The records, in plain words
- A and AAAA point a name at an IPv4 or IPv6 address: where your website lives.
- CNAME makes a name an alias of another name, like
wwwpointing at your host’s domain. When you look up A records on an alias, we show the CNAME chain we followed. - MX lists the servers that accept email for the domain. The lowest number is tried first.
- NS names the nameservers that are authoritative for the domain, which tells you where the DNS is managed.
- TXT holds text: SPF for email, and verification codes for Google Search Console and other services. Long values are split into 255-character strings in DNS; we join them back together.
- SOA holds the zone’s primary nameserver, admin contact, serial number and timers.
- CAA lists which certificate authorities may issue TLS certificates for the domain.
How it works
We send each query to Cloudflare’s public resolver using DNS over HTTPS (the JSON API at cloudflare-dns.com) and show the answers with their TTLs. Names with underscores work too, so you can look up _dmarc.example.com or a DKIM selector like google._domainkey.example.com. When the resolver validated the answer with DNSSEC, we say so.
Common checks before a launch
- Both the apex and
wwwresolve, and one redirects to the other. - No leftover A records pointing at an old host.
- The Search Console verification TXT record is still there.
- MX, SPF and DMARC exist for the domain you send launch emails from.
For email records with verdicts and fixes, use the SPF, DKIM and DMARC checker. If a site isn’t loading, the website down checker tells you whether it’s DNS or the server.