DNS Checker

Run a baseline lookup before any nameserver change, registrar transfer, or mail provider switch. Capture A, AAAA, MX, TXT (SPF, DKIM, DMARC), NS, and SOA in a change ticket. After cutover, run the same lookup and diff answers line by line. SOA serial increments on many providers when the zone file changes — note it when troubleshooting stale secondaries or support claims that «propagation is complete» while your laptop still shows old mail routes.

Use the DNS Checker when onboarding a SaaS product that asks for verification TXT, when debugging deliverability after SPF or DKIM rotation, when confirming CAA before issuing certificates, or when a CDN orange-cloud toggle changes anycast A answers. Checking dns records online is faster than installing bind-utils on locked-down corporate laptops and more complete than ping or nslookup alone, which never show MX, TXT, or CAA in one structured view.

Pair a full lookup with WHOIS when delegation itself is suspect: if nameservers at the registrar do not match the NS records returned publicly, you may be editing an inactive DNS panel while the world still queries the previous host. For single-type traces (only MX, only TXT, only NS), the DIG tool on the same site returns resolver-style answer sections you can paste into support threads without reformatting.

If the DNS Checker shows values that disagree with your control panel, compare NS records first. You might be logged into a child-zone editor while the apex still delegates elsewhere. Query authoritative nameservers with DIG @ns1.example.com when recursive caches lie — our checker uses a configured resolver path, which reflects what most visitors see, not necessarily the authoritative file seconds after you click Save.

TTL drives how long old answers persist. A record cached for 86400 seconds can take up to twenty-four hours to vanish from every resolver worldwide even after you publish a fix. Lower TTL on stable records twenty-four to forty-eight hours before a planned change, verify the lower TTL with the DNS Checker, apply the new data, then raise TTL again after stability returns.

Duplicate SPF TXT records at the same owner name invalidate SPF entirely — merge includes into one string. CNAME at a label that also carries MX or TXT is invalid per DNS rules and produces unpredictable resolver behavior. DMARC without aligned SPF or DKIM reports failures but does not fix them; treat DMARC as a policy layer on top of working authentication records, not a substitute.

Geographic anycast and CDN proxied names may return different A or AAAA answers depending on resolver location. That is expected, not a propagation bug. When debugging origin routing, compare grey-cloud versus orange-cloud states in your DNS panel and re-run the DNS Checker from the same resolver path after each toggle.

Inbound mail depends on MX priorities and reachable mail exchanger hostnames. Outbound reputation depends on SPF, DKIM, and DMARC TXT at predictable names. The DNS Checker groups MX and TXT in one response so you can confirm that mail.example.com resolves, that only one SPF exists at the apex, that your selector._domainkey label publishes a current public key, and that _dmarc.example.com states the policy you intend (none, quarantine, or reject).

After Google Workspace, Microsoft 365, or any SMTP relay onboarding, verify all four families before sending bulk mail. A working MX record does not imply SPF is correct — compare outbound SMTP IPs with the SPF include chain and provider documentation. Copy the exact concatenated TXT from the checker rather than retyping from PDFs; split DKIM strings in the panel still concatenate in DNS answers.

When Authentication-Results headers show spf=fail or dkim=fail, re-query live TXT with the DNS Checker, fix the zone, note TTL, and wait for cache expiry before retesting. Use the Blacklist Checker on sending IPs if deferrals persist after DNS auth is clean — DNS fixes deliverability prerequisites but does not replace IP reputation work.

This tool shows the DNS records returned by our resolver right now — a complete all-records lookup including DKIM- and DMARC-friendly TXT answers, grouped by type with copy actions. It is built for verifying configuration, documenting migrations, and answering «what does the public DNS tree show for this name today?» It does not plot a world map of resolver differences and does not claim to test fifty global locations simultaneously.

Dedicated DNS propagation checkers query many regional recursive resolvers over time and visualize which regions still cache old A, MX, or NS values. That worldview helps after large TTL-heavy changes or nameserver swaps when support teams ask «has it propagated yet?» DN01 does not replicate that map — we focus on one high-quality snapshot plus history, API access, and companion tools (DIG, WHOIS, SSL) on the same site.

Propagation is not instant teleportation. It is old caches expiring per TTL plus registrar glue updates when nameservers change. A low TTL on the authoritative zone helps future changes converge faster but cannot retroactively flush answers already cached at 86400 seconds. Use the DNS Checker to confirm your authoritative publish, then use propagation maps if you need geographic confidence that resolvers in multiple regions have expired old data.

When answers differ between the DNS Checker and a propagation map, both can be «correct» for their vantage point. Recursive resolvers cache independently; your office DNS, mobile carrier, and 8.8.8.8 may disagree until TTLs expire. Query authoritative NS directly with DIG when you need to bypass cache entirely — if authoritative NS already shows the new MX but the checker still shows the old one, you are observing cache lag, not a failed publish.

Choose DN01 when you want every major record type in one view, localized UI in eight languages, local recent history, and a documented API for automation. Choose propagation maps when your question is specifically «which regions still see the previous IP?» — not «are my MX and SPF strings correct?» We are honest about that boundary: no fake propagation percentage bar, no simulated global grid — just accurate, copy-friendly DNS data for operators who need to ship reliable mail, web, and certificate changes.