How to check the DNS records for any domain?

To check the DNS records for any domain, use a lookup tool and ask for each record type by name. On macOS or Linux, run dig example.com MX (or A, TXT, NS and so on). On Windows, use Resolve-DnsName example.com -Type MX in PowerShell or nslookup -type=MX example.com in Command Prompt. If you'd rather not use a terminal, a web-based lookup tool or a DNS-over-HTTPS query in your browser will show the same public records. There's no single command that reliably lists every record in a domain, so you check the types and names you care about one by one.

Checking DNS is the first step in troubleshooting almost any website or email problem, and it's useful for plenty of other jobs too: confirming a change has gone live, seeing which email provider a company uses, or checking a domain's SPF and DMARC policy. This guide covers the tools available on each operating system, which records to look for, how to read the answers, how to make sure you're seeing current data rather than a cached copy, and how to script lookups for many domains.

Which Records Can You Check?

DNS records are public by design. Anyone can look up the records for any domain, as long as they know the name and type to ask for. The most common types are:

Type	What it holds	Example question
A	IPv4 address	Where is the website hosted?
AAAA	IPv6 address	Does the site support IPv6?
CNAME	Alias to another name	Which platform runs www?
MX	Mail servers	Who handles this domain's email?
TXT	Free text, including SPF, DMARC and verification	What is the SPF policy?
NS	Authoritative nameservers	Where is DNS hosted?
SOA	Zone administration details	What's the zone's serial number?
CAA	Allowed certificate authorities	Who can issue SSL certificates?
SRV	Service locations	Where are SIP or XMPP services?
PTR	Reverse DNS for an IP address	What name belongs to this IP?

Why You Can't List Every Record

You might expect a command that dumps the whole zone. Two mechanisms used to come close, and neither works for the public today:

• ANY queries: Asking for type ANY was once a way to get every record at a name. Most large providers now return a minimal response instead, as allowed by RFC 8482, because ANY was widely abused in amplification attacks.
• Zone transfers (AXFR): These copy an entire zone, but well-run nameservers only allow them to their own secondary servers.

So to check a domain thoroughly, you query each type at each name you're interested in. For the domain owner, the complete list is always in the DNS provider's dashboard or export.

Checking Records on macOS and Linux

Using dig

dig is the standard tool on macOS and most Linux distributions. If it's missing on Linux, install it from the dnsutils package on Debian and Ubuntu, or bind-utils on Fedora, RHEL and similar systems.

The basic form is dig name type. Adding +short prints only the values:

dig example.com A +short
dig example.com AAAA +short
dig example.com MX +short
dig example.com TXT +short
dig example.com NS +short

192.0.2.10
2001:db8::10
10 mx1.mail.example.net.
20 mx2.mail.example.net.
"v=spf1 include:_spf.mail.example.net -all"
"google-site-verification=abc123exampletoken"
ns1.dns-host.example.
ns2.dns-host.example.

If you want the TTL and record type alongside each value, use +noall +answer instead of +short:

dig example.com MX +noall +answer

example.com.		3600	IN	MX	10 mx1.mail.example.net.
example.com.		3600	IN	MX	20 mx2.mail.example.net.

The columns are the name, TTL in seconds, class, type and value.

Using host

The host command gives friendlier output and, with no type specified, shows the A, AAAA and MX records together:

host example.com

example.com has address 192.0.2.10
example.com has IPv6 address 2001:db8::10
example.com mail is handled by 10 mx1.mail.example.net.
example.com mail is handled by 20 mx2.mail.example.net.

