21+ years in hosting · Jaipur, India · INR billing with 18% GST · 24/7 email support
Blog · WebJi® India

How to Check DNS Records

Quick answer

To check DNS records, query the domain for one record type at a time: A for the website’s IP, MX for mail hosts, NS for nameservers, TXT for SPF, DKIM or verification. Use an online DNS lookup, dig on macOS or Linux, or nslookup on Windows. Compare the answer and TTL with the zone you saved.

For site owners and admins diagnosing a site that will not open, bouncing email or a DNS edit that never seems to take effect.

✓ In business since 2005
✓ INR + GST billing
✓ 24/7 Email Support — avg reply < 60 min
GuideWebJi®
knowledge
Read time
6 min
Sections
9
Updated
14 Nov 2026
Written by
WebJi® team

Which DNS record should you check for each problem?

Check A or AAAA when a website will not open, MX when email bounces, NS when edits never appear, TXT when SPF, DKIM or a verification fails, and CNAME when a subdomain points to the wrong service. A lookup returns one record type at a time, so start with the type that matches the symptom.

DNS record types, what a lookup returns and the symptom each explains
TypeReturnsCheck it when
AIPv4 addressThe site does not load or opens the old server
AAAAIPv6 addressSome visitors see a different site (stale IPv6 left behind)
CNAMEAnother hostnamewww, shop or a SaaS subdomain points to the wrong place
MXMail host plus preference numberIncoming mail bounces or lands at the old provider
NSNameserver hostnamesChanges you save in a panel never show up
TXTText: SPF, DKIM, DMARC, verification codesMail goes to spam or Google/Microsoft verification fails
SOAPrimary nameserver and serial numberYou need proof the zone was updated (serial rises)

PTR (reverse DNS) maps an IP back to a name and matters for mail servers, not for whether a site opens. The meaning of each record when you are editing a zone is in DNS records explained.

How to check DNS records online without installing anything

Enter the bare domain in the WebJi® DNS lookup, pick the record type and read the value and TTL it returns. No account is needed, and the query runs against live DNS, so you see what the internet sees rather than what a control panel claims.

  1. Type the domain only, for example example.in, without https:// or a path.
  2. Pick the type that matches the symptom from the table above.
  3. Read the value and the TTL; the TTL is how many seconds resolvers may cache that answer.
  4. Compare it with the record you saved at the DNS host named in the NS result.

For mail problems the MX record lookup shows the mail hosts in priority order, and the DNS propagation checker compares answers from resolvers in several regions after a change.

Why should you check NS records before anything else?

The NS records decide which DNS host’s zone the internet reads, so if they point elsewhere, every edit you make in your current panel is ignored. This single mismatch causes most “I changed the record and nothing happened” tickets.

Query NS on the bare domain, not on www. The answer, usually two to four hostnames, should match what is saved at the registrar. If you see Cloudflare names but you edited records in cPanel, the cPanel zone is not live; edit at Cloudflare or change the nameservers. The guide to changing nameservers covers the registrar side.

  • Matches registrar: edit records at that DNS host only.
  • Different from registrar: a recent change is still publishing at the registry; recheck after a few hours.
  • No answer: the domain may be expired or on hold; run a WHOIS lookup to see its status.

How to check DNS records with dig on macOS or Linux

Run dig example.in A in Terminal, change the type as needed, and add @nameserver to ask the authoritative server directly instead of a cached resolver. dig ships with macOS; on Ubuntu or Debian install it with sudo apt install dnsutils.

dig example.in A +short                     # website IPv4
dig example.in AAAA +short                  # website IPv6
dig example.in MX +short                    # mail hosts and priority
dig example.in NS +short                    # nameservers
dig example.in TXT +short                   # SPF and verification strings
dig _dmarc.example.in TXT +short            # DMARC policy
dig default._domainkey.example.in TXT +short   # DKIM; replace "default" with your selector
dig example.in A @ns1.yourdnshost.com       # authoritative answer, bypasses cache
dig example.in A @8.8.8.8                   # what Google Public DNS currently has
dig example.in +trace                       # full path from the root servers

Without +short, look at the status line: NOERROR with an empty answer means the name exists but has no record of that type; NXDOMAIN means the name itself does not exist. The number before IN in each answer line is the remaining TTL in seconds.

