DNS & Email Security Lookup
Every DNS record for a domain in one go, plus a check of its email security (SPF, DMARC, DKIM, MTA-STS and BIMI), or the hostname behind an IP address.
Last updated
How to look up DNS records
- Type a domain such as
example.com, or an IP address for a reverse lookup. - Choose Cloudflare or Google to ask, and add a DKIM selector if you know it.
- Click Look up to see every record and the email security checks.
What the records mean
A and AAAA records give a name's IPv4 and IPv6 addresses; CNAME makes it an alias of another name; MX lists the servers that receive its email (lowest number first); NS names the servers that hold its DNS; TXT holds free text, used for verification codes and email policies; SOA describes the zone; CAA says which certificate authorities may issue HTTPS certificates for it. A reverse lookup (PTR) turns an IP address back into a hostname.
For email: SPF (a TXT record starting v=spf1) lists the servers allowed to send mail for the domain, and should end in -all or ~all; it may trigger at most 10 further DNS lookups. DMARC (TXT at _dmarc.) tells receivers what to do with mail that fails SPF and DKIM for the From domain: p=reject or quarantine protects against spoofing, p=none only monitors. DKIM keys live at selector._domainkey.; selectors aren't listable, so common ones are tried (you'll find the real one as s= in an email's DKIM-Signature header). MTA-STS and BIMI are optional extras for encrypted delivery and logos in inboxes.
Lookups go from your browser straight to the public DNS service you choose (Cloudflare or Google) over encrypted DNS-over-HTTPS; toolcrate never sees them. "DNSSEC: signed" means the resolver validated the answer's signatures.
Questions about DNS
How do I check a domain’s DNS records?
Enter the domain and click Look up. A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records are all fetched at once.
How do I check SPF, DKIM and DMARC?
They’re checked automatically and explained in plain English, with a warning if something is missing or too weak to stop spoofing.
Why doesn’t my DNS change show up yet?
Records are cached for their TTL (time to live), shown in seconds. Changes can take that long to appear, sometimes up to a day or two.
What is a reverse DNS lookup?
Turning an IP address back into a hostname using its PTR record. Enter an IP address to try it: 8.8.8.8 is dns.google.