Look up a domain's DNS records from the browser: you run the named resolver's request yourself, and the answer is decoded here.
This page never sends a request. Copy the line below, run it in your own terminal, then paste the answer into the box underneath and it is decoded here.
Name to be looked up —
The DNS-over-HTTPS request line—Or, with dig: —
Whichever resolver you choose is told the name you are asking about, by you, when you run the command. Their policy is linked beside their name.
Decoded records appear here. The example loaded below is a saved answer kept with this page, so there is something to read before you run anything.
A shared link carries the name, the record type and the resolver you chose. No answer and no pasted text can go into it — there is no state key that could hold one.
Press ? for shortcuts
Nothing you type or paste here is stored between visits, and none of it is logged — the decoding happens in this tab.
The tool itself sends nothing: every decode runs in this tab. The page around it reserves an advertising slot, so it is not one of the ad-free pages.
One section per record type this page decodes, each with its own link. Fields carry the names the RFCs give them, so a row here reads against a row in the answer above.
Defined in RFC 1035 §3.4.1
An A record maps the name to a single 32-bit IPv4 address. Several A records under one name are ordinary: the client picks one, and the order they arrive in is not a ranking.
| Field | What it holds |
|---|---|
ADDRESS | One IPv4 address, in dotted-quad form. |
Defined in RFC 3596 §2.2
AAAA carries a 128-bit IPv6 address. A name may hold A and AAAA records at once, and asking for one never returns the other — an empty AAAA answer says nothing about the A.
| Field | What it holds |
|---|---|
ADDRESS | One IPv6 address, in colon-hex form. |
Defined in RFC 1035 §3.3.1
A CNAME points one name at another. Asking for an address may return the alias hops first and the address last; the table keeps them in the resolver's order, so the address belongs to the final name, not the one asked about.
| Field | What it holds |
|---|---|
CNAME | The canonical name this alias stands for. |
Defined in RFC 1035 §3.3.9
MX data is two tokens, and the page shows them in separate columns. The number is an order of preference, not a weight or a score.
| Field | What it holds |
|---|---|
PREFERENCE | 16-bit number; the lowest is tried first. |
EXCHANGE | Host name that accepts the mail. A single dot at preference 0 is the null MX: the domain accepts none (RFC 7505). |
Defined in RFC 1035 §3.3.14, RFC 6763 §6.1
TXT holds character-strings rather than one blob, each one capped at 255 octets, so a longer value arrives in parts. The parts and the concatenation are both printed. What a particular string means is the business of whatever reads it.
| Field | What it holds |
|---|---|
TXT-DATA | One or more strings, each at most 255 octets. |
Defined in RFC 1035 §3.3.11
NS names a server that answers for the zone. The set is the delegation itself: it says who is entitled to answer, never what the answer will be.
| Field | What it holds |
|---|---|
NSDNAME | Host name of an authoritative server. |
Defined in RFC 1035 §3.3.13
One SOA exists per zone. A denial carries it in the authority section, which is why a name that does not exist still returns a record: it names the zone that said so.
| Field | What it holds |
|---|---|
MNAME | Primary server for the zone. |
RNAME | Responsible mailbox, written as a name. |
SERIAL | Version counter secondaries compare. |
REFRESH | Seconds before a secondary re-checks. |
RETRY | Seconds before retrying a failed check. |
EXPIRE | Seconds a secondary keeps serving unrefreshed. |
MINIMUM | TTL a negative answer may be cached for. |
Defined in RFC 8659 §4
CAA states a policy for certificate issuance under the name. Flags 128 sets the critical bit: an issuer that does not understand the tag must refuse rather than proceed.
| Field | What it holds |
|---|---|
FLAGS | One octet; 128 marks the property critical. |
TAG | Property name, such as issue or iodef. |
VALUE | The property's value, as a quoted string. |
Defined in RFC 1035 §3.3.12
A reverse lookup asks under in-addr.arpa for IPv4 or nibble-reversed ip6.arpa for IPv6. Type the address and the reverse name is built for you, so the request line shows what is actually asked.
| Field | What it holds |
|---|---|
PTRDNAME | The name this address points back to. |
Defined in RFC 2782
SRV is asked under _service._proto.name and answers with four fields at once. A target of a single dot means the service is definitively not available at that name.
