DNS query
DNS query checks A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, PTR, and CAA records. It is useful for verifying DNS configuration, troubleshooting propagation, and preparing certificate requests. Open it at DNS query.
Query workflow
Section titled “Query workflow”-
Enter a domain
Enter the domain to query, such as
example.com. -
Choose a record type
Use the record type tags to select A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, PTR, or CAA.
-
Choose a DNS server
You can select a built-in public resolver:
- Alibaba Cloud:
223.5.5.5:53 - Tencent Cloud:
119.29.29.29:53 - Google:
8.8.8.8:53 - Cloudflare:
1.1.1.1:53
Or select Custom and enter a resolver in
IP:portformat, such as8.8.8.8:53. - Alibaba Cloud:
-
Run the query
Results show record name, type, TTL, value, and priority.
Query results
Section titled “Query results”After a successful query, the result card shows:
- Number of returned records.
- Query duration.
- DNS server used.
- Record table.
If the query succeeds but no matching record exists, the page states that no records were found.
The result area also provides a Request certificate shortcut. It opens Certificate management with the current domain, so you can continue from DNS verification to certificate issuance.
dig command
Section titled “dig command”The page generates a dig command from the current form, for example:
dig @8.8.8.8 example.com A +shortClick Copy to copy the command and reproduce the query in a terminal. This is useful when comparing results with a server environment, operations terminal, or another DNS tool.
Examples
Section titled “Examples”The Examples section contains common record-type examples. Click Try to populate the form and run the query immediately.
Supported record types
Section titled “Supported record types”| Type | Purpose |
|---|---|
| A | IPv4 address |
| AAAA | IPv6 address |
| CNAME | Alias record |
| MX | Mail server |
| TXT | Text records such as SPF, DKIM, DMARC, and domain validation |
| NS | Authoritative name servers |
| SOA | Start of authority |
| SRV | Service discovery |
| PTR | Reverse DNS |
| CAA | Allowed certificate authorities |
Troubleshooting scenarios
Section titled “Troubleshooting scenarios”DNS propagation differs
Section titled “DNS propagation differs”Query with different DNS servers. If domestic and international public resolvers return different values, cache expiry or authoritative DNS synchronization may still be in progress.
Certificate validation fails
Section titled “Certificate validation fails”Query the validation domain’s CNAME or TXT record and compare it with the certificate request instructions. Copy the dig command and re-check from a server if needed.
Mail configuration issues
Section titled “Mail configuration issues”Query MX and TXT records to verify mail server, SPF, DKIM, and DMARC configuration.
Certificate mis-issuance protection
Section titled “Certificate mis-issuance protection”Query CAA records to confirm that only trusted CAs can issue certificates for the domain.
Why must custom DNS include a port?
Section titled “Why must custom DNS include a port?”The current form validates custom DNS as address:port, for example 8.8.8.8:53, where 53 is the standard DNS port.
Why do DNS servers return different results?
Section titled “Why do DNS servers return different results?”Common causes include cache timing, recent DNS changes, authoritative DNS synchronization delay, or resolver geography. Results usually converge after TTL expires.
Why did the query succeed but return no records?
Section titled “Why did the query succeed but return no records?”The selected DNS server has no record of that type for the domain. Try another record type, another DNS server, or verify the domain spelling.