When a website won't load, email stops arriving, or a new domain "isn't working yet", the answer is usually in its DNS records. DNS (the Domain Name System) is the internet's address book: it turns a name like mybotsy.com into the server addresses and settings computers need. This guide shows you how to check DNS records for any domain, explains what each record type means, and walks through the problems you're most likely to be troubleshooting.
How DNS works, in one minute
When you type a domain into your browser, your device asks a resolver (usually run by your internet provider, or a public one such as Google's 8.8.8.8 or Cloudflare's 1.1.1.1) for the domain's records. If the resolver doesn't have a fresh copy cached, it asks the root servers, then the servers for the top-level domain (like .com), and finally the domain's authoritative nameservers, which hold the real records. The answer is cached for a period called the TTL (time to live).
That caching is why DNS changes don't appear everywhere at once, and why checking records directly is so useful.
The DNS record types you'll actually see
A and AAAA records
An A record points a name to an IPv4 address, such as 203.0.113.10. An AAAA record does the same for an IPv6 address. These are what make a website load. A domain can have several, for load balancing or redundancy.
CNAME records
A CNAME (canonical name) makes one name an alias of another, for example pointing www.example.com to example.com or to a hosting provider's hostname. A name with a CNAME can't have other records at the same name, which is why the bare root domain usually uses A records (or a provider-specific "flattening" feature) instead.
MX records
MX (mail exchanger) records say which servers receive email for the domain, each with a priority number. Lower numbers are tried first. If MX records are missing or wrong, email to the domain bounces or disappears.
TXT records
TXT records hold text, and today they're mostly used for verification and email security:
- SPF (
v=spf1 ...) lists the servers allowed to send email for the domain. - DKIM records (at names like
selector._domainkey.example.com) publish keys that let receivers verify signed email. - DMARC (at
_dmarc.example.com) tells receivers what to do with mail that fails SPF and DKIM, and where to send reports. - Site verification strings for services like Google Search Console.
NS and SOA records
NS records list the domain's authoritative nameservers, so they tell you which DNS provider is in control. The SOA record (start of authority) holds administrative details such as the primary nameserver and a serial number that changes when the zone is updated.
CAA records
CAA records list which certificate authorities may issue SSL/TLS certificates for the domain. If a CAA record exists and your certificate provider isn't listed, certificate issuance fails.
How to check DNS records online
The quickest way is a web-based lookup, which needs no software:
- Open the DNS lookup tool.
- Enter the domain or subdomain, such as
example.comormail.example.com, withouthttps://. - Submit and review the A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records that come back.
- Repeat for specific subdomains. Records like
wwwor_dmarcare separate names and need their own lookups.
How to check DNS from the command line
If you prefer a terminal, two built-in tools do the job.
nslookup (Windows, macOS, Linux)
nslookup example.com
nslookup -type=mx example.com
nslookup -type=txt example.com 1.1.1.1The last line asks a specific resolver (here 1.1.1.1), which is handy for comparing answers.
dig (macOS, Linux)
dig example.com A
dig example.com MX +short
dig _dmarc.example.com TXT
dig @ns1.yourdnsprovider.com example.com AQuerying the authoritative nameserver directly with @ shows you the current records, with no caching in between.
Troubleshooting common DNS problems
"My website isn't loading after I changed hosting"
Check the A (and AAAA) records for both the root domain and www. Make sure they point to the new host's IP, and remove any old AAAA record that still points to the previous server, since browsers may prefer IPv6. Then check the hosting with the website hosting checker, and confirm the certificate with the SSL lookup.
"DNS changes aren't showing up"
Resolvers keep cached answers until the TTL expires. If the old record had a TTL of 86,400 seconds (24 hours), some visitors may see the old address for up to a day. Before a planned move, lower the TTL to a few minutes a day in advance. Also confirm which nameservers are actually in charge: if the NS records at your registrar point to a different provider than the one you edited, your changes will never take effect.
"Email is bouncing or going to spam"
Look up the MX records, then the TXT records for SPF and the _dmarc record. Common mistakes include having two SPF records (only one is allowed), forgetting to include your email or newsletter provider in SPF, and a DMARC policy that's stricter than your setup supports.
"A subdomain doesn't work"
Make sure a record exists for that exact name. A record for example.com doesn't cover blog.example.com unless there's a wildcard (*) record.
"Who controls this domain?"
The NS records tell you the DNS provider. The WHOIS lookup tells you the registrar, the registration and expiry dates, and the domain's status. If a domain stopped resolving suddenly, an expired registration is a common cause.
DNS and SEO
DNS isn't a ranking factor by itself, but it affects things that matter for search:
- Availability. If DNS fails, search engines can't crawl your site. Reliable DNS providers with multiple nameservers reduce that risk.
- Speed. Slow DNS resolution adds delay to the first visit. Fast, widely distributed DNS providers help.
- Verification. Google Search Console offers DNS TXT verification, which covers every subdomain and protocol of your domain.
- Consistent URLs. Make sure both
wwwand the root domain resolve, then redirect one to the other. Check the redirects with the URL redirect checker.
Related lookups worth knowing
- IP lookup shows the approximate location and network of an IP address from an A record.
- Reverse IP lookup shows the hostname (PTR record) for an IP address, which mail servers often check.
- HTTP headers lookup shows what the server responds once DNS has done its job.
- Punycode converter lets you look up domains with accented or non-Latin characters by converting them to the
xn--form DNS uses.
Frequently asked questions
How long does DNS propagation take?
It depends on the TTL of the old record. Many changes show up within minutes to a few hours, but records with long TTLs can take up to a day or two to update everywhere.
Can I see all DNS records for a domain?
You can look up each record type for the names you know. DNS generally doesn't let anyone list every subdomain in a zone, so records at unknown names won't appear.
What's the difference between DNS and WHOIS?
DNS holds the technical records that make a domain work. WHOIS holds registration information, such as the registrar, creation and expiry dates and status.
Why do different tools show different results?
They may be asking different resolvers with different cached copies. Querying the authoritative nameserver directly shows the current truth.
What is a good TTL?
Values between 300 seconds (5 minutes) and 3,600 seconds (1 hour) are common. Use a short TTL before planned changes and a longer one for records that rarely change.