DNS tools to check records and find what broke

Look up a domain's DNS records, check whether a change has gone live, and find the setting that stops a website, email, or certificate from working. Not sure which tool you need? Start with DNS lookup, or match your problem in the table below the tools.

Tools

DNS lookup

Look up a domain's DNS records from a public resolver or its own nameserver.

DNS trace

Follow referrals from the root servers to find where a lookup stops.

DNS change checker

Compare the authoritative answer with the copies still held by public resolver caches.

Nameserver checker

Check the parent handoff, glue records, and whether every nameserver answers.

DNSSEC checker

Validate the signed chain from the root to one DNS answer.

SOA checker

Compare the serial and timing values served by every nameserver.

CAA checker

Find which certificate authorities may issue normal and wildcard certificates.

Domain report

Check registration and live DNS together and find mismatches.

Which DNS tool do I need?

Pick the row that matches what you're seeing.

What's happeningTool to use
You want to see a record's current value, such as an A, MX, or TXT recordDNS lookup
You changed a record, and some people still get the old oneDNS change checker
The domain doesn't resolve, or fails only some of the timeNameserver checker, then DNS trace to see where the lookup stops
Lookups fail with SERVFAIL after you turned on DNSSEC or moved DNSDNSSEC checker
Your nameservers give different answers for the same recordSOA checker
A certificate authority won't issue a certificate for your domainCAA checker
The domain may be on hold or near expiry, or you want registration and DNS checked togetherDomain report