DNSai nslookup record finder

DNS Record Finder supports 30+ record types including: Basic (A, AAAA, MX, TXT, NS, SOA, CNAME, DNAME, CAA), Email Authentication (DMARC, DKIM, SPF, BIMI), Service Discovery (SRV, HTTPS, SVCB, URI, NAPTR), DNSSEC (DNSKEY, DS, RRSIG, NSEC, NSEC3), and Security (PTR, TLSA, SSHFP, IPSECKEY, OPENPGPKEY).

Different DNS servers may have different cache states. Cloudflare (1.1.1.1) and Google (8.8.8.8) are major public resolvers. Testing against multiple servers helps verify DNS propagation and troubleshoot resolution issues across different networks.

Selecting 'All Record Types' queries multiple record types in one request, giving you a comprehensive view of a domain's DNS configuration. Selecting a specific type returns only that record type, which is faster when you know what you're looking for.

Including DKIM adds time because DKIM selectors aren't standardized — we test common selectors to find them. Exclude DKIM for faster results when you only need basic DNS records. Include it when auditing email authentication.

We use Certificate Transparency (CT) logs to automatically discover subdomains. When SSL/TLS certificates are issued, they're logged to public CT servers — we query these logs via crt.sh to find all subdomains that have had certificates issued. The "Subdomains" option shows ALL discovered subdomains with their resolved record types (A, AAAA, or CNAME). The "CNAME" option focuses specifically on subdomains with CNAME aliases, following chains to their final targets. Both are included in "All Record Types" lookups.

Our subdomain discovery relies on Certificate Transparency logs, which only capture subdomains that have had SSL/TLS certificates issued. Subdomains may not appear if: they've never had a certificate issued, they use internal/self-signed certificates, they're wildcard-covered without explicit certificates, they were created after the last CT log update, or they use non-standard ports. Additionally, some DNS records may have short TTLs and change frequently, or may be restricted by firewalls or geolocation policies. For more comprehensive subdomain enumeration, DNS Explorer offers a Deep Search feature that combines CT logs with DNS brute-forcing, zone transfers, and other discovery techniques.

CNAME lookup discovers subdomains and focuses on those that are aliases pointing to other hostnames. It follows the entire CNAME chain (e.g., www.example.com → cdn.example.net → 123.cloudfront.net) and resolves to the final IP address. This is useful for understanding CDN configurations, third-party service integrations, and potential subdomain takeover vulnerabilities. Subdomains lookup discovers ALL subdomains regardless of record type — showing A records (IPv4), AAAA records (IPv6), and CNAME records together. Use Subdomains for a complete inventory of a domain's infrastructure; use CNAME when you specifically need to analyze alias chains and external service dependencies.

Yes, after a lookup you can export results as JSON or CSV files, copy records to clipboard, or share a direct link. This makes it easy to document DNS configurations or share findings with colleagues.