DNS lookup

Record types

NetCheck queries Google's public DNS resolver live (over DNS-over-HTTPS) and shows the answer as is. Each record type has a precise role:

TTL, or why a change is not instant

Every DNS answer carries a TTL (time to live), in seconds. It is how long resolvers around the world may keep the answer in memory without asking again. A TTL of 3600 means a change may take up to an hour to be seen everywhere. Before a migration, lower the TTL to 300 (five minutes) the day before, make the change, then raise it again once everything is checked. To follow a change in progress, use the DNS Propagation tool.

Email: SPF, DKIM and DMARC

Most emails that land in spam can be explained by TXT records.

• SPF lists the servers allowed to send email on behalf of the domain. You need exactly one per domain, starting with v=spf1. Two separate SPF records invalidate both: merge them.
• DKIM publishes a key that lets the recipient verify each message's signature. It lives on a subdomain such as selector._domainkey.example.com, which your email provider gives you.
• DMARC, published at _dmarc.example.com, says what to do with messages that fail these checks: let them through (p=none), send them to spam (p=quarantine) or reject them (p=reject). Gmail and Yahoo now require it from bulk senders.

To read a DKIM or DMARC record, type the relevant subdomain directly, for example _dmarc.example.com, and choose the TXT type.

Common configuration mistakes

• A CNAME at the root: the standard forbids a CNAME on the bare domain (example.com), because it would clash with the NS and SOA records. Some DNS providers offer “CNAME flattening” or an ALIAS type to work around the rule.
• An MX pointing to an IP address: an MX must name a host, which itself has an A record.
• Inconsistent name servers: if the NS set at the registrar differ from those in the zone, some visitors may get stale answers.
• A forgotten AAAA: if an IPv6 record still points to the old server, IPv6 visitors land on the old site. Remember it during a migration.

Reading an empty answer

“No records” does not necessarily mean something is wrong: many domains have no AAAA or CAA, and that is normal. However, a domain with neither A nor AAAA cannot serve a website, and a domain without MX cannot receive email. If the resolver says the domain does not exist (code 3, known as NXDOMAIN), check the spelling, then its status with the WHOIS tool.

nslookup online: the same answers as nslookup and dig

This tool is a DNS lookup in your browser: enter a domain, pick a record type, and NetCheck queries Google's public resolver. If you prefer the command line, these commands return the same records from your own machine:

To ask the same resolver as NetCheck, add its address: nslookup -type=MX example.com 8.8.8.8 or dig @8.8.8.8 example.com MX. In Windows PowerShell, Resolve-DnsName example.com -Type MX gives the same result.

Online lookup or local command?

• Locally, your computer asks your router's or provider's resolver. If it still holds an old answer in cache, you see the old value until the TTL runs out. Some networks also filter answers.
• Online, you see the view of a large public resolver, independent of your network. If the two results differ, the cause is usually your provider's cache or your computer's. On Windows, ipconfig /flushdns clears the local cache.
• Straight from the domain's name server: dig @ns1.provider.net example.com A skips every cache and shows what the zone actually contains. It is the fastest way to confirm a fresh change before every resolver has picked it up.

Frequently asked questions

Are the results up to date?

Yes: the query goes live to Google's public resolver, over DNS-over-HTTPS. But that resolver, like all others, honours the TTL: right after a change it may still return the old value. The DNS Propagation tool compares several resolvers at once.

What is the difference between an A record and a CNAME?

An A record gives an IP address directly. A CNAME points to another name, which is then resolved in turn. It is handy when the destination address changes often (platforms, CDNs), but it adds a step and cannot coexist with other records on the same name.

What does the number in front of an MX record mean?

It is the priority: the lower it is, the higher the server's priority. Senders try the server with the smallest value first, then move on to the next ones if it does not answer.

What is a CAA record for?

It restricts which certificate authorities may issue a certificate for your domain. Without CAA, any of them can; with it, an unlisted authority must refuse, which reduces the risk of a fraudulent certificate.

What is the difference between nslookup and dig?

Both send DNS queries. nslookup comes preinstalled on Windows and gives a short output. dig is standard on Linux and macOS and shows more detail, such as the TTL of each answer and which server replied.

What does “Non-authoritative answer” mean in nslookup?

The answer came from a resolver, not directly from the domain's own name server. That is the normal case, not an error. You get an authoritative answer by querying one of the domain's name servers directly.

Why does nslookup show a different value from the online DNS lookup?

Usually your provider's resolver or your computer still holds an older answer in cache. It disappears once the TTL has expired at the latest. On Windows, ipconfig /flushdns clears the local cache straight away.