Where does the domain I type go?

To Cloudflare’s public DNS. Resolving a name requires asking some resolver; this tool asks that one directly rather than through a server of ours. Internal-only names would leave your network.

The selector is probably different. DKIM records are named after the selector, so they cannot be guessed. Check your mail provider’s console, or the `s=` value in a received message’s `DKIM-Signature` header.

I changed a record but the old value comes back.

Caches hold it for the TTL. Wait out the seconds shown, or lower the TTL before making changes next time.

Does this pass through your server?

No. The browser queries Cloudflare directly.

My mail keeps landing in spam. What do I check first?

The three on the mail tab. Without SPF, anyone can put your domain in the From line. Without DMARC, nothing tells receivers what to do when SPF or DKIM fails. Without DKIM, there is no way to show the message was not altered in transit. Receivers can only conclude a message is genuine when all three are in place.

My SPF lists several sending services. Is that a problem?

There is a limit of ten. SPF is evaluated by following include: references, and once that exceeds ten lookups receivers stop and treat the check as failed. Adding sending services one at a time is how domains cross it without noticing.

Can these results disagree with what actually gets delivered?

Yes. This reads published records only; delivery also depends on the receiving side own policy. Correct records still lose to a poor sending-IP reputation or to the content of the message itself. The records are necessary, not sufficient.

The list of mail servers allowed to send as that domain. A TXT record starting `v=spf1`; a trailing `-all` means reject anything else, `~all` means treat it as suspicious but accept.

The public key for the signature added to outgoing mail. It lives at ` ._domainkey. `, and the selector differs per provider (`google` for Google, `selector1` for Microsoft).

What to do with mail that fails SPF and DKIM. Found at `_dmarc. `: `p=none` is monitor only, `p=quarantine` means treat as spam, `p=reject` means refuse.

MX records and the numbers in front of them

The servers that accept mail for the domain. The number is a preference, and lower is tried first. Equal numbers share the load; higher ones are the fallback when the preferred host is down. A domain with no MX cannot receive mail at all.

An A record binds a name straight to an address. A CNAME says "this name is an alias for that name", and the target gets looked up in turn. A CNAME is not allowed at the apex of a domain (example.com itself); getting that wrong produces a setup that appears to work while mail quietly breaks.

NS lists the authoritative servers holding the answers for the domain; SOA carries its administrative data — contact address, serial number, default cache times. When a freshly transferred domain keeps returning old values, the NS records usually have not switched yet, and this is where you can see it.

Back to all tools／ Network

DNS lookup and mail authentication

This tool queries Cloudflare’s DNS-over-HTTPS (cloudflare-dns.com) directly to resolve records, so the domain you type is sent there — be aware that internal-only hostnames would leave your network. It does not go through this site’s server.

Look up A, MX, TXT and other records for a domain. The mail tab checks whether the anti-spoofing records — SPF, DKIM and DMARC — are in place.

Input

Domain name

Use the form example.com. Pasting a URL works — only the hostname is used.

Output

Enter a domain and press Look up.

The mail tab checks the three anti-spoofing records — SPF, DKIM and DMARC — together. With any one of them missing, spam sent in your domain's name is much harder to stop.

All tools

Why this one

All three mail records at once: SPF, DKIM and DMARC are all TXT records that simply live in different places. This queries all three in one press and states plainly which are missing.
Long TXT records are not truncated: TXT values come back split every 255 characters — long SPF lines hit this and look cut off if shown naively. The pieces are joined before display.
TTL is shown: Each record carries its remaining lifetime. When a change “has not taken effect”, the TTL is usually the reason, and this tells you how many seconds are left.

How to use it

Choose what to look up
Basic records covers A, MX, TXT and the rest; Mail covers the three anti-spoofing records.
Enter a domain
Use the form example.com. Pasting a URL works — only the hostname is used. Enter runs it.
Read the result
Values are listed with their TTL. Anything absent says so, which separates “not configured” from “not checked”.

Terms and how to read them

SPF: The list of mail servers allowed to send as that domain. A TXT record starting `v=spf1`; a trailing `-all` means reject anything else, `~all` means treat it as suspicious but accept.
DKIM: The public key for the signature added to outgoing mail. It lives at `<selector>._domainkey.<domain>`, and the selector differs per provider (`google` for Google, `selector1` for Microsoft).
DMARC: What to do with mail that fails SPF and DKIM. Found at `_dmarc.<domain>`: `p=none` is monitor only, `p=quarantine` means treat as spam, `p=reject` means refuse.
MX records and the numbers in front of them: The servers that accept mail for the domain. The number is a preference, and lower is tried first. Equal numbers share the load; higher ones are the fallback when the preferred host is down. A domain with no MX cannot receive mail at all.
CNAME versus A: An A record binds a name straight to an address. A CNAME says "this name is an alias for that name", and the target gets looked up in turn. A CNAME is not allowed at the apex of a domain (example.com itself); getting that wrong produces a setup that appears to work while mail quietly breaks.
NS and SOA: NS lists the authoritative servers holding the answers for the domain; SOA carries its administrative data — contact address, serial number, default cache times. When a freshly transferred domain keeps returning old values, the NS records usually have not switched yet, and this is where you can see it.

Questions

Where does the domain I type go?: To Cloudflare’s public DNS. Resolving a name requires asking some resolver; this tool asks that one directly rather than through a server of ours. Internal-only names would leave your network.
DKIM says not found.: The selector is probably different. DKIM records are named after the selector, so they cannot be guessed. Check your mail provider’s console, or the `s=` value in a received message’s `DKIM-Signature` header.
I changed a record but the old value comes back.: Caches hold it for the TTL. Wait out the seconds shown, or lower the TTL before making changes next time.
Does this pass through your server?: No. The browser queries Cloudflare directly.
My mail keeps landing in spam. What do I check first?: The three on the mail tab. Without SPF, anyone can put your domain in the From line. Without DMARC, nothing tells receivers what to do when SPF or DKIM fails. Without DKIM, there is no way to show the message was not altered in transit. Receivers can only conclude a message is genuine when all three are in place.
My SPF lists several sending services. Is that a problem?: There is a limit of ten. SPF is evaluated by following include: references, and once that exceeds ten lookups receivers stop and treat the check as failed. Adding sending services one at a time is how domains cross it without noticing.
Can these results disagree with what actually gets delivered?: Yes. This reads published records only; delivery also depends on the receiving side own policy. Correct records still lose to a poor sending-IP reputation or to the content of the message itself. The records are necessary, not sufficient.

Input

Output

Related tools

Why this one

How to use it

Choose what to look up

Enter a domain

Read the result

Terms and how to read them

Questions