How to use the DNS Record Lookup and Email Security Check

  1. Type a domain, or an IP address for a reverse (PTR) lookup.
  2. Choose a record type, or All for the common ones, and press Look up.
  3. For mail, switch to Email security and add your DKIM selector if you know it.
  4. Read the findings, most serious first, each with the record to publish where one is needed.

What a DNS lookup shows

A DNS lookup asks a resolver for the records published under a name: A and AAAA give its IPv4 and IPv6 addresses, MX says which servers take its mail, TXT holds text such as SPF and DMARC policies, and NS names the servers authoritative for the zone. This tool sends each question as DNS over HTTPS (RFC 8484) from your browser to Cloudflare’s 1.1.1.1 resolver, falling back to Google’s, and shows the answer with its TTL and whether DNSSEC validated it.

Record types

TypeWhat it holds
A, AAAAIPv4 and IPv6 addresses of the name
CNAMEAn alias: the name is another name
MXMail servers, with a priority; lower is tried first
TXTFree text: SPF, DMARC, DKIM keys, site verification
NS, SOAThe zone’s name servers and its serial and timers
CAAWhich certificate authorities may issue for the name (RFC 8659)
SRVHost and port of a service, such as _sip._tcp
PTRThe name an IP address points back to (reverse DNS)
DS, DNSKEYDNSSEC: the parent’s hash of the key, and the zone’s keys

Type an IP address and the tool builds the reverse name for you: 192.0.2.10 becomes 10.2.0.192.in-addr.arpa, and IPv6 addresses become 32 nibbles under ip6.arpa. The AD flag in an answer means the resolver checked its DNSSEC signatures.

What the email security audit checks

  • SPF (RFC 7208): one v=spf1 record, and no more than 10 DNS lookups in total. include, a, mx, ptr, exists and redirect each cost one, counted through every nested include. Past ten, receivers return permerror and SPF fails for every message. More than two lookups that find nothing (void lookups) is also an error. The ending matters: -all fails unlisted senders, ~all soft-fails them, ?all says nothing and +all lets anyone send.
  • DMARC (RFC 7489) at _dmarc.<domain>: the policy p= (none, quarantine or reject), sp= for subdomains, pct=, the rua= report address, and strict or relaxed alignment.
  • DKIM (RFC 6376) at <selector>._domainkey.<domain>: the key type and size. Selectors cannot be listed, so the tool tries common ones (google, selector1, selector2, k1, s1, default and others) plus any you type. RFC 8301 recommends 2048-bit RSA.
  • MX: priorities, a null MX (0 ., RFC 7505) for a domain that takes no mail, and targets that are CNAMEs or IP addresses, which are not allowed.
  • MTA-STS (RFC 8461), TLS-RPT (RFC 8460) and BIMI: whether each is announced. A browser cannot read the MTA-STS policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt because it is served without CORS headers, so open that link yourself.

Worked example

A typical record for a domain that sends through Google Workspace and a newsletter service:

example.com.        TXT  "v=spf1 include:_spf.google.com include:servers.mcsv.net -all"
_dmarc.example.com. TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

The same checks from a terminal:

dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short TXT google._domainkey.example.com
dig +short -x 192.0.2.10

Common errors and how to fix them

  • "SPF permerror: too many DNS lookups". Remove includes for services you no longer use, and replace an include you control with ip4: and ip6: ranges, which cost nothing.
  • Two SPF records. Adding a provider often adds a second v=spf1 record. Merge them into one; with two, SPF fails.
  • DMARC stuck at p=none. It only collects reports. Once the reports show your own mail passing, move to quarantine, then reject.
  • No DKIM key found. Open a message you sent, find the DKIM-Signature header and type its s= value as the selector.
  • NXDOMAIN for a record you just added. Check you added it in the zone that is actually authoritative (the NS records), and wait out the negative-cache TTL from the SOA.

From DNS to a running site

Once the A record points at your server, Shipown can install Nginx, Certbot and its Nginx plugin over SSH. Pointing the domain at an app then writes the virtual host, tests the configuration before reloading Nginx, and asks Certbot for a certificate. For mail, follow your mail provider’s DNS instructions and check the result here.

Frequently asked questions

What is the SPF 10 DNS lookup limit?

RFC 7208 lets SPF evaluation make at most 10 DNS lookups, counting include, a, mx, ptr, exists and redirect through every nested include. Past that, receivers return permerror and SPF fails.

How do I find my DKIM selector?

Open an email your domain sent, view its headers, and find DKIM-Signature. The s= tag is the selector, and the key is at <selector>._domainkey.<your domain>.

What does the AD flag mean in a DNS answer?

Authenticated Data: the resolver validated the answer with DNSSEC. It is missing when the zone is not signed or the chain of trust is incomplete.

Should DMARC be p=none, quarantine or reject?

Start with p=none to collect reports, then move to quarantine and finally reject once your own mail passes. p=none on its own protects nothing.

Why does this tool use DNS over HTTPS?

A browser cannot send ordinary DNS queries, so the questions go over HTTPS to Cloudflare or Google, which return JSON. The answers are the same as dig would get from those resolvers.

Why does a new DNS record not show up yet?

Resolvers cache answers for the TTL, and cache a missing name for the SOA’s negative TTL. Wait that long, and check the record is in the zone your NS records point at.

All 26 free tools →