DNS Lookup
Every record for a domain, plus a zone health read that flags missing MX, SPF, DMARC and CAA.
Most DNS tools dump a list of records and leave you to spot what's wrong. This one reads the zone. Type a domain and we pull every record (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA), then tell you what's missing: no MX so mail bounces, no SPF or DMARC so your email gets spoofed and filtered, no CAA so any authority can mint a certificate, no IPv6, a CNAME stuck at the apex. The raw records are all there with their TTLs and a one-click copy, but the part that saves you an afternoon is the read on top. We relay the query through our own service and throw the name away, nothing logged.
Queries run through the PacketNebula lookup service. We log nothing.
The lookup service is not reachable.
In local preproduction, start it with npm run api then . The rest of the site works without it.
What the health read checks
A pile of records does not tell you whether a domain is set up well, so on an All lookup we read the zone the way you would in a review: is there an MX so it can receive mail, an SPF and a DMARC so the mail it sends is trusted, a CAA to stop any CA issuing certificates for it, an AAAA for IPv6. Each gap is flagged with what it actually costs you, because a missing SPF is a deliverability problem and a CNAME at the apex is a spec violation, not just a blank line.
Propagation without the superstition
"Waiting for propagation" is mostly waiting for caches to expire. The authoritative servers answer with the new value the instant you publish; everyone else serves the old one until its TTL runs out. So query right after the change, confirm the new value is live, note the old TTL, and that is your worst case. If a record still shows the old value past its TTL, suspect a second copy of the zone or a resolver that ignores TTLs, not magic.
Frequently asked questions
Why do I see different IP addresses than a colleague?
Plenty of honest reasons: CDNs and load balancers answer with addresses close to whoever asks, round-robin rotates the order, and caches at different ages serve different snapshots. If the difference survives across resolvers and past the TTL, then you might be looking at split-horizon DNS or a hijack worth a closer look.
What does TTL mean in the results?
Time to live, in seconds: how long a resolver may cache the record before asking again. 300 means changes spread within five minutes, 86400 means a day. Before moving a service, drop the TTL a day ahead so the switch is fast, then put it back up afterwards.
My domain shows no AAAA. Is that a problem?
No, it just means nobody published an IPv6 address, so the site is not reachable over IPv6 directly. It is common and not an error. With IPv6 adoption past 40% on Google's own numbers, a new deployment may as well publish both A and AAAA, but an existing site is fine without it.
What is a CAA record and do I need one?
Certification Authority Authorization lists which CAs are allowed to issue certificates for your domain, and CAs have been required to honour it since 2017. One line like "0 issue letsencrypt.org" shuts the door on mis-issuance by every other CA. It costs nothing and takes two minutes.
Is the domain I look up stored anywhere?
No. Browsers cannot send raw DNS queries, so we relay yours through a small service, which queries the resolver and discards the name. We keep no history of what anyone looks up.