How to Check DNS Records for Any Domain

Updated September 9, 2026

To check a domain's DNS records, open DNS Kit's DNS Lookup, enter the domain, and choose a record type. From a terminal, run dig example.com A for an IPv4 address or dig example.com MX for mail servers. On Windows, use nslookup -type=MX example.com. Replace example.com with the domain you want to check.

Whether you're troubleshooting a website that won't load, verifying email configuration, or auditing a domain's DNS setup, knowing how to look up DNS records is an essential skill. This guide walks through three methods — from the simplest to the most powerful.

Method 1: Using DNS Kit's DNS Lookup Tool

The fastest way to check DNS records is with an online tool that does the work for you.

Step-by-Step

1. Open DNS Kit's DNS Lookup tool — navigate to the DNS Lookup page.
2. Enter the domain name — type the domain you want to check (e.g., example.com). Don't include http:// or https://.
3. Select the record type — choose the type of record you want to look up (A, MX, TXT, CNAME, etc.), or select "All" to see everything.
4. View the results — the tool displays all matching records with their values, TTL, and additional context.

What You'll See

The results include:

• Record type — A, AAAA, MX, TXT, CNAME, NS, etc.
• Value — The record data (IP address, hostname, text content)
• TTL — How long the record is cached (in seconds)
• Priority — For MX records, the priority value

This method is ideal for quick lookups and for users who aren't comfortable with command-line tools.

Method 2: Using the dig Command

dig (Domain Information Groper) is the most powerful DNS lookup tool available. It comes pre-installed on macOS and most Linux distributions.

Basic Queries

# Look up A records (default)
dig example.com

# Look up a specific record type
dig example.com MX
dig example.com TXT
dig example.com AAAA
dig example.com NS
dig example.com CAA

# Get only the answer (concise output)
dig example.com +short
dig example.com MX +short

Reading dig Output

A full dig response looks like this:

; <<>> DiG 9.18.18 <<>> example.com
;; QUESTION SECTION:
;example.com.            IN    A

;; ANSWER SECTION:
example.com.     3600    IN    A    93.184.216.34

;; AUTHORITY SECTION:
example.com.     86400   IN    NS   ns1.example.com.

;; Query time: 23 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)

The number 3600 in the ANSWER section is the TTL — this record is cached for 3600 seconds (1 hour).

Advanced dig Queries

# Query a specific DNS server
dig @8.8.8.8 example.com A
dig @1.1.1.1 example.com MX

# Query the authoritative nameserver directly
dig @ns1.example.com example.com A

# Look up DKIM record
dig TXT google._domainkey.example.com +short

# Look up DMARC record
dig TXT _dmarc.example.com +short

# Look up SPF (it's a TXT record)
dig TXT example.com +short

# Trace the full resolution path
dig example.com +trace

The +trace option follows the delegation chain from root servers through the TLD to your domain's nameservers. DNS Kit's Delegation Trace provides the same information in a visual format with DNSSEC validation at each zone level. For more on how delegation works, see our DNS delegation guide.

Method 3: Using nslookup

nslookup is available on Windows, macOS, and Linux. It's simpler than dig but less detailed.

Basic Queries

# Look up A records
nslookup example.com

# Look up a specific record type
nslookup -type=mx example.com
nslookup -type=txt example.com
nslookup -type=aaaa example.com
nslookup -type=ns example.com
nslookup -type=cname www.example.com

# Use a specific DNS server
nslookup example.com 8.8.8.8
nslookup -type=mx example.com 1.1.1.1

Reading nslookup Output

Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
Name:    example.com
Address: 93.184.216.34

The "Non-authoritative answer" label means the response came from a cache, not directly from the authoritative nameserver.

What Records to Check by Scenario

Troubleshooting a Website

Troubleshooting Email

For a detailed email troubleshooting workflow, see our guide on how to check email authentication.

Verifying DNS Changes

When you've made a DNS change and want to verify it's propagating:

# Check the authoritative server (should show new value immediately)
dig @ns1.your-provider.com example.com A +short

# Check major public resolvers
dig @8.8.8.8 example.com A +short      # Google
dig @1.1.1.1 example.com A +short      # Cloudflare
dig @9.9.9.9 example.com A +short      # Quad9
dig @208.67.222.222 example.com A +short  # OpenDNS

If the authoritative server shows the new value but public resolvers show the old one, propagation is in progress. See our DNS propagation guide for more details.

Common Issues and Solutions

"No answer" or Empty Response

• The record type may not exist for that domain. Not every domain has every record type.
• Double-check the domain name for typos.
• For DKIM records, you need the correct selector: dig TXT selector._domainkey.example.com.

Different Results from Different Resolvers

This is normal during DNS propagation. Each resolver caches records independently. Wait for the old TTL to expire, or query the authoritative server to see the current true value.

"SERVFAIL" Response

This usually indicates a DNSSEC validation failure or a misconfigured nameserver. Check that your nameservers are operational and, if you use DNSSEC, that your key chain is valid.

Truncated TXT Records

Some tools truncate long TXT records (like DKIM keys). Use dig +short or check that your DNS provider is serving the full record. See our DKIM guide for details on key length and DNS limitations.

Quick Reference

For a complete reference of all record types and their purposes, see our DNS record types guide.