How to Check DNS Records
To check DNS records, query the domain for one record type at a time: A for the website’s IP, MX for mail hosts, NS for nameservers, TXT for SPF, DKIM or verification. Use an online DNS lookup, dig on macOS or Linux, or nslookup on Windows. Compare the answer and TTL with the zone you saved.
For site owners and admins diagnosing a site that will not open, bouncing email or a DNS edit that never seems to take effect.
knowledge
- Read time
- 6 min
- Sections
- 9
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
Which DNS record should you check for each problem?
Check A or AAAA when a website will not open, MX when email bounces, NS when edits never appear, TXT when SPF, DKIM or a verification fails, and CNAME when a subdomain points to the wrong service. A lookup returns one record type at a time, so start with the type that matches the symptom.
| Type | Returns | Check it when |
|---|---|---|
| A | IPv4 address | The site does not load or opens the old server |
| AAAA | IPv6 address | Some visitors see a different site (stale IPv6 left behind) |
| CNAME | Another hostname | www, shop or a SaaS subdomain points to the wrong place |
| MX | Mail host plus preference number | Incoming mail bounces or lands at the old provider |
| NS | Nameserver hostnames | Changes you save in a panel never show up |
| TXT | Text: SPF, DKIM, DMARC, verification codes | Mail goes to spam or Google/Microsoft verification fails |
| SOA | Primary nameserver and serial number | You need proof the zone was updated (serial rises) |
PTR (reverse DNS) maps an IP back to a name and matters for mail servers, not for whether a site opens. The meaning of each record when you are editing a zone is in DNS records explained.
How to check DNS records online without installing anything
Enter the bare domain in the WebJi® DNS lookup, pick the record type and read the value and TTL it returns. No account is needed, and the query runs against live DNS, so you see what the internet sees rather than what a control panel claims.
- Type the domain only, for example
example.in, withouthttps://or a path. - Pick the type that matches the symptom from the table above.
- Read the value and the TTL; the TTL is how many seconds resolvers may cache that answer.
- Compare it with the record you saved at the DNS host named in the NS result.
For mail problems the MX record lookup shows the mail hosts in priority order, and the DNS propagation checker compares answers from resolvers in several regions after a change.
Why should you check NS records before anything else?
The NS records decide which DNS host’s zone the internet reads, so if they point elsewhere, every edit you make in your current panel is ignored. This single mismatch causes most “I changed the record and nothing happened” tickets.
Query NS on the bare domain, not on www. The answer, usually two to four hostnames, should match what is saved at the registrar. If you see Cloudflare names but you edited records in cPanel, the cPanel zone is not live; edit at Cloudflare or change the nameservers. The guide to changing nameservers covers the registrar side.
- Matches registrar: edit records at that DNS host only.
- Different from registrar: a recent change is still publishing at the registry; recheck after a few hours.
- No answer: the domain may be expired or on hold; run a WHOIS lookup to see its status.
How to check DNS records with dig on macOS or Linux
Run dig example.in A in Terminal, change the type as needed, and add @nameserver to ask the authoritative server directly instead of a cached resolver. dig ships with macOS; on Ubuntu or Debian install it with sudo apt install dnsutils.
dig example.in A +short # website IPv4
dig example.in AAAA +short # website IPv6
dig example.in MX +short # mail hosts and priority
dig example.in NS +short # nameservers
dig example.in TXT +short # SPF and verification strings
dig _dmarc.example.in TXT +short # DMARC policy
dig default._domainkey.example.in TXT +short # DKIM; replace "default" with your selector
dig example.in A @ns1.yourdnshost.com # authoritative answer, bypasses cache
dig example.in A @8.8.8.8 # what Google Public DNS currently has
dig example.in +trace # full path from the root servers
Without +short, look at the status line: NOERROR with an empty answer means the name exists but has no record of that type; NXDOMAIN means the name itself does not exist. The number before IN in each answer line is the remaining TTL in seconds.
How to check DNS records on Windows with nslookup or PowerShell
In Command Prompt run nslookup -type=MX example.in; in PowerShell, Resolve-DnsName example.in -Type MX gives the same answer with the TTL shown. Both are built into Windows.
nslookup example.in # A and AAAA
nslookup -type=NS example.in
nslookup -type=TXT example.in
nslookup -type=MX example.in 1.1.1.1 # ask Cloudflare's resolver
Resolve-DnsName example.in -Type A
Resolve-DnsName _dmarc.example.in -Type TXT
Resolve-DnsName example.in -Type MX -Server 8.8.8.8
“Non-authoritative answer” only means the reply came from a resolver cache; it is normal. “Non-existent domain” means no such name. A timeout means the server you asked did not reply, which is a network problem, not an empty zone.
How do you read A, MX, TXT and CNAME results correctly?
A correct result matches the value your host or mail provider gave you exactly, and for mail the lowest MX number must point to your current provider. Small details in each type cause most misreadings.
- A and AAAA
- Should equal the server IP in your hosting welcome email. An old AAAA left after a move sends IPv6 visitors to the previous server.
- MX
- Lower preference is tried first. Each MX host must itself resolve to an address; an MX pointing to an IP or to a CNAME is a misconfiguration. See what an MX record is.
- TXT
- Only one
v=spf1record is allowed per name; two SPF TXT records make SPF fail. DKIM lives onselector._domainkeyand DMARC on_dmarc. - CNAME
- Returns a hostname, never an IP. A CNAME cannot sit on the bare domain alongside MX and NS, so the apex uses A or AAAA (or a provider’s flattening).
How do you tell whether a DNS change has propagated?
Ask the authoritative nameserver and a public resolver the same question: if the authoritative answer is new and the resolver’s is old, the change is saved and you are only waiting for the old TTL to expire. Do not edit the record again while waiting; that only resets the clock.
Record edits clear within the old TTL, often 3,600 or 14,400 seconds. A nameserver change is slower, because the registry must publish the new delegation and the parent zone’s NS TTL can run to a day or two. Lower the TTL to 300 a day before a planned move so the switch itself clears in minutes. The wider mechanics are in DNS propagation explained.
What should you record before changing DNS?
Save the current A, AAAA, MX, NS, TXT and CNAME values before any hosting or email move, because a live lookup shows only today’s records and there is no built-in history. Third-party archives exist but miss records, so your own copy is the reliable rollback.
A quick way on macOS or Linux is for t in A AAAA MX NS TXT; do dig example.in $t +short; done > dns-before.txt, plus the same for www and any mail subdomains. If you host on WebJi®, support@webji.services can check a zone with you 24/7 in Hindi and English; records on shared hosting are edited in cPanel Zone Editor, as shown in adding a TXT record in cPanel.
Frequently asked questions
Why does my control panel show one value and the lookup another?
Either the panel is not the authoritative DNS host (check NS), or resolvers still hold the old answer until its TTL expires. Query the authoritative nameserver directly with dig or nslookup to tell the two cases apart.
Are DNS records public?
Yes. Anyone can query the A, MX, NS and TXT records of any domain. Do not put secrets in TXT records. What is not public is a full list of every subdomain, because zone transfers are normally blocked.
How do I flush my own computer’s DNS cache?
On Windows run ipconfig /flushdns. On macOS run sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder. This clears only your machine; your ISP’s resolver keeps its own copy until the TTL ends.
Can I check DNS for a subdomain the same way?
Yes. Query the full name, such as shop.example.in or mail.example.in. Subdomains often use CNAME rather than A, and they inherit the domain’s nameservers unless the subdomain is delegated separately with its own NS records.
Commands checked 14 November 2026 · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.