Guide
How to Check DNS Records: dig, nslookup & Online Lookup
Every DNS incident starts with the same question: “what do the records actually say right now?” Answering it takes one command. This guide covers the three ways to look up any record — and how to interpret the answer.
Method 1: dig (Linux/macOS, most powerful)
Common dig lookups
bashdig +short yourdomain.com A
dig +short yourdomain.com MX
dig +short yourdomain.com TXT
dig +short _dmarc.yourdomain.com TXT
# Bypass cache: ask the authoritative server directly
dig @ns1.yourprovider.com yourdomain.com A +short
# Full detail when debugging
dig yourdomain.com A +noall +answer +commentsThe @server form is the single most useful debugging trick: it separates “my change hasn't propagated” from “my change is wrong”.
Method 2: nslookup (Windows built-in)
nslookup basics
bashnslookup yourdomain.com
nslookup -type=MX yourdomain.com
nslookup -type=TXT yourdomain.com
# Query a specific server:
nslookup yourdomain.com 1.1.1.1Method 3: Online DNS lookup (no terminal)
Free lookup tools show every record type at once with propagation status across global resolvers — ideal for sharing a result with a teammate or verifying from networks you don't control. Use them after migrations, registrar moves, and any “the site works for me but not for them” report.
Reading the answer: what “correct” looks like
- Match the intent: A/AAAA should point at your infrastructure, MX at your mail provider, TXT exactly as each service specified (one stray quote breaks SPF).
- Check the TTL: the number beside each record is how long resolvers cache it — it dictates how fast your next change (or rollback) takes effect.
- Compare resolvers: authoritative vs. Google vs. Cloudflare. Disagreement is propagation; agreement on a wrong value is a zone error.
One-off lookups catch today's mistake. Continuous DNS monitoring catches tomorrow's — baseline the zone once, then get alerted on every drift with old-vs-new diffs.
Never miss an expiry again
Certack monitors SSL certificates, DNS records, and domain expiry continuously and alerts you on 9 channels before anything lapses. Two sites free, no credit card required.
Related guides
How to Check SSL Certificate Expiration: Browser, OpenSSL, curl & Online
Four reliable ways to check when an SSL certificate expires — in your browser, with OpenSSL, with curl, or with a free online checker — plus what the expiry date actually means.
How Long Do SSL Certificates Last? Validity in 2026 and the Road to 47 Days
Public TLS certificates last 200 days max since March 2026, dropping to 100 days in 2027 and 47 days in 2029. What the CA/Browser Forum timeline means for renewal automation.
What Happens When an SSL Certificate Expires?
Browser warnings, failed API calls, dropped search rankings, and broken integrations — exactly what breaks when a certificate lapses, and how to recover fast.