Look up the DNS records for any domain and check that its email security is set up properly. Unlike most Snowkit tools, this one has to go online: the domain name you type is sent to the public resolver you choose, and nothing else is.
How to look up a domain
- Type a domain name into Domain name. Pasting a full web address works too, and it is trimmed to the domain.
- On the Records tab, choose a Record type: All, A, AAAA, CNAME, MX, TXT, NS, SOA, CAA or SRV.
- Choose a Resolver: Cloudflare (1.1.1.1) or Google Public DNS.
- Press Look up, then read the results. Copy results saves them as text.
- Open the Email security tab to check SPF, DMARC and DKIM. Add a selector, or leave Try common selectors too on.
What gets sent
The lookup uses DNS over HTTPS. Your browser asks the resolver you picked for the records of the domain, and shows the answer. The only information sent is the domain name and the record type. Nothing else about you or your files is uploaded. If the chosen resolver cannot be reached, you can switch to the other one.
What each record type does
A and AAAA records point a name at an IPv4 or IPv6 address. CNAME makes one name an alias of another. MX lists the servers that receive email, lowest number first. TXT holds text such as SPF rules and site verification codes. NS names the servers that hold the zone, and SOA has its serial number and timers. CAA says which certificate authorities may issue certificates for the domain, and SRV points services like SIP or IMAP at a host and port.
SPF, DMARC and DKIM in plain English
SPF is a TXT record listing the servers allowed to send email for your domain. It may use at most 10 DNS lookups, counting every include, so this check follows each include and adds them up. DKIM signs each message with a key published under a selector, such as google._domainkey.example.com; your email provider tells you the selector. DMARC, at _dmarc.example.com, tells receivers what to do when a message fails both, and where to send reports. Start with p=none, read the reports, then move to quarantine and reject.
Why records can look different elsewhere
DNS answers are cached for the TTL shown next to each record, in seconds. After you change a record, resolvers may keep the old answer until that time runs out, so different tools and networks can disagree for a while. Switching the resolver above lets you compare two large public caches.
Common uses
- Checking that a new website points at the right server after a move.
- Finding out why email from your domain lands in spam or bounces.
- Confirming that a verification record was added correctly.
- Seeing which mail provider a company uses by reading the MX records.
For the headers a website sends, try the HTTP header checker.
Questions
Why does my new record not show up?
It may still be cached. Wait for the TTL to run out and look up again, or try the other resolver.
Is this the same as WHOIS?
No. DNS shows where a domain points. WHOIS shows who registered it.
Does it change my DNS?
No. It only reads public records.