DNS Lookup

DNS is the internet's directory - it turns names like example.com into the addresses, mail servers, and security keys computers actually use. A lookup asks a resolver for that information, and if nothing's cached, the resolver works its way down to the domain's own name servers for a fresh answer. Everything below is queried live, straight from those servers.

A - IPv4 Address

Points a hostname to an IPv4 address - the classic x.x.x.x format, and the record that actually gets a browser connected. A domain can list more than one; resolvers just rotate between them.

AAAA - IPv6 Address

Same job as an A record, but for IPv6. Most domains publish both so older and newer networks can each connect.

CNAME - Canonical Name

An alias that points one hostname to another - www to the bare domain, say. A name with a CNAME can't have any other record type, and it usually can't sit on a domain's root.

MX - Mail Exchange

Says which mail servers handle email for the domain, ranked by priority - lowest number wins, and the rest are fallbacks. No MX record generally means no incoming email.

NS - Name Server

Lists the servers that actually hold this domain's DNS data and answer every other lookup on this page. Set at the registrar, they're how a domain points to whichever provider runs its DNS.

SOA - Start of Authority

Housekeeping for the whole zone: the primary name server, an admin contact, a serial number that ticks up on every change, and the timers secondary servers use to stay in sync.

TXT - Text

Free-form text attached to a domain. Once just notes, it's now mostly used to prove ownership or to carry standards like SPF, which lives in a TXT record of its own.

SPF - Sender Policy Framework

A TXT record listing which servers are allowed to send mail as this domain. Receiving servers check it and can reject anything that doesn't match - one of the main defenses against spoofed email.

DMARC

Builds on SPF and DKIM. Tells receiving servers what to do with mail that fails those checks - deliver it, flag it, or block it - and where to send reports on that activity.

BIMI - Brand Indicators for Message Identification

Points to a verified logo that mail clients like Gmail show next to your email - but only once DMARC is properly enforced. A reward for getting the rest right, not a standalone feature.

MTA-STS - Mail Transfer Agent Strict Transport Security

Forces incoming mail onto an encrypted, verified connection, closing a gap where plain SMTP can otherwise be silently downgraded by someone in the middle.

TLSRPT - SMTP TLS Reporting

Tells other mail servers where to send reports when a secure connection to this domain fails. Usually deployed alongside MTA-STS as its feedback loop.

DNSKEY - DNSSEC Public Key

Holds the public keys used to verify DNSSEC signatures, letting a resolver confirm the records it got are genuine and untampered. Only shows up if the domain has DNSSEC enabled.

Want a deeper check of just the mail-authentication records? See SPF Checker and DMARC Checker.