| Field | What it holds |
|---|---|
PRIORITY | Lowest is tried first, like MX preference. |
WEIGHT | Relative share among equal priorities. |
PORT | TCP or UDP port the service listens on. |
TARGET | Host name; a lone dot means no service. |
Do it offline:$ dig example.com A +short
Name a domain, pick a record type, and this page writes the exact DNS-over-HTTPS request for the resolver you chose. You run that one line and paste the JSON answer back. What returns is split into typed fields — preference and exchange for MX, the string sequence inside a TXT, the alias hops ahead of an address — with the resolver named and the answer's age stated.
example.com Aexample.com A → NOERROR · A 172.66.147.243 (TTL 300) · A 104.20.23.154 (TTL 300)Two addresses for one name: a load-balanced host, and the client picks. Both rows show 300 seconds of remaining TTL. Schema-derived fixture, addresses from dig on 2026-08-14 — not a live capture, so run it today and they may differ.
google.com MXgoogle.com MX → NOERROR · MX 10 smtp.google.com (TTL 300)MX data is two tokens: a 16-bit preference, then the exchange name (RFC 1035 §3.3.9). Lower is tried first, so it is an order, not a score. A bare-dot exchange at preference 0 is RFC 7505's null MX — no mail accepted.
_dmarc.google.com TXT_dmarc.google.com TXT → NOERROR · TXT v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com (TTL 300)An underscore label is a normal name — RFC 8552 reserves that space — so rejecting one is wrong about DNS. What the policy string means belongs to the email-authentication page.
www.microsoft.com Awww.microsoft.com A → NOERROR · CNAME www.microsoft.com-c-3.edgekey.net (TTL 300) · CNAME e13678.dscb.akamaiedge.net (TTL 300) · A 23.199.2.40 (TTL 20)Asking for an address returned two aliases first. The chain keeps the resolver's order: the address belongs to the last name in it, hence that row's own 20-second TTL.
nonexistent-g325-probe.example Anonexistent-g325-probe.example A → NXDOMAIN · no answer records · authority SOA a.root-servers.net nstld.verisign-grs.com 2026081402 (TTL 85162)A refusal that is still an answer. Status 3 says no such name exists below the zone that replied, and the authority SOA names the server that said so.
Every example on this page is executed against the same engine that powers the tool, on every build.
NXDOMAIN (status 3) means no such name. NOERROR with an empty answer section means the name is real and holds no record of the type asked for — NODATA, in operator shorthand. Reading one as the other gets a domain renewed that never expired.
A resolver reports how much longer it will serve its copy, not the value the zone publishes: ask ten seconds later and it is ten lower. A small figure means a nearly stale cache entry, not a record that changes often. The published value is visible only from an authoritative server.
The AD bit (RFC 4035 §3.2.3) is set when a resolver says it validated the answer with DNSSEC. Nothing here checks a signature, so believing it means trusting that resolver and the path to it — a labelled claim, not a tick.
DNS caps each character-string at 255 octets (RFC 1035 §3.3.14), so longer values arrive split; sequence and concatenation are both shown. In presentation form \255 is a decimal octet and \" a quote (RFC 1035 §5.1).
That is not a DNS name that can be looked up: label 1 (`-bad`) starts or ends with a hyphen. Names are dot-separated labels of letters, digits, hyphens and underscores — like `example.com` or `_dmarc.example.com`.That text is not valid JSON. A DoH answer is a JSON object — copy the whole response body, from the opening `{` to the closing `}`.That JSON parsed, but it is not a DNS answer: there is no numeric `Status` field. A DoH-JSON answer is an object with a numeric `Status` field and optional `Question`, `Answer` and `Authority` arrays (RFC 8484 §4.1).The resolver answered NXDOMAIN (RCODE 3): this name does not exist at all. That is different from a name that exists with no records of the type you asked for — check the spelling before concluding the domain is unregistered.Your network returned a block page instead of a DNS answer. A filter, captive portal or corporate proxy is intercepting DNS-over-HTTPS on this connection — this is not a fault in the name you asked about.Because a lookup from here would be a third-party request made on your behalf. The request line is handed over instead: read it, send it from whichever network you choose, paste back what returns.
Whichever is in the request you run: cloudflare-dns.com or dns.google, both named on the page with privacy policies linked. It sees the name asked about and the address it came from, as any DNS query does.
Usually caching: each holds its copy until the TTL expires, so just after an edit one may serve the old record and the other the new. Geography is the second reason: authoritative servers often answer near the asker. A worldwide check needs vantage points this page does not have.