For a specific type, use -t:

host -t TXT example.com

Checking Records on Windows

Using PowerShell

PowerShell's Resolve-DnsName cmdlet is the most capable built-in option on Windows:

Resolve-DnsName example.com -Type A
Resolve-DnsName example.com -Type MX
Resolve-DnsName example.com -Type TXT

Name                           Type   TTL   Section    NameExchange              Preference
----                           ----   ---   -------    ------------              ----------
example.com                    MX     3600  Answer     mx1.mail.example.net      10
example.com                    MX     3600  Answer     mx2.mail.example.net      20

Because it returns objects, you can filter the output. For example, to show only the TXT strings:

(Resolve-DnsName example.com -Type TXT).Strings

To ask a specific DNS server, add -Server:

Resolve-DnsName example.com -Type A -Server 1.1.1.1

Using nslookup

nslookup works on every version of Windows, as well as macOS and Linux:

nslookup -type=MX example.com

Server:  one.one.one.one
Address:  1.1.1.1

Non-authoritative answer:
example.com     MX preference = 10, mail exchanger = mx1.mail.example.net
example.com     MX preference = 20, mail exchanger = mx2.mail.example.net

"Non-authoritative answer" simply means the response came from a resolver's cache rather than directly from the domain's own nameservers.

Checking Common Subdomains and Special Names

Many important records don't live at the domain itself. They sit at specific names that you have to ask for directly:

dig www.example.com +short
dig _dmarc.example.com TXT +short
dig selector1._domainkey.example.com TXT +short
dig _sip._tls.example.com SRV +short
dig autodiscover.example.com +short

Name	What it is
www	Website, usually a CNAME or A record
_dmarc	DMARC email policy
<selector>._domainkey	DKIM public key for a mail service
_mta-sts	MTA-STS policy for secure mail delivery
autodiscover	Mail client configuration, common with Microsoft 365
_service._proto	SRV records, such as _sip._tls

DKIM is the tricky one, because you need to know the selector. Common selectors include google for Google Workspace and selector1 and selector2 for Microsoft 365. If you have an email from the domain, the selector is in the DKIM-Signature header as s=.

Finding Subdomains

DNS has no way to list a domain's subdomains, but certificate transparency logs record every publicly trusted TLS certificate, including the names it covers. The crt.sh service lets you search them:

curl -s "https://crt.sh/?q=%25.example.com&output=json" \
  | jq -r '.[].name_value' | sort -u

api.example.com
example.com
shop.example.com
www.example.com

%25 is a URL-encoded %, which crt.sh treats as a wildcard. This only finds names that have had certificates issued, but it's often surprisingly complete.

Checking Reverse DNS

To find the name associated with an IP address, look up its PTR record. dig -x builds the reverse lookup name for you:

dig -x 192.0.2.25 +short

mail.example.com.

Reverse DNS is especially important for mail servers, as many receiving servers check that a sending IP has a PTR record that matches its hostname.

Making Sure You See Current Records

When you run a lookup, your query usually goes to a recursive resolver, which may answer from its cache. If a record changed recently, you might see the old value until the cached copy expires. There are two ways around this.

Ask a Different Resolver

Public resolvers each keep their own cache, so comparing several is a quick sanity check:

for r in 1.1.1.1 8.8.8.8 9.9.9.9; do
  echo "$r: $(dig @"$r" example.com A +short)"
done

1.1.1.1: 192.0.2.10
8.8.8.8: 192.0.2.10
9.9.9.9: 192.0.2.10

Ask the Authoritative Nameserver

The definitive answer comes from the domain's own nameservers. Find them, then query one directly:

dig example.com NS +short
dig @ns1.dns-host.example example.com A +short

This bypasses all caching. If the authoritative answer is right but resolvers show something else, the change is correct and caches simply haven't expired yet. If the authoritative answer is wrong, the problem is in the zone itself.

Checking DNS From a Browser

If you can't install anything, you can query DNS over HTTPS directly from a browser or with curl. Both Google and Cloudflare offer a JSON interface:

curl -s "https://dns.google/resolve?name=example.com&type=MX" | jq '.Answer'

[
  {
    "name": "example.com.",
    "type": 15,
    "TTL": 3600,
    "data": "10 mx1.mail.example.net."
  },
  {
    "name": "example.com.",
    "type": 15,
    "TTL": 3600,
    "data": "20 mx2.mail.example.net."
  }
]

Cloudflare's version needs an accept header:

curl -s -H "accept: application/dns-json" \
  "https://cloudflare-dns.com/dns-query?name=example.com&type=TXT" | jq -r '.Answer[].data'

You can also paste the Google URL straight into a browser's address bar to see the JSON. The type field is numeric: 1 is A, 28 is AAAA, 5 is CNAME, 15 is MX, 16 is TXT and 2 is NS.

