# DNS Lookup — Every Record, Mail Authentication and Propagation

> Pull every DNS record for a domain at once, check SPF and DMARC, and compare four public resolvers.

To look up DNS records, enter a domain and every record type is queried at once — A, AAAA, MX, NS, TXT, SOA, CAA and DNSSEC — rather than one at a time. The mail records are read as policy, so SPF and DMARC are graded on the clause that actually decides whether your mail is accepted, and the same query is put to four independent public resolvers so you can see whether a change has finished propagating.

**URL:** https://convertto.tech/t/dns-lookup
**Category:** Network Tools (https://convertto.tech/c/network-tools)
**Privacy:** Uses a server request
**Cost:** Free, no sign-up
**Last updated:** 2026-08-01

## Key facts

- **Privacy:** Uses a server — the address you enter is sent to perform the lookup
- **Resolvers:** Google, Cloudflare, NextDNS and AdGuard, queried in parallel
- **Coverage:** Ten record types plus SPF, DMARC and DNSSEC in one pass
- **Cost:** Free, unlimited, no sign-up

## How to use

1. Enter a domain — every record type is queried at once.
2. Read the mail panel for SPF, DMARC and DNSSEC problems in plain English.
3. Switch record type in the resolver panel to check propagation.
4. Download the whole zone as JSON if you need it elsewhere.

## FAQ

### What does TTL mean?

Time to live, in seconds — how long a resolver may cache the record before asking again. A 3600 TTL means a change can take up to an hour to be seen everywhere. Lower the TTL a day before a planned migration, then raise it afterwards.

### Why can I not see my new DNS record?

Either the change has not aged past the old TTL, or it was added to a zone that is not authoritative. Check the NS records first — if they point at a different provider than the one you edited, that is where your change needs to go. The resolver comparison shows which caches have caught up.

### What is DNS propagation, really?

Nothing propagates. Each resolver independently caches an answer until its TTL expires and then asks again, so during a change some resolvers hold the old answer and some the new one. That is why four resolvers are queried here — disagreement between them is exactly what "still propagating" looks like.

### My email goes to spam. What should I check here?

SPF ending in -all rather than ~all, and DMARC at p=quarantine or p=reject rather than p=none. Those two clauses are behind most deliverability problems, and both are graded on this page with the reason attached rather than printed as raw text.

### What does the DNSSEC line mean?

It reports whether answers came back authenticated, meaning the zone is signed and a resolver can detect tampering in transit. An unsigned zone is common and not a fault, but nothing cryptographically prevents a forged answer being accepted.

### Why does AdGuard sometimes disagree with the others?

AdGuard filters ad and tracker domains by policy, so it will refuse to resolve some names the others answer normally. That is a blocking decision rather than a propagation problem, which is why it is shown but excluded from the agreement test.

## Sources

- [RFC 1035 — Domain Names](https://www.rfc-editor.org/rfc/rfc1035) — IETF
- [RFC 7208 — Sender Policy Framework](https://www.rfc-editor.org/rfc/rfc7208) — IETF
- [RFC 7489 — DMARC](https://www.rfc-editor.org/rfc/rfc7489) — IETF
- [RFC 8484 — DNS Queries over HTTPS](https://www.rfc-editor.org/rfc/rfc8484) — IETF

## Related tools

- [Email Header Analyzer](https://convertto.tech/t/email-header-analyzer): Paste raw email headers to map the delivery path, time every hop and read the SPF, DKIM and DMARC results the receiving server recorded.
- [SSL Certificate Checker](https://convertto.tech/t/ssl-certificate-checker): Open a real TLS handshake to any host and read the certificate it is serving right now.
- [What Is My IP Address](https://convertto.tech/t/what-is-my-ip): Your public IPv4 and IPv6 address with the routing, registry, blocklist and VPN-leak detail behind it.
- [WHOIS / RDAP Domain Lookup](https://convertto.tech/t/whois-lookup): Registration dates, transfer locks and status codes in plain English, cross-checked against live DNS.
- [HTTP Header Checker](https://convertto.tech/t/http-header-checker): Follow every redirect, grade the security headers and read the cookie and caching settings.
- [Open Graph Preview](https://convertto.tech/t/open-graph-preview): Render your share card the way each platform really draws it, with the og:image measured.
- [Punycode Converter](https://convertto.tech/t/punycode-converter): Convert internationalised domain names to Punycode and decode xn-- domains back.
- [Connection & Network Information](https://convertto.tech/t/connection-info): See what your browser reports about the network: connection type, downlink estimate and round-trip time.