Does this send my query anywhere?

Yes — the domain name goes to api.sitekits.dev, which resolves it and returns the records. A browser cannot make raw DNS queries, so a server step is unavoidable for this tool. Only the domain name is sent, it is processed in memory, and it is not written to any log or database we keep.

Which resolver is used?

Cloudflare's DNS-over-HTTPS endpoint (1.1.1.1). That means you are seeing what Cloudflare's resolver currently has cached, not what your own ISP resolver would return.

Why do I see a CNAME when I asked for A records?

Because that is the real answer. When a hostname is an alias, the resolver returns the CNAME chain along with the address records, and filtering it out would show "no records" for a domain that resolves perfectly well. Records are labelled by the type the resolver actually returned, not the type you asked for.

I just changed a record and it still shows the old value.

You are seeing a cached answer. The TTL column tells you how many seconds the resolver intends to keep it. Lower the TTL before a planned change, not after.

Why is there no SOA, SRV or CAA button?

The lookup requests the six most commonly needed types in one round trip and the buttons filter that result client-side. The API itself accepts SOA, SRV, CAA and PTR if you call it directly.

DNS Lookup Tool

Overview

DNS is the step before every other step. When a site is unreachable, when mail bounces, or when a deploy went out but nobody can see it, the first question is almost always what the name currently resolves to — and the second is who is telling you that.

This tool asks a public DNS-over-HTTPS resolver for the six record types you need most often and shows the answers with their TTLs. Because a browser cannot open a DNS socket, the query goes through our API rather than staying local; that is the one thing on this site that has to leave your machine, and the privacy policy describes exactly what happens to it.

How to use

Enter a domain — example.com, not https://example.com/path.
Read the records. Each row shows its type, name, value and TTL.
Use the type buttons to filter what is already on screen. They do not send a new query.

What each record type tells you

Type	Answers the question
`A`	Which IPv4 address serves this name
`AAAA`	Which IPv6 address serves this name. Absence is normal, not an error
`CNAME`	This name is an alias for another name — follow it
`MX`	Which hosts accept mail for this domain, and in what preference order
`NS`	Which nameservers are authoritative for this zone
`TXT`	Free-form text. In practice SPF, DKIM, DMARC and domain-verification tokens

The MX column shows the priority separately from the host, because the number is a preference and not a rank of quality: lower wins, and equal values mean the sender may pick either. A domain with no MX records at all can still receive mail at its A record under an implicit-MX rule, which is legal and almost always accidental.

Reading TTLs

The TTL is how long the resolver intends to keep this answer, in seconds. It is counting down, so the number you see is the remaining life of a cached entry, not the value configured in the zone. Query twice a minute apart and you will usually see it drop.

This is the single most useful number during a migration. A record with a TTL of 86400 will still be served from caches for up to a day after you change it, regardless of how quickly your DNS provider applies the edit. The fix has to happen before the change: lower the TTL to 300, wait for the old TTL to expire, then make the change, then raise the TTL again.

Why answers differ between tools

Two resolvers can legitimately disagree, and knowing why saves a lot of confusion:

Cache state. This tool reads Cloudflare’s resolver. Your ISP’s resolver has its own cache with its own countdown.
Geographic routing. Many large sites answer with the address closest to the resolver, so an answer obtained from a Cloudflare data centre is not the answer your laptop would get.
Split-horizon DNS. A corporate network can serve internal addresses for a name that resolves publicly to something else. A public resolver never sees the internal view.

For “what does the authoritative server say, right now, with no cache”, you want dig @<nameserver> <name> <type> against one of the NS hosts this tool lists. That is the ground truth; everything else is a cache.

Examples

Mail is bouncing. Check MX first, then look in TXT for the SPF record. Two SPF records on one domain is a hard failure in the spec, and it is a common outcome of adding a new sender without removing the old line.
A subdomain 404s after a deploy. Check whether it is a CNAME pointing at a platform hostname that was renamed.
A domain was transferred and something is stale. Compare NS against what the registrar shows. A mismatch means the zone you are editing is not the zone being served.
Verifying a service. Domain-verification tokens live in TXT, and the most common failure is adding the record to www rather than the apex.

Notes

The domain is validated against a hostname pattern before the query is made, so URLs, IP addresses and internationalised names in Unicode form are rejected rather than passed through. For an internationalised domain, convert it to Punycode first with the IDN converter.

Records are labelled with the type the resolver returned rather than the type requested. This matters for aliased hosts: asking for A on a name that is a CNAME returns the alias plus the resolved addresses, and mislabelling the alias as an address record would be actively misleading.

An empty result is a valid answer, not a failure. A domain with no AAAA record simply has no IPv6 address, and a domain with no TXT records has nothing configured — neither is an error worth reporting as one.

To see what the resolved server actually returns over HTTP, follow up with the HTTP header checker.