DNS Lookup over HTTPS
Query public DNS records through Cloudflare or Google DNS over HTTPS. Inspect answers, TTL, response codes and resolver DNSSEC flags.
Queries are sent to the selected public resolver.
Query a specific public resolver
Choose Cloudflare or Google, select a record type and enter a DNS name. Internationalized domains are converted to their ASCII form. SRV-style names such as _sip._tcp.example.com are accepted. For PTR queries, an IPv4 or IPv6 address is converted into its reverse-DNS name.
The result separates Answer, Authority and Additional records and shows record type, data and remaining TTL in seconds. NXDOMAIN is a DNS response, not a failed HTTP connection. NOERROR with no answers can mean that the name exists but no record of the requested type was returned.
Caching, DNSSEC and privacy
These are public resolver results, which can differ from your operating system, local network, split-horizon DNS or an authoritative server. Resolver caches still apply even though this page does not reuse a browser response. This tool cannot flush those caches or prove worldwide propagation.
Queries go directly from your browser to the selected service; that service sees the requested name and your connection. Google requests set edns_client_subnet=0.0.0.0/0. The DO option requests DNSSEC records; CD stays off. AD is the resolver’s assertion, not cryptographic verification performed by this page. Each request is cancellable, limited to 10 seconds and 1 MB of JSON. The provider JSON schema is not an IETF-standard wire format.
Reference
Questions & answers
Will this reveal an internal-only DNS zone?
Usually not. The selected public resolver sees its own DNS view, not your internal resolver configuration.
Does AD=false prove a record is unsafe?
No. It means the response did not assert authenticated data. The zone may be unsigned, the response may not be validated, or other resolver behavior may apply.