop.net server, so the resolvers do not see your IP address.
Can I query internal names?
No. Public resolvers only know public zones. For internal names use nslookup or Resolve-DnsName in your own network. The commands are shown under every result.
Why is a record I just created missing?
Either the change has not reached all name servers yet or the resolver still has the old answer cached. A “does not exist” is cached as long as the negative TTL in the SOA says.
What does “DNSSEC validated” mean?
The zone is signed and the resolver checked the signature chain up to the root. So the answer was not tampered with on the way. DNS works without DNSSEC too, just without this protection.
Why does “All important” show no SRV records?
SRV records live under their own names such as _sip._tcp.example.com. Enter that name and choose the SRV type.