Log In Get Started
Free tool

DNS records of a domain

Half the trouble with a domain is visible in its records: mail does not flow without MX, letters land in spam without SPF and DMARC, the site shows someone else’s page because the address points at old hosting. Enter a domain — we show everything DNS answers about it and point out what is missing.

The request goes from your browser straight to a resolver, bypassing us.

Ready to check

The records are asked of a public resolver over DNS-over-HTTPS straight from your browser. Our servers take no part in it.

What is what

RecordWhat it does
A and AAAAthe addresses the site opens at: IPv4 and IPv6
CNAMEan alias: the domain points at another domain and takes its address
MXwhere to deliver mail. No MX means no mail on the domain
TXTservice lines, among them SPF — who is allowed to send mail in your name
DMARCwhat to do with letters that fail the checks. Lives in _dmarc.domain
NSname servers: who answers for this domain at all
CAAwhich certificate authorities may issue certificates for the domain

Nearby: who resolves names for you, whether a site opens from other countries and whose IP address this is.

Records fine but the site will not open?

Then it is not the domain but the road to it: blocking, a filter, or a fault at your provider. 404 VPN goes around that part.

How it works →

FAQ

guest@404vpn:~$ cat dns-records-faq.md
[01] $ How is this different from dig or nslookup? ▸
> In essence, not at all — these are the same queries, only from a browser and with human labels. The difference is convenience: you do not have to remember the syntax and the record types, and we ask for SPF and DMARC ourselves even though they live in different places — the first in the domain’s own TXT, the second in the TXT of the _dmarc subdomain.
[02] $ Why do you see a record while the site does not open in my browser? ▸
> Because we ask a public resolver and your computer asks its own. There can be a difference between them: fresh changes spread around the world in anything from minutes to a day, and a provider’s DNS sometimes holds an old answer longer than it should. If the records here are right and it still does not work for you, wait or change your resolver.
[03] $ What does "DNSSEC: signed" mean? ▸
> That this domain’s answers are cryptographically signed and the resolver verified the signature. It protects against an answer being substituted on the way: slipping you a foreign address instead of the real one becomes much harder. The absence of a signature is not a fault — most domains do not use it — but with it things are safer.
[04] $ No MX — is that an error? ▸
> Only if mail is supposed to work on this domain. For a domain that holds nothing but a website, having no MX is normal. But if you send letters from an address on this domain, then without MX, SPF and DMARC they will regularly go to spam — and that is worth fixing.
[05] $ Can you see which domains I check? ▸
> No. The request goes from your browser straight to a public resolver over DNS-over-HTTPS — it does not pass through our servers. We know neither the domain nor the answer.