DNS Lookup

What is a DNS lookup?

A DNS lookup asks the Domain Name System for the records published for a domain or host name. DNS is the internet’s address book: it turns names people can remember, like prosyo.com, into the IP addresses computers connect to, and it holds the instructions that run email (MX, SPF, DKIM, DMARC), domain verification and security policies.

This free DNS lookup tool queries a public DNS-over-HTTPS resolver and returns the live records for any name: A, AAAA, CNAME, MX, TXT, NS, SOA and CAA. Choose one record type, or “ALL” to see every type at once, with each record’s TTL and full value. Nothing is installed and nothing you type is stored.

Key takeaways

• DNS holds the records that run your website and your email.
• MX receives mail; SPF, DKIM and DMARC are TXT or CNAME records that authenticate it.
• Changes take up to the old record’s TTL to show everywhere.
• Edit records wherever your NS records point, not necessarily at your registrar.
• A name with a CNAME cannot have any other record type.

How to use the DNS lookup tool

1. Enter a domain or host name, such as example.com, mail.example.com or _dmarc.example.com. URLs and email addresses are trimmed to the name automatically.
2. Pick a record type, or leave “ALL” to query A, AAAA, CNAME, MX, NS, TXT, SOA and CAA together.
3. Press “Run DNS lookup”. The table shows each record’s type, name, TTL in seconds and value.
4. Copy what you need. TXT values are shown joined and unquoted, which is how mail servers read them.

DNS record types explained

Understanding TTL

TTL (time to live) is how long, in seconds, other servers may cache a record before asking again. A TTL of 300 means five minutes; 3600 means an hour; 86400 means a day. When you change a record, servers that cached the old value keep using it until its TTL runs out. That is the real meaning of “DNS propagation”: not records travelling around the world, but caches expiring.

A practical tip: before a planned change, such as moving email providers, lower the TTL on the records you will change to 300 a day in advance. The switch then takes effect within minutes instead of hours. Raise it again afterwards.

Useful lookups for email and cold outreach

For a guided check of all the email records at once, with a score and fixes, use the Domain Health Checker. For a single record with full explanations, use the SPF Checker, DKIM Checker or DMARC Checker.

Troubleshooting with DNS lookups

“I changed a record but nothing happened”

First, check the NS records. If your domain’s nameservers belong to Cloudflare, editing records at your registrar does nothing, and the reverse is also true. Second, check the TTL of the old value; caches may hold it for that long. Third, check for a typo in the host field; some DNS editors add the domain automatically, so typing the full name creates a doubled name.

“My verification TXT record is not found”

Look up the exact name the service asked for. Some services want the TXT record on the root (@), others on a specific subdomain. Look for stray quotes or spaces in the value; the tool shows it exactly as resolvers return it.

“A subdomain shows a CNAME and nothing else”

That is normal. A name with a CNAME cannot have other records; the answers come from the target name. If you need an MX or TXT record on that subdomain, it cannot also be a CNAME.

“The domain returns NXDOMAIN”

The name does not exist in DNS. Either it is misspelled, the domain has expired, or the subdomain was never created.

Why the results come from a public resolver

This tool asks Cloudflare’s public resolver over HTTPS, falling back to Google’s if needed. Public resolvers return the answers anyone on the internet would get, which is what matters for email delivery and websites. Two consequences to know:

• Results may come from the resolver’s cache. If you changed a record seconds ago, the old value may appear until its TTL expires.
• Internal or split-horizon DNS (records only visible inside a company network) will not appear.

Command-line equivalents

• macOS and Linux: dig example.com TXT +short, dig example.com MX +short
• Windows: nslookup -type=TXT example.com
• Asking a specific resolver: dig @1.1.1.1 example.com MX

The browser tool gives the same answers without a terminal, formats TXT records for reading and works on any device.

DNS hygiene for teams that send email

• Keep a record inventory. Note what each TXT and CNAME record is for. Old verification records pile up and nobody dares delete them.
• Use one DNS host per domain. Records split across hosts cause most “it is set up but not working” problems.
• Protect domains you do not send from. Publish v=spf1 -all and a DMARC p=reject so nobody can spoof them.
• Review after every new tool. Each sending tool you add tends to bring an SPF include and a DKIM record; check them the day you connect it.
• Add CAA records listing the certificate authorities you use, so no one else can issue a certificate for your domain.

Every DNS record a new sending domain needs

If you are setting up a domain for email, including a secondary domain for cold outreach, these are the records to publish, in order. Use this tool to confirm each one after you add it.

Then run the Domain Health Checker for a scored summary.

