DNS Lookup

Query any DNS record type - A, AAAA, MX, TXT, NS, SOA, CAA, SRV, DNSKEY and more - straight from your browser over DNS-over-HTTPS.

Live lookup DNS & Domain Queries a public API
Try:

Result

Ready to query
Press "Run lookup" to resolve example.com A over DNS-over-HTTPS. The request goes from your browser straight to the resolver you selected - Netvorx operates no resolver and never sees the query.

What the answer will show

Status
the DNS response code - NOERROR, NXDOMAIN or SERVFAIL
Answer section
each record with its remaining cache TTL
DNSSEC
whether the resolver validated the chain of trust
Zone file form
the same records ready to paste into a zone

About DNS Lookup

This is a browser-native replacement for dig. The query is sent as DNS-over-HTTPS from your machine directly to the resolver you pick, so the answer reflects what that resolver sees - including its cache - rather than what a server in some other country sees.

Reading the result

The status field is the DNS response code. NOERROR with zero answers is NODATA: the name exists but has no record of that type - a completely different condition from NXDOMAIN, where the name does not exist at all. SERVFAIL usually means a broken delegation or a DNSSEC validation failure, not a missing record.

The TTL is what remains of the cache lifetime at that resolver, so it counts down on repeat queries rather than showing the value configured in the zone.

DNSSEC

The AD (Authenticated Data) flag means the resolver validated the chain of trust for this answer. Its absence does not prove tampering - most zones are still unsigned - but for a signed zone, losing AD is a red flag worth chasing.

Common use cases

  • Confirming an A or AAAA change has actually taken effect at a public resolver.
  • Checking MX and TXT records while debugging mail delivery.
  • Reading CAA policy before requesting a certificate from a new CA.
  • Finding the authoritative nameservers for a domain during a delegation problem.

Edge cases and gotchas

  • ANY queries are refused or truncated by most modern resolvers (RFC 8482) - query the specific type instead.
  • Answers come from a public resolver cache, so they may lag behind an authoritative change by up to the record TTL.
  • Split-horizon or internal-only names will not resolve here; this sees the public view only.

Frequently asked questions

Why does my new record not show up?
Either the resolver is still serving a cached answer until the old TTL expires, or the change has not propagated from your provider to the authoritative servers. Query the authoritative nameserver directly with dig @ns1.example.com to separate the two.
Is my lookup logged by Netvorx?
No. The request goes from your browser directly to Cloudflare or Google DNS. We operate no resolver and never see the query. The resolver you choose logs it under its own privacy policy.
What does SERVFAIL mean?
The resolver could not produce an answer. The usual causes are a broken delegation (nameservers not responding), a DNSSEC signature that fails validation, or an authoritative server that is down.