DNS Lookup

The record types and what they are for

A maps a name to an IPv4 address; AAAA to IPv6. CNAME aliases one name to another, and cannot coexist with any other record at the same name, which is why you cannot CNAME a bare domain that also needs MX records. MX names the mail servers and carries a priority where lower wins. TXT holds arbitrary text and in practice holds SPF, DKIM and domain verification tokens. NS delegates a zone to its authoritative nameservers. SOA carries the zone's serial number and timing parameters.

TTL is a promise you already made

Every record carries a time-to-live telling resolvers how long they may cache it. Change a record with a 24-hour TTL and some resolvers will serve the old value for a full day, no matter how many times you flush your own cache. The fix is anticipatory: lower the TTL to 300 seconds at least one full TTL period before a planned migration, make the change, confirm propagation, then raise it back. Doing this after you have already changed the record does nothing for anyone already holding the old answer.

Authoritative versus recursive answers

Querying your ISP's resolver returns whatever it has cached. Querying the domain's own nameservers, listed in its NS records, returns the current truth. When a change appears live for you and broken for a colleague, the difference is almost always which resolver each of you is asking, not a fault in the zone.

NXDOMAIN, NOERROR and the empty answer

NXDOMAIN means the name does not exist at all. NOERROR with no records means the name exists but has nothing of the type you asked for, which is a completely different diagnosis: querying AAAA on an IPv4-only host returns NOERROR with an empty answer, not an error. Negative answers are cached too, governed by the SOA minimum field, so a name queried before it existed can stay unresolvable for a while after you create it.

Reading a mail configuration

Three TXT lookups tell you most of what matters. SPF at the domain root lists who may send; check it ends in -all or ~all and stays under ten DNS lookups, since exceeding that limit makes SPF fail outright. DKIM sits at a selector subdomain. DMARC lives at _dmarc.yourdomain.com and states what to do when the other two fail. A domain with no DMARC record has no policy, and increasingly that means reduced deliverability.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.