DNS Lookup

How to use this DNS lookup tool

Enter a domain name.
Choose which record type to query.
See the results instantly, queried live from Google's public DNS.

How does this work without a server?

This tool queries Google's public DNS-over-HTTPS API directly from your browser — the same resolver infrastructure that powers 8.8.8.8, just accessed over HTTPS instead of the traditional DNS protocol. No data passes through OmniDeck's own servers.

Why might results differ from what I see elsewhere?

DNS changes take time to propagate, and different resolvers around the world may have cached the old value for different amounts of time — this tool queries Google's resolver specifically, which may differ briefly from your ISP's resolver.

What does an empty result mean?

It means that record type doesn't exist for this domain — for example, most domains have no CAA record, which is normal and doesn't indicate a problem.

What DNS-over-HTTPS actually changes versus traditional DNS

Traditional DNS queries travel as plain, unencrypted UDP packets on port 53, which means anyone positioned between your device and the resolver — your ISP, a network operator on a public Wi-Fi network, anyone technically capable of observing that traffic — can see exactly which domains you're looking up, and in some cases modify the response before it reaches you. DNS-over-HTTPS wraps the same query inside a normal, encrypted HTTPS request, indistinguishable in transit from any other secure web traffic, which prevents both the eavesdropping and the tampering traditional DNS is vulnerable to. This tool uses DoH specifically so the actual lookup — not just this page — happens over an encrypted channel between your browser and Google's resolver.

Why TTL determines how "live" any DNS answer really is

Every DNS record carries a Time To Live (TTL) value, in seconds, that tells any resolver caching that record how long it's allowed to keep serving that cached answer before checking with the authoritative server again. A "live" query through this tool still reflects whatever Google's resolver currently has cached, which is accurate as of that resolver's last refresh — if a domain's TTL is set to 3600 seconds (one hour) and the record changed 10 minutes ago, a query might still return the old value until that cache entry expires and gets refreshed. This is a normal, expected part of how DNS caching works at scale, not something specific to this tool, and it's the reason DNS changes take real, TTL-dependent time to become visible everywhere rather than updating instantly worldwide.

Why a domain can legitimately return different answers depending on where you're resolving from

Beyond ordinary propagation delay, many large websites deliberately configure their DNS to return different answers to different resolvers based on geographic location or network path — a technique broadly called geoDNS, often combined with anycast routing, used specifically to direct users to the nearest data center or CDN edge server for better performance. This means two people querying the exact same domain from different resolvers in different parts of the world can correctly receive two different, both entirely valid, IP addresses — this isn't a propagation lag or an error, it's the DNS system working as intended to route traffic efficiently. Worth keeping in mind before assuming a different result from another tool or location means something is broken.

The record types beyond what this tool shows

The eight record types this tool queries (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA) cover the vast majority of what most people need to check, but DNS supports several other specialized types for specific purposes: SRV records advertise the location of specific services (used by protocols like SIP and XMPP), PTR records support reverse DNS lookups (IP address to hostname, the opposite direction of a normal lookup), and DNSKEY/DS/RRSIG records support DNSSEC, the cryptographic signing system that lets a resolver verify DNS answers haven't been tampered with. These exist for more specialized diagnostic and infrastructure needs beyond typical domain configuration checks.

Limitations of this tool

This tool queries a single specific resolver — Google's public DNS-over-HTTPS service — which means it shows you what that one resolver currently has cached, not a comprehensive view across every resolver worldwide (this site's separate DNS Propagation Checker handles that comparison). It also doesn't validate or display DNSSEC signing status, doesn't perform a full authoritative-server trace the way a command-line tool like dig +trace does, and is limited to the record types listed in the dropdown rather than the complete set DNS supports. For a quick, single-resolver check of common record types, this is a fast and reliable tool; for deeper DNS diagnostics, a dedicated command-line tool gives more complete visibility.