Online Lookup Tools

Web-based tools such as Google's Admin Toolbox Dig, MXToolbox and DNSChecker offer the same lookups in a form, often with extras like checking from several locations at once or testing SPF syntax. They're handy for quick checks and for sharing results with someone non-technical. For anything you need to repeat or trust precisely, the command line gives you more control over which server you're asking.

Scripting Lookups for Many Domains

A Bash Loop

To check the same records across a list of domains:

#!/usr/bin/env bash
# check-records.sh - print key records for each domain in domains.txt
while read -r d; do
  [ -z "$d" ] && continue
  echo "== $d"
  echo "  NS:    $(dig +short "$d" NS | tr '\n' ' ')"
  echo "  A:     $(dig +short "$d" A | tr '\n' ' ')"
  echo "  MX:    $(dig +short "$d" MX | tr '\n' ' ')"
  echo "  DMARC: $(dig +short "_dmarc.$d" TXT)"
done < domains.txt

A Python Script With dnspython

For more control, the dnspython library handles errors and record parsing cleanly:

pip install dnspython

#!/usr/bin/env python3
"""Print common DNS records for a domain."""
import sys
import dns.resolver

domain = sys.argv[1]
record_types = ["A", "AAAA", "CNAME", "MX", "NS", "TXT", "CAA", "SOA"]

resolver = dns.resolver.Resolver()
resolver.nameservers = ["1.1.1.1", "8.8.8.8"]

for rtype in record_types:
    try:
        answer = resolver.resolve(domain, rtype)
    except (dns.resolver.NoAnswer, dns.resolver.NXDOMAIN, dns.resolver.NoNameservers):
        continue
    for rdata in answer:
        print(f"{rtype:6} {answer.rrset.ttl:>6}  {rdata.to_text()}")

python3 check_dns.py example.com

A        3600  192.0.2.10
AAAA     3600  2001:db8::10
MX       3600  10 mx1.mail.example.net.
MX       3600  20 mx2.mail.example.net.
NS      86400  ns1.dns-host.example.
NS      86400  ns2.dns-host.example.
TXT      3600  "v=spf1 include:_spf.mail.example.net -all"
CAA      3600  0 issue "letsencrypt.org"
SOA      3600  ns1.dns-host.example. hostmaster.example.com. 2026101601 3600 900 1209600 300

A CNAME lookup on the apex normally returns no answer, so the script skips it silently.

Reading the Results

A few patterns are worth recognising:

• No output from +short: The name exists but has no record of that type (NOERROR with an empty answer), or the name doesn't exist at all (NXDOMAIN). Run the query without +short and check the status: field to tell them apart.
• A CNAME followed by an IP address: The name is an alias, and the resolver followed it to the final address.
• Several A records: The site uses multiple servers or a CDN.
• Different answers from different resolvers: Either a recent change is still in caches, or the provider returns location-based answers, which is normal for CDNs.
• SERVFAIL: The resolver couldn't get a valid answer, often because of a broken DNSSEC setup or unreachable nameservers.

---

FAQ: Checking DNS Records

---

Conclusion

Checking a domain's DNS records takes seconds once you know the tools. Use dig or host on macOS and Linux, Resolve-DnsName or nslookup on Windows, and DNS over HTTPS or a web tool when you can't use a terminal. Ask for each record type you need, and remember that important records such as DMARC and DKIM live at their own special names.

When results look wrong, compare several resolvers and then query the domain's authoritative nameserver directly, which tells you whether you're looking at a cached copy or a real problem. For repeated checks, a short Bash loop or Python script turns the same lookups into something you can run across any number of domains.