DNS Lookup

DNS Lookup answers two questions in one search: what does this domain’s DNS actually say, and is its email protected from spoofing? Type a domain and get every record type in one view: A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, plus a plain-English SPF, DKIM and DMARC report card that tells you exactly what to fix, with a copy-paste record when something’s missing.

DNS records 101

A domain’s DNS zone is a small set of record types, each with one job:

Type	What it holds	Why you’d check it
A	IPv4 address(es)	Where the domain actually points
AAAA	IPv6 address(es)	Modern dual-stack hosting
CNAME	An alias to another hostname	www pointing at a CDN, app pointing at a SaaS host
MX	Mail servers, ranked by priority	Where email for @yourdomain.com gets delivered
NS	The nameservers authoritative for the domain	Who actually controls the zone
TXT	Free-text records	SPF, domain-verification codes, and anything else that needs a text slot
SOA	Zone metadata (serial, refresh, retry, expire)	How the zone propagates between nameservers
CAA	Which certificate authorities may issue SSL certs	Cheap insurance against a mis-issued certificate

Most of these are set-and-forget: you configure MX and A records once with your registrar or DNS host and rarely touch them again. TXT is the exception: it’s the one record type that keeps growing, because every service you connect (Google Workspace, HubSpot, Stripe, a CDN, an SPF policy) claims a line in it to prove domain ownership or declare a mail policy. DNS Lookup groups every TXT record and recognises the common ones (SPF, Google/Facebook/Microsoft site-verification, DocuSign) with a chip, so a crowded TXT zone stops being a wall of unlabelled strings.

The deliverability deep-dive: SPF, DKIM, DMARC

Since Gmail and Yahoo’s 2024 sender requirements, a domain without all three of these configured correctly will see mail filtered, bulk-rejected, or silently dropped, even when the message content is completely legitimate.

SPF (Sender Policy Framework) is a TXT record starting v=spf1 that lists which servers are allowed to send mail claiming to be from your domain. Receivers check the sending server against this list. The two mistakes that break SPF silently: publishing two SPF records (RFC 7208 says exactly one is valid: receivers must ignore both), and exceeding 10 DNS lookups across every include, a, mx, exists and redirect mechanism, which returns a permanent error and voids the whole record. This tool counts your lookups and walks one level into every include: so you can see exactly where the budget goes. The qualifier on the final all mechanism matters too: -all (strict: reject anything not listed) and ~all (soft-fail: flag but usually still deliver) are both fine; ?all, +all, or no all mechanism at all effectively tells receivers “anyone may send as this domain,” which defeats the purpose.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing message using a private key your mail provider holds, matched against a public key published in DNS at <selector>._domainkey.yourdomain.com. There’s no single place to look: the selector name is chosen by whichever provider set it up, so DNS Lookup auto-tries the dozen most common selectors (Google, Microsoft 365, Mailchimp, Postmark, and several generic defaults) and reports the key it finds, or lets you specify your own selector if you know it. A selector that exists but publishes an empty key is revoked, not active, a subtly different (and easy-to-miss) failure mode from simply having no DKIM at all.

DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together and tells receivers what to do when a message fails both: do nothing but report (p=none), send it to spam (p=quarantine), or reject it outright (p=reject). It also gives you visibility: the rua= tag is where aggregate reports get emailed, showing you who’s sending mail as your domain, including any spoofing attempts you’d otherwise never see.

Add DMARC in 5 minutes

If DNS Lookup shows your DMARC as missing, here’s the fastest safe path:

1. Start in monitoring mode. Add a TXT record at _dmarc.yourdomain.com with the value v=DMARC1; p=none; rua=mailto:[email protected]. This is the exact record this tool offers as a one-click copy when DMARC is missing; p=none means nothing about your mail flow changes yet.
2. Wait a few days, then read the reports. The rua= address starts receiving daily XML aggregate reports (most DNS/email providers also offer a human-readable dashboard) showing every source sending mail as your domain and whether it passed SPF/DKIM alignment.
3. Confirm your own legitimate senders are passing: your website’s transactional mail, your marketing platform, your helpdesk. If something legitimate is failing, fix its SPF/DKIM setup before tightening the policy, or it will start getting rejected in the next step.
4. Tighten to p=quarantine once you’re confident nothing legitimate is failing. Failing mail now lands in spam instead of the inbox.
5. Move to p=reject as the final step: failing mail is refused outright. This is the strongest protection and where most well-run domains eventually land.

Re-run DNS Lookup after each change: the email security card re-evaluates instantly and shows the new verdict along with any remaining issues (missing reporting address, a pct= under 100, an SPF record still creeping toward the 10-lookup limit).

For AI agents

This tool exposes a plain-text endpoint designed for language models and agents:

GET https://nitrosites.com/tools/dns-lookup/scan.php?url=<target>&format=agent

It returns a token-cheap digest of the same analysis shown on this page: every DNS record plus the SPF/DKIM/DMARC verdicts, so an agent can answer “is this domain’s email set up right?” from a single GET. An optional &selector=<name> parameter targets a specific DKIM selector. Soft rate limits apply; results are cached briefly. No key or login required.

Frequently asked questions

What do SPF, DKIM and DMARC actually do?

SPF lists which servers may send mail for your domain, DKIM cryptographically signs each message, and DMARC tells receivers what to do when either check fails, and sends you reports. Together they stop spoofing and keep your mail out of junk folders.

Why is my email going to spam even though it "works"?

Since 2024, Gmail and Yahoo enforce authentication: domains without aligned SPF/DKIM and a DMARC record get filtered or rejected, especially at volume. Run your domain here; the email card shows exactly what's missing.

What does "p=none" mean in my DMARC record?

Monitoring mode: you receive reports but spoofed mail is still delivered. It's the right first step, but once your legitimate mail passes, tighten to p=quarantine and then p=reject.

How many DNS lookups can an SPF record use?

Ten. Every include, a, mx, exists and redirect counts, and going over returns a permanent error: receivers treat your SPF as broken. This tool counts them for you.

What is a CAA record?

It names which certificate authorities may issue SSL certificates for your domain. It's optional but cheap insurance against mis-issued certificates.