Query live zone files and resolve A, AAAA, MX, TXT, SPF, DKIM, NS, CNAME, SOA, and CAA records directly through cryptographic DNS-over-HTTPS (DoH).
Advertisement
Status: Ready to resolve0 Records Found
Host Name
Type
TTL (Seconds)
Resolved Record / Target Data
Enter a domain and click "Resolve Records" to query DNS servers.
Advertisement
Recursive vs Authoritative DNS Explained
The Domain Name System translates human-memorable hostnames (like example.com) into binary IP addresses needed by TCP/IP stacks. DNS operation is divided between two distinct server roles:
Recursive Resolvers (e.g. 1.1.1.1, 8.8.8.8): Act as the intermediary between your browser and the root servers. When you request a domain, the recursive resolver traverses the hierarchy: Root (.) → TLD (.com) → Authoritative Name Server, caching the answers for the duration specified by the TTL.
Authoritative Name Servers (e.g. ns1.cloudflare.com): The definitive masters that hold the true zone files for a specific domain. Only authoritative servers can publish or update records.
Cryptographic DNS-over-HTTPS (DoH) & Privacy
Legacy DNS queries operate in cleartext over UDP port 53. Any intermediate router, local Wi-Fi administrator, or internet provider can inspect and log every domain you visit, even when using HTTPS for the web content.
DNS-over-HTTPS (DoH, RFC 8484) encapsulates DNS requests inside standard TLS 1.3 encrypted HTTPS sessions on port 443. This prevents eavesdropping, man-in-the-middle spoofing, and ISP content hijacking.
Common DNS Record Types & Specifications
Record Type
RFC Standard
Core Function
Example Value
A
RFC 1035
Maps a domain name to a 32-bit IPv4 address
172.66.147.243
AAAA
RFC 3596
Maps a domain name to a 128-bit IPv6 address
2606:4700:3036::6815:1817
MX
RFC 1035
Directs incoming email to designated mail transfer agents
10 mail.google.com.
TXT
RFC 1464
Carries human and machine readable text (SPF, DKIM, DMARC)
v=spf1 include:_spf.google.com ~all
NS
RFC 1035
Delegates a DNS zone to authoritative name servers
ns1.digitalocean.com.
CNAME
RFC 1035
Creates an alias pointing one domain name to another canonical name
app.billmaster97.com.
CAA
RFC 6844
Specifies which Certificate Authorities are permitted to issue SSL certs
0 issue "letsencrypt.org"
Comprehensive DNS Architecture & Resource Record Guide
The Domain Name System (DNS) is the foundational hierarchical distributed naming system of the global Internet. Operating predominantly over UDP port 53 (with TCP fallback for payloads exceeding 512 bytes or during zone transfers), DNS translates human-friendly Fully Qualified Domain Names (FQDNs) into routable 32-bit IPv4 addresses and 128-bit IPv6 addresses.
1. Core DNS Resource Record Specifications (RFC 1035)
Authoritative nameservers maintain discrete Resource Records (RRs) that dictate network routing and service endpoints:
A Record (Address): Maps an FQDN to a 32-bit IPv4 address (e.g., 192.0.2.1).
AAAA Record (IPv6 Address): Maps an FQDN to a 128-bit IPv6 address (RFC 3596).
CNAME (Canonical Name): Creates an alias pointing one domain name to another canonical hostname. Under RFC 1912, CNAME records cannot coexist with other records on the zone apex (root).
MX (Mail Exchange): Defines mail delivery agents responsible for receiving inbound emails, including preference numbers where lower values indicate higher delivery priority.
TXT (Text Record): Stores machine-readable text data, most notably email security frameworks including SPF (Sender Policy Framework), DKIM public verification keys, and DMARC enforcement policies.
NS (Name Server): Delegates a DNS zone to authoritative nameservers responsible for publishing its official records.
SOA (Start of Authority): Contains authoritative zone administrative parameters including the primary nameserver, administrator email, zone serial number, refresh intervals, retry limits, and minimum negative caching TTL.
CAA (Certification Authority Authorization): Restricts which Certificate Authorities (e.g., Let's Encrypt, DigiCert) are legally authorized to issue SSL/TLS certificates for the domain (RFC 6844).
2. The Iterative vs. Recursive DNS Resolution Lifecycle
When a client initiates a lookup, the operating system's local stub resolver queries a configured recursive resolver (such as Cloudflare 1.1.1.1 or Google Public DNS 8.8.8.8). If the record is not cached within its Time-to-Live (TTL) window, the recursive resolver undertakes an iterative traversal:
Root Nameserver Query: Queries one of the 13 global root server clusters (named A through M) to identify the Top-Level Domain (TLD) nameservers (e.g., .com or .org).
TLD Server Referral: The TLD nameserver returns the authoritative nameservers registered for the specific second-level domain.
Authoritative Nameserver Query: The recursive resolver contacts the authoritative nameserver directly to retrieve the final resource record.
Client Caching: The response is delivered to the client and stored in local cache according to the record's TTL setting.
3. Modern Encrypted DNS: DoH vs. DoT
Legacy DNS queries transmit over unencrypted plaintext UDP, leaving lookups vulnerable to eavesdropping, ISP telemetry harvesting, and DNS spoofing / cache poisoning attacks. Modern network architectures employ encrypted protocols:
DNS over HTTPS (DoH - RFC 8484): Encapsulates DNS queries within standard HTTPS port 443 traffic, blending DNS lookups into regular web traffic and preventing network firewalls from inspecting or filtering domain queries.
DNS over TLS (DoT - RFC 7858): Encrypts queries using dedicated TLS tunnels over TCP port 853, establishing strict transport-layer privacy between client resolvers and upstream servers.