DNS record types and what a check returns
A DNS check returns one type at a time. The type tells you whether the value is an address, a mail host, a nameserver, or a text string. Query the type that matches the problem, not every row in the zone.
| Type | What the check returns | What a match looks like |
|---|---|---|
| A | An IPv4 address | The address your host assigned to the site |
| AAAA | An IPv6 address | Present only when the host assigned IPv6 |
| CNAME | Another hostname | An alias, usually www, not an IP address |
| MX | A mail hostname and a preference | The mail host your email provider listed |
| NS | Nameserver hostnames | The DNS host where you edit the zone |
| TXT | Text, including SPF | The string a service asked you to publish |
| SOA | Primary nameserver and a serial | A serial that rises after you edit the zone |
SOA is the zone header: the primary nameserver and a serial that should rise after an edit. PTR maps an IP address back to a name, and it is not the check for whether the website opens. DNS records explained defines each row when you are changing the zone rather than reading the live answer.
How to check DNS records with the WebJi lookup
Use the DNS lookup when you want the current answer in a browser. Type the domain, pick the record type, and read the value and the TTL. There is no signup. The query runs against live DNS, so the value is what that lookup received.
- Open the lookup and enter the bare domain, such as example.com. Leave off https:// and any path.
- Choose the type. Start with A if the site will not open, MX if mail bounces, NS if edits never appear, or TXT if a verification string is missing.
- Read the value and the TTL. The TTL is how many seconds a resolver may keep that answer.
- Compare the value with the zone on the nameservers from the NS check. A match means the published record is the one you expected.
You know it worked when the value equals the row you saved. If the site will not open, query A and AAAA and compare both with the IP address your host gave you.
How to check nameserver records
Nameserver records are the NS type on the bare domain. They are hostnames, usually two or more, and they name the DNS company that publishes every other record. Check NS before you decide an A or MX row is wrong.
The list should match the nameservers saved at the registrar. If the lookup shows a different pair, you are editing a panel the internet is not reading. Change the records only at the host those NS names point to. The delegation for the whole domain is the NS answer on the bare name, not on www.
You know the NS check worked when every hostname in the answer is one you recognise from the registrar, and a follow-up query to one of those hosts returns the A record you saved.
How to read A, MX, TXT and CNAME results
An A result is one or more IPv4 addresses. If it is empty, or it is not the address your host assigned, that name will not open the site you expect. AAAA is the IPv6 address. A missing AAAA is normal when the host has not assigned IPv6.
An MX result is a mail hostname plus a preference number. The lower number is tried first. The hostname should itself have an A record, and it should be the host your email provider listed. A TXT result on the bare domain often starts with v=spf1. DKIM is a TXT record on a selector name, and DMARC is a TXT record on _dmarc.
A CNAME result is another hostname, not an IP address. A www name is the usual alias. The bare domain should return A or AAAA, because a CNAME on that name collides with MX and other rows. The check worked when each type you queried matches the row in the zone.
How to check DNS records with dig
On macOS or Linux, dig prints the answer, the TTL, and which server replied. Open Terminal and run dig example.com A. Change the type when you need mail, nameservers, or text.
- A record: dig example.com A
- MX record: dig example.com MX
- Nameserver records: dig example.com NS
- TXT record: dig example.com TXT
Add +short to print only the values, as in dig example.com MX +short. To see past a resolver cache, ask one nameserver from the NS answer, for example dig example.com A @ns1.example.net, using the hostname you just found. The check worked when the answer shows the value you saved and the status is NOERROR.
How to check DNS records with nslookup on Windows
On Windows, open Command Prompt and run nslookup example.com. That query returns the A record. Set the type before the name when you need mail, nameservers, or text.
- Mail: nslookup -type=MX example.com
- Nameservers: nslookup -type=NS example.com
- Text: nslookup -type=TXT example.com
The check worked when the answer lists the value you saved. Non-existent domain means that name has no record of the type you asked for. A timeout means the server you asked did not reply, which is not the same as an empty zone.
How to tell if a DNS change has propagated
Query the nameserver the NS record names, then run the same query with no server named. If the first answer is new and the second is old, resolvers still hold the previous TTL. Wait out that TTL. Do not edit the row again while you wait.
A nameserver change at the registrar is a different wait. The registry has to publish the new delegation, and that can outlast the TTL on an old A record. Recheck NS and the records at the new host separately. DNS propagation is that gap between the zone you saved and the answer a resolver still has cached.
How to fix a wrong or stale DNS record
Set the nameservers at the registrar, then edit records only in the DNS host those nameservers point at. Editing the other panel does nothing. A website and its mail can use different hosts: the A record sends the site, MX sends the mail.
After the save, query that type again from outside the panel. The fix worked when the live value matches the row you saved. If the panel is right and the lookup is still old, you are waiting on TTL, not on a second zone. Lower the TTL before a planned change if the next edit should expire sooner.
How to check DNS history
A live lookup cannot show DNS history. It returns the records published now, not yesterday's address, an old mail host, or the date a TXT row was added. The TTL tells you how long the current answer may be cached. It is not a log of past values.
If you need an earlier value, that copy lives in an outside archive, and those archives miss records. This check does not store one. Before a move, write down the A, MX, NS and TXT values you see today so you have your own copy.
Frequently Asked Questions
How do I check my domain's DNS records?
Enter the domain on a live lookup and choose the type: A for the site, MX for mail, NS for nameservers, or TXT for SPF. The value on screen is what that query returned, plus the TTL.
How can I check DNS records online?
Open the WebJi DNS lookup, type the domain with no https and no path, and pick the record type. You do not need an account. Compare the value with the zone your nameservers publish.
How do I check nameserver records?
Query the NS type on the bare domain. The answer is a list of nameserver hostnames. Those hosts are where the zone is published. If you edited a different panel, the lookup will not change.
Are DNS records public?
Records the zone publishes are public. Anyone can query the A, MX, NS and TXT values for a name. A row you have not saved, and a name you do not query, does not appear.
How do I check my DNS history?
A live lookup shows the records published now. It does not list yesterday's address, an old mail host, or the date a TXT row was added. Past copies, when they exist, sit in a separate archive, not in this answer.
How do I know if a DNS change has propagated?
Query the nameserver the NS record names, then query without naming a server. If only the second answer is old, wait out the TTL on that old answer. A nameserver change at the registrar can take longer than that TTL.
What does the dig command show?
dig example.com A prints the IPv4 answer, the TTL, and the server that replied. Swap A for MX, NS or TXT to check those types. Add +short when you only want the values.