Query any DNS record type for any domain. Enter a domain like nvidia.com or openai.com and select the record types you need — from basic A/MX records to DNSSEC and security records.
This tool gives you granular control over DNS queries. Need to check just the MX records? Select MX from the dropdown. Auditing DNSSEC configuration? Query DNSKEY and DS records specifically. You can also choose which DNS server to query (Cloudflare, Google, or NextDNS) to verify propagation across different resolvers.
Select a domain, choose your record type(s), and pick a DNS server. We query that server directly and return the authoritative records. Results include TTL values, record data, and when available, additional context like IP geolocation for A/AAAA records.
Record Categories: Basic DNS (A, AAAA, MX, TXT, NS, SOA, CNAME), Email Authentication (DMARC, DKIM, SPF, BIMI), Service Discovery (SRV, HTTPS, SVCB), DNSSEC (DNSKEY, DS, RRSIG, NSEC), and Security (TLSA, SSHFP, CAA).
DKIM Option: Including DKIM searches common selectors to discover DKIM keys. This adds time to the lookup but is essential for email authentication audits.
DNS Record Finder supports 30+ record types including: Basic (A, AAAA, MX, TXT, NS, SOA, CNAME, DNAME, CAA), Email Authentication (DMARC, DKIM, SPF, BIMI), Service Discovery (SRV, HTTPS, SVCB, URI, NAPTR), DNSSEC (DNSKEY, DS, RRSIG, NSEC, NSEC3), and Security (PTR, TLSA, SSHFP, IPSECKEY, OPENPGPKEY).
Different DNS servers may have different cache states. Cloudflare (1.1.1.1) and Google (8.8.8.8) are major public resolvers. Testing against multiple servers helps verify DNS propagation and troubleshoot resolution issues across different networks.
Selecting 'All Record Types' queries multiple record types in one request, giving you a comprehensive view of a domain's DNS configuration. Selecting a specific type returns only that record type, which is faster when you know what you're looking for.
Including DKIM adds time because DKIM selectors aren't standardized — we test common selectors to find them. Exclude DKIM for faster results when you only need basic DNS records. Include it when auditing email authentication.
We use Certificate Transparency (CT) logs to automatically discover subdomains. When SSL/TLS certificates are issued, they're logged to public CT servers — we query these logs via crt.sh to find all subdomains that have had certificates issued. The "Subdomains" option shows ALL discovered subdomains with their resolved record types (A, AAAA, or CNAME). The "CNAME" option focuses specifically on subdomains with CNAME aliases, following chains to their final targets. Both are included in "All Record Types" lookups.
Our subdomain discovery relies on Certificate Transparency logs, which only capture subdomains that have had SSL/TLS certificates issued. Subdomains may not appear if: they've never had a certificate issued, they use internal/self-signed certificates, they're wildcard-covered without explicit certificates, they were created after the last CT log update, or they use non-standard ports. Additionally, some DNS records may have short TTLs and change frequently, or may be restricted by firewalls or geolocation policies. For more comprehensive subdomain enumeration, DNS Explorer offers a Deep Search feature that combines CT logs with DNS brute-forcing, zone transfers, and other discovery techniques.
CNAME lookup discovers subdomains and focuses on those that are aliases pointing to other hostnames. It follows the entire CNAME chain (e.g., www.example.com → cdn.example.net → 123.cloudfront.net) and resolves to the final IP address. This is useful for understanding CDN configurations, third-party service integrations, and potential subdomain takeover vulnerabilities. Subdomains lookup discovers ALL subdomains regardless of record type — showing A records (IPv4), AAAA records (IPv6), and CNAME records together. Use Subdomains for a complete inventory of a domain's infrastructure; use CNAME when you specifically need to analyze alias chains and external service dependencies.
Yes, after a lookup you can export results as JSON or CSV files, copy records to clipboard, or share a direct link. This makes it easy to document DNS configurations or share findings with colleagues.
DNS Explorer — Run bulk DKIM, SPF, and DMARC lookups across thousands of domains. Built for security teams, MSPs, and IT administrators who need to audit email authentication configurations across their entire domain portfolio.
Start free DNS Explorer trial14-day full-feature trial