DNS Lookup Tool

The DNS Lookup Tool queries Domain Name System (DNS) records to retrieve information about domains and their configurations. DNS is the internet's phone book, translating human-readable domain names (like google.com) into IP addresses (like 142.250.185.46) that computers use to communicate. This tool displays various DNS record types including A (IPv4), AAAA (IPv6), MX (mail servers), NS (nameservers), TXT (text records for verification and policies), CNAME (aliases), and SOA (zone authority). Whether you're troubleshooting email delivery, verifying DNS propagation, investigating domain configuration, or learning about DNS infrastructure, this tool provides comprehensive DNS record analysis.

The Domain Name System (DNS) is a hierarchical, distributed database that maps domain names to IP addresses and other resource records. Understanding DNS records is fundamental to internet operations.

DNS Record Types:

• A Record (Address): Maps domain to IPv4 address
  • Format: domain.com IN A 192.0.2.1
  • Most common record type
  • Multiple A records = round-robin load balancing
  • TTL controls caching duration
• AAAA Record (IPv6 Address): Maps domain to IPv6 address
  • Format: domain.com IN AAAA 2001:db8::1
  • Growing in importance as IPv4 exhausts
  • Browsers prefer IPv6 when available (Happy Eyeballs algorithm)
• MX Record (Mail Exchange): Specifies mail servers for domain
  • Format: domain.com IN MX 10 mail.domain.com
  • Priority number: lower = higher preference
  • Used by email servers for routing
  • Multiple MX records provide redundancy
  • Example: Gmail uses multiple aspmx servers
• NS Record (Name Server): Delegates domain to DNS servers
  • Format: domain.com IN NS ns1.nameserver.com
  • Points to authoritative nameservers
  • Typically 2-4 nameservers for redundancy
  • Critical for DNS resolution
• TXT Record (Text): Arbitrary text data
  • Format: domain.com IN TXT "v=spf1 ..."
  • Uses: SPF (email auth), DKIM, DMARC, site verification
  • Max 255 characters per string, multiple strings allowed
  • Example: Google site verification codes
• CNAME Record (Canonical Name): Alias to another domain
  • Format: www.domain.com IN CNAME domain.com
  • Points one domain to another
  • Cannot coexist with other records at same name
  • Common for www to root domain redirect
• SOA Record (Start of Authority): Zone metadata
  • Primary nameserver (MNAME)
  • Admin email (RNAME, @ replaced with .)
  • Serial number (version, usually YYYYMMDDNN format)
  • Refresh, Retry, Expire, Minimum TTL timers
  • One SOA per zone

Other Common Record Types:

• CAA (Certification Authority Authorization): Specifies which CAs can issue certificates
• SRV (Service): Defines location of services (e.g., _sip._tcp.domain.com)
• PTR (Pointer): Reverse DNS lookup (IP to domain)
• DNSKEY, DS, RRSIG: DNSSEC records for authentication

DNS Resolution Process:

1. Local cache check: Browser/OS checks cached records
2. Recursive resolver: Query ISP or public DNS (8.8.8.8, 1.1.1.1)
3. Root nameserver: Returns TLD nameserver (.com, .org)
4. TLD nameserver: Returns authoritative nameserver for domain
5. Authoritative nameserver: Returns actual record (A, MX, etc.)
6. Return to client: Result cached based on TTL

TTL (Time to Live):

• Specifies how long (seconds) DNS record should be cached
• Low TTL (60-300s): Fast propagation, high query load
• High TTL (3600-86400s): Slower propagation, reduced query load
• Strategy: Lower TTL before changes, raise after propagation

SPF, DKIM, DMARC (Email Authentication):

• SPF (Sender Policy Framework): TXT record listing authorized mail servers
  • Format: "v=spf1 ip4:192.0.2.0/24 include:_spf.google.com ~all"
  • ~all = soft fail, -all = hard fail
  • Prevents email spoofing
• DKIM (DomainKeys Identified Mail): Public key for email signature verification
  • TXT record at selector._domainkey.domain.com
  • Contains RSA public key
  • Verifies email authenticity and integrity
• DMARC (Domain-based Message Authentication): Policy for SPF/DKIM failures
  • TXT record at _dmarc.domain.com
  • Format: "v=DMARC1; p=quarantine; rua=mailto:reports@domain.com"
  • Policies: none, quarantine, reject

DNS Query Tools:

• dig (Linux/Mac): Comprehensive DNS query tool

  # Query A record
  dig google.com
  
  # Query specific record type
  dig google.com MX
  
  # Query specific DNS server
  dig @8.8.8.8 google.com
  
  # Trace full resolution path
  dig +trace google.com

• nslookup (Cross-platform): Simple DNS lookup

  nslookup google.com
  nslookup -type=MX google.com

• host (Linux/Mac): Simple DNS lookup

  host google.com
  host -t MX google.com

DNS Propagation:

• Time for DNS changes to spread globally
• Affected by TTL values
• Typically 1-24 hours (most within 1-2 hours)
• Check propagation: whatsmydns.net, dnschecker.org
• Flush local cache to see changes immediately:
  • Windows: ipconfig /flushdns
  • Mac: sudo dscacheutil -flushcache
  • Linux: sudo systemd-resolve --flush-caches

Public DNS Resolvers:

• Google Public DNS: 8.8.8.8, 8.8.4.4 (IPv4) | 2001:4860:4860::8888 (IPv6)
• Cloudflare DNS: 1.1.1.1, 1.0.0.1 (IPv4) | 2606:4700:4700::1111 (IPv6)
• Quad9: 9.9.9.9 (blocks malicious domains)
• OpenDNS: 208.67.222.222, 208.67.220.220 (with filtering options)

Common DNS Issues:

• NXDOMAIN: Domain does not exist (typo or not registered)
• SERVFAIL: DNS server encountered error (misconfiguration)
• Timeout: DNS server unreachable (firewall, network issue)
• Wrong IP: DNS cache not updated (flush cache, check TTL)
• Email not delivered: Check MX records, SPF, DKIM, DMARC

DNS Security (DNSSEC):

• Cryptographic authentication of DNS responses
• Prevents DNS cache poisoning attacks
• Uses DNSKEY, DS, RRSIG records
• Chain of trust from root to domain
• Adoption growing but not universal

Best Practices:

• Use multiple nameservers (2-4) for redundancy
• Set appropriate TTL values (balance flexibility vs caching)
• Implement SPF, DKIM, DMARC for email security
• Use CAA records to restrict certificate issuance
• Monitor DNS changes for unauthorized modifications
• Consider DNSSEC for high-security domains
• Use anycast DNS for performance and DDoS protection