Where to edit DNS at common hosts

• Cloudflare: dashboard, select the domain, DNS, Records. Mail-related records must be “DNS only” (grey cloud).
• GoDaddy: My Products, the domain, DNS or Manage DNS.
• Namecheap: Domain List, Manage, Advanced DNS.
• Squarespace Domains: Domains, the domain, DNS, DNS settings.
• Google Cloud DNS, AWS Route 53, Azure DNS: the hosted zone for the domain in each console.

If the NS records point elsewhere, edits at your registrar have no effect; make changes wherever the nameservers point.

A note on DNSSEC

DNSSEC adds cryptographic signatures to DNS answers so resolvers can tell records were not forged in transit. It is switched on at your DNS host and registrar together. It protects against a specific class of attacks rather than improving deliverability directly, but it is a sensible default for important domains, and some security policies require it.

DNS lookups in prospecting

Public DNS also tells you useful context about a target company: which email provider and security gateway it uses (MX), which marketing, support and sales tools it has verified (TXT verification records often name the service), and whether its email is well configured. Treat this as light context, not a reason to mention someone’s tech stack in a first message, which usually reads as creepy rather than relevant.

Worked example: checking a new outreach domain

Say you have just set up getacme.com for outreach on Google Workspace. Run “ALL” on getacme.com and you should see:

• NS records pointing to your DNS host, confirming where to edit.
• A records for the website redirect.
• MX showing 1 smtp.google.com.
• TXT records including google-site-verification=… and v=spf1 include:_spf.google.com ~all.

Then look up google._domainkey.getacme.com as TXT for the DKIM key, and _dmarc.getacme.com as TXT for the DMARC record. If any is missing, add it at the host shown in the NS records and run the lookup again. Finally, run the Domain Health Checker for a single score before warm-up begins.

Reading an SOA record

The SOA (start of authority) record describes the zone itself. Its fields are the primary nameserver, the administrator’s email (written with a dot instead of the @), a serial number that changes every time the zone is edited, and timers that control how secondary servers refresh. The serial is the useful part for troubleshooting: if it has not changed after your edit, the edit has not been published.

CAA records in brief

A CAA record lists the certificate authorities allowed to issue HTTPS certificates for your domain, such as 0 issue "letsencrypt.org". If no CAA record exists, any authority may issue. Adding CAA records for the authorities you actually use is a small, worthwhile security step.

DNS for agencies managing client domains

Agencies that run outreach for clients often manage dozens of domains across several DNS hosts. A few habits prevent most problems: keep a sheet of every domain with its DNS host, registrar, renewal date and the records you added; use the same naming for secondary domains across clients; check every domain with this tool after any change; and run the Domain Health Checker on each before a client’s campaign starts. Renewal lapses are a surprisingly common cause of sudden outreach failure: an expired domain stops resolving, and every email and reply disappears.

Glossary

• Resolver: the DNS server that finds answers on your behalf, such as 1.1.1.1 or 8.8.8.8.
• Authoritative nameserver: the server that holds the real records for a domain, named in its NS records.
• Zone: all the records for a domain at its DNS host.
• Propagation: the time until cached copies of an old record expire everywhere.
• DNS-over-HTTPS (DoH): DNS queries sent over encrypted HTTPS, as this tool does.
• Apex (root): the domain itself, such as example.com, written as @ in most DNS editors.

Verification TXT records you may find

Many services ask you to prove you own a domain by publishing a TXT record. Seeing them in a lookup is normal. Common examples include google-site-verification=… (Google Search Console and Workspace), MS=… (Microsoft 365), facebook-domain-verification=…, apple-domain-verification=… and similar records from marketing, analytics and security tools. Once a service is verified, some can be removed, but many services re-check periodically; keep a note of which records belong to which tool before deleting any.

How Prosyo helps

Once your DNS is right, Prosyo handles the rest of outbound: it finds people who fit your ideal customer, verifies their contact details, writes personal LinkedIn and email messages from what they actually posted, and sends from your own accounts inside safe limits. Try it free for 7 days.

Related free tools

These tools are often used together with the DNS Lookup. All of them are free, and the checkers and calculators run instantly in your browser.

• Domain Health Checker: Score your sending domain on MX, SPF, DKIM, DMARC, BIMI, MTA-STS and blocklists in one click, with a fix for everything that fails.
• MX Lookup: See which mail servers receive email for any domain, their priority, their IP addresses and the provider behind them.
• SPF Checker: Validate your SPF record, count its DNS lookups against the limit of 10 and see every include it depends on.
• DMARC Checker: Read your DMARC policy in plain English, get a grade from A to F and a safe path to full enforcement.