How to check DNS records on Windows with nslookup or PowerShell

In Command Prompt run nslookup -type=MX example.in; in PowerShell, Resolve-DnsName example.in -Type MX gives the same answer with the TTL shown. Both are built into Windows.

nslookup example.in                          # A and AAAA
nslookup -type=NS example.in
nslookup -type=TXT example.in
nslookup -type=MX example.in 1.1.1.1         # ask Cloudflare's resolver

Resolve-DnsName example.in -Type A
Resolve-DnsName _dmarc.example.in -Type TXT
Resolve-DnsName example.in -Type MX -Server 8.8.8.8

“Non-authoritative answer” only means the reply came from a resolver cache; it is normal. “Non-existent domain” means no such name. A timeout means the server you asked did not reply, which is a network problem, not an empty zone.

How do you read A, MX, TXT and CNAME results correctly?

A correct result matches the value your host or mail provider gave you exactly, and for mail the lowest MX number must point to your current provider. Small details in each type cause most misreadings.

A and AAAA
Should equal the server IP in your hosting welcome email. An old AAAA left after a move sends IPv6 visitors to the previous server.
MX
Lower preference is tried first. Each MX host must itself resolve to an address; an MX pointing to an IP or to a CNAME is a misconfiguration. See what an MX record is.
TXT
Only one v=spf1 record is allowed per name; two SPF TXT records make SPF fail. DKIM lives on selector._domainkey and DMARC on _dmarc.
CNAME
Returns a hostname, never an IP. A CNAME cannot sit on the bare domain alongside MX and NS, so the apex uses A or AAAA (or a provider’s flattening).

How do you tell whether a DNS change has propagated?

Ask the authoritative nameserver and a public resolver the same question: if the authoritative answer is new and the resolver’s is old, the change is saved and you are only waiting for the old TTL to expire. Do not edit the record again while waiting; that only resets the clock.

Record edits clear within the old TTL, often 3,600 or 14,400 seconds. A nameserver change is slower, because the registry must publish the new delegation and the parent zone’s NS TTL can run to a day or two. Lower the TTL to 300 a day before a planned move so the switch itself clears in minutes. The wider mechanics are in DNS propagation explained.

What should you record before changing DNS?

Save the current A, AAAA, MX, NS, TXT and CNAME values before any hosting or email move, because a live lookup shows only today’s records and there is no built-in history. Third-party archives exist but miss records, so your own copy is the reliable rollback.

A quick way on macOS or Linux is for t in A AAAA MX NS TXT; do dig example.in $t +short; done > dns-before.txt, plus the same for www and any mail subdomains. If you host on WebJi®, support@webji.services can check a zone with you 24/7 in Hindi and English; records on shared hosting are edited in cPanel Zone Editor, as shown in adding a TXT record in cPanel.

FAQ

Frequently asked questions

Why does my control panel show one value and the lookup another?

Either the panel is not the authoritative DNS host (check NS), or resolvers still hold the old answer until its TTL expires. Query the authoritative nameserver directly with dig or nslookup to tell the two cases apart.

Are DNS records public?

Yes. Anyone can query the A, MX, NS and TXT records of any domain. Do not put secrets in TXT records. What is not public is a full list of every subdomain, because zone transfers are normally blocked.

How do I flush my own computer’s DNS cache?

On Windows run ipconfig /flushdns. On macOS run sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder. This clears only your machine; your ISP’s resolver keeps its own copy until the TTL ends.

Can I check DNS for a subdomain the same way?

Yes. Query the full name, such as shop.example.in or mail.example.in. Subdomains often use CNAME rather than A, and they inherit the domain’s nameservers unless the subdomain is delegated separately with its own NS records.

Commands checked 14 November 2026 · Reviewed by the WebJi® team, Jaipur.

WebJi® since 2005

Ready to get started with WebJi®?

Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.