Use the form example.com. Pasting a URL works — only the hostname is used.
Enter a domain and press Look up.
Look up A, MX, TXT and other records for a domain. The mail tab checks whether the anti-spoofing records — SPF, DKIM and DMARC — are in place.
This tool queries Cloudflare’s DNS-over-HTTPS (cloudflare-dns.com) directly to resolve records, so the domain you type is sent there — be aware that internal-only hostnames would leave your network. It does not go through this site’s server.
Questions
Where does the domain I type go?
To Cloudflare’s public DNS. Resolving a name requires asking some resolver; this tool asks that one directly rather than through a server of ours. Internal-only names would leave your network.
DKIM says not found.
The selector is probably different. DKIM records are named after the selector, so they cannot be guessed. Check your mail provider’s console, or the `s=` value in a received message’s `DKIM-Signature` header.
I changed a record but the old value comes back.
Caches hold it for the TTL. Wait out the seconds shown, or lower the TTL before making changes next time.
Does this pass through your server?
No. The browser queries Cloudflare directly.
My mail keeps landing in spam. What do I check first?
The three on the mail tab. Without SPF, anyone can put your domain in the From line. Without DMARC, nothing tells receivers what to do when SPF or DKIM fails. Without DKIM, there is no way to show the message was not altered in transit. Receivers can only conclude a message is genuine when all three are in place.
My SPF lists several sending services. Is that a problem?
There is a limit of ten. SPF is evaluated by following include: references, and once that exceeds ten lookups receivers stop and treat the check as failed. Adding sending services one at a time is how domains cross it without noticing.
Can these results disagree with what actually gets delivered?
Yes. This reads published records only; delivery also depends on the receiving side own policy. Correct records still lose to a poor sending-IP reputation or to the content of the message itself. The records are necessary, not sufficient.