How to use DNS Lookup via DoH
- Open the tool. Open this page in a browser with an internet connection.
- Run the check. Enter a domain or record hostname, select a record type, and choose Look up DNS.
- Analyze the data. Review results and limitations, copy available data, and rerun after changing your network settings.
What is DNS over HTTPS (DoH)?
The domain name system translates names into records that applications use to locate services. DNS over HTTPS (DoH) carries the query in an encrypted HTTPS connection to a resolver. This tool sends your chosen hostname directly to Cloudflare, which can answer from its cache or consult the DNS hierarchy and authoritative nameserver. Encryption protects the browser-to-resolver hop; it does not hide the query from the resolver.
Time to Live (TTL) is the lifetime of a cached record in seconds. A recursive response may show the remaining cache lifetime rather than the original zone value. Zone file propagation is not a single global push: resolvers retain old answers until they expire. This lookup provides a current view from one resolver, not a guarantee of zero propagation delay or worldwide agreement.
The table preserves response names, numeric record types, TTLs, and target values. NXDOMAIN means the queried name does not exist according to the resolver. A successful response with no answers means that type may be absent. SERVFAIL can indicate an upstream outage or DNSSEC validation problem. Raw JSON also exposes authority records and flags useful for diagnosing these cases.
Common DNS Record Types Explained (A, MX, TXT, CNAME)
An A record maps a name to IPv4; AAAA maps it to IPv6. A canonical name (CNAME) aliases one hostname to another, so a response may contain both the alias and its resolved address. A mail exchanger (MX) record directs inbound email to a hostname, with lower preference numbers usually tried first. NS records identify nameservers, and SOA describes zone administration, serial numbers, and timing values.
TXT records store text used for domain ownership and email policy. SPF and DKIM verification require the correct hostname: SPF commonly lives at the domain root, while DKIM uses a selector such as selector1._domainkey.example.com. Querying the root does not list every DKIM selector or the entire zone. Avoid entering passwords or other private data; submitted names are sent to the public resolver.
What this network tool measures
Authoritative record vocabulary
Explains A, AAAA, MX, TXT, CNAME, NS and SOA responses using the fields returned by the resolver.
Resolver status and TTL context
Makes NXDOMAIN, SERVFAIL, empty answers and remaining TTL values visible for practical diagnosis.
Readable and raw evidence
Pairs a table for quick inspection with raw JSON for flags, authority data and details that are easy to omit in a summary.
When this check is useful
Verify a website migration
Check address records and TTL behavior after changing hosting, DNS providers or a CDN configuration.
Diagnose email delivery
Inspect MX targets and verify that those hostnames resolve before changing mail settings.
Review domain verification
Query TXT records for ownership or email-policy checks without treating one resolver response as a complete zone export.
Frequently Asked Questions
How long does DNS propagation take?
Cached answers normally persist until their previous TTL expires. Negative caching, delegation changes, and resolver behavior can extend the visible transition. Compare multiple resolvers and the authoritative nameserver before concluding that a change has failed.
Why is my MX record not resolving?
Check the exact domain, its nameserver delegation, and whether an MX record exists. NXDOMAIN differs from an empty answer or SERVFAIL. Verify that the MX target is a hostname with usable address records and allow previous cache entries to expire.
Does DoH bypass all DNS caching?
No. HTTPS encrypts transport to the resolver; it does not remove resolver caches or TTL rules. This tool bypasses the browser HTTP cache for its request, while Cloudflare can still return a cached DNS answer.
Why does a TXT lookup not show every email setting?
TXT records are returned for the exact hostname queried. SPF, DKIM and DMARC use different names, and a resolver response is not a full zone listing. Query the relevant policy name and selector separately.
Can this lookup prove that my DNS change is live everywhere?
No. It reports one resolver view. Compare the authoritative nameserver and independent resolvers, and account for TTL and negative caching before treating a change as globally propagated.
Do I need an internet connection, and are my inputs uploaded?
An internet connection is required. The site handshake sends a random challenge, not files or text inputs. Network diagnostics need external connections. IP checks contact Cloudflare and ipapi; DNS queries send the entered hostname to Cloudflare; WebRTC contacts Google STUN; latency probes contact the listed providers. Those services receive your connection address and may apply their own logging policies. Results are not saved by this tool.
Continue checking your network
Technical references: Cloudflare DNS JSON, ipapi fields, WebRTC candidate addresses, Brave IP handling.