Free tool DNS lookup: see what the internet sees for a domain
Type a domain and get its A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records in one go, as a public resolver returns them right now. Type an IP address for a reverse lookup. Compare three resolvers side by side when a change you made is not showing up everywhere.
- 10 record types
- Compare 3 resolvers
- Sent only when you click
Look up DNS records
Enter a domain, a full URL or an email address (only the domain part is used). An IPv4 or IPv6 address switches to a reverse (PTR) lookup. The results below are a sample, dated, until you click Look up.
cloudflare-dns.com), Google (dns.google) or Alibaba Cloud (dns.alidns.com) — for the name and record type, nothing else. Checks that follow a chain (SPF includes, MX hosts) send those names to the same service. TapCub’s servers are not involved and store nothing.Subdomains, underscore names such as _dmarc.example.com and international domains all work.
“Common types” runs eight queries at once.
In mainland China, Alibaba Cloud is usually reachable when the other two are not.
Summary
- OK14 records found for tapcub.com.
- NoteNot DNSSEC-validated (the zone is not signed, or the resolver did not validate it).
- NoteNo records of these types: CAA.
- NoteSample result: these records were looked up on 2026-11-11 while building this page. Click Look up for live data.
Records
TTL is how long resolvers may cache the answer; hover it for seconds.
| Type | Name | TTL | Value | What it is |
|---|---|---|---|---|
| A | tapcub.com | 5 min | 172.67.145.35 | — |
| A | tapcub.com | 5 min | 104.21.65.106 | — |
| AAAA | tapcub.com | 5 min | 2606:4700:3037::6815:416a | — |
| AAAA | tapcub.com | 5 min | 2606:4700:3032::ac43:9123 | — |
| MX | tapcub.com | 10 min | 10 mx.zoho.com | Zoho Mail |
| MX | tapcub.com | 10 min | 20 mx2.zoho.com | Zoho Mail |
| MX | tapcub.com | 10 min | 50 mx3.zoho.com | Zoho Mail |
| NS | tapcub.com | 24 h | chip.ns.cloudflare.com | — |
| NS | tapcub.com | 24 h | olivia.ns.cloudflare.com | — |
| TXT | tapcub.com | 5 min | emxwb2c2d8 | — |
| TXT | tapcub.com | 5 min | google-site-verification=5Q3r7y9GTIxOIw24VWvWnJwF3i0NtuUTDhJGdzYCq-E | Google Search Console verification |
| TXT | tapcub.com | 5 min | v=spf1 include:zohomail.com ~all | SPF |
| TXT | tapcub.com | 5 min | zoho-verification=zb19924911.zmverify.zoho.com | — |
| SOA | tapcub.com | 30 min | chip.ns.cloudflare.com dns.cloudflare.com 2419297697 10000 2400 604800 1800 | — |
Resolver comparison
Different answers are normal while a change propagates, and for sites that answer differently by location.
tapcub.com. 300 IN A 172.67.145.35
tapcub.com. 300 IN A 104.21.65.106
tapcub.com. 300 IN AAAA 2606:4700:3037::6815:416a
tapcub.com. 300 IN AAAA 2606:4700:3032::ac43:9123
tapcub.com. 600 IN MX 10 mx.zoho.com.
tapcub.com. 600 IN MX 20 mx2.zoho.com.
tapcub.com. 600 IN MX 50 mx3.zoho.com.
tapcub.com. 86400 IN NS chip.ns.cloudflare.com.
tapcub.com. 86400 IN NS olivia.ns.cloudflare.com.
tapcub.com. 300 IN TXT "emxwb2c2d8"
tapcub.com. 300 IN TXT "google-site-verification=5Q3r7y9GTIxOIw24VWvWnJwF3i0NtuUTDhJGdzYCq-E"
tapcub.com. 300 IN TXT "v=spf1 include:zohomail.com ~all"
tapcub.com. 300 IN TXT "zoho-verification=zb19924911.zmverify.zoho.com"
tapcub.com. 1800 IN SOA chip.ns.cloudflare.com. dns.cloudflare.com. 2419297697 10000 2400 604800 1800The same records in the format used by BIND and most DNS panels’ import screens.
Share these inputs: the values go after the # in the link, so they never reach a server.
https://tapcub.com/tools/dns-lookup
Version v1.0Updated Update history
What each record type tells you
Most questions about a domain come down to four or five records.
A, AAAA and CNAME: where the site is
A and AAAA are the IPv4 and IPv6 addresses browsers connect to. A CNAME says “this name is another name”; the addresses then come from the target. Behind a CDN such as Cloudflare you see the CDN’s addresses, not your server’s.
MX: where email goes
Each MX names a mail server and a priority; the lowest number is tried first. No MX means senders try the domain’s own address. A Null MX (0 .) says the domain takes no mail. See the MX checker for details.
TXT: proofs and policies
Ownership tokens for Google Search Console, Baidu, Microsoft 365 and others, plus the SPF record. DMARC and DKIM live at special names (_dmarc. and selector._domainkey.), so look them up there.
NS, SOA and TTL: who answers and for how long
NS shows which DNS provider hosts the zone. SOA holds its serial number and timers. TTL is how many seconds a resolver may keep an answer; a change can take that long to reach everyone.
Resolvers cache. If you just changed a record, Cloudflare, Google and Alibaba Cloud may each show the old or new value until the previous TTL runs out. “Compare all three” makes this visible.
Three steps
No sign-up. One click sends the queries.
-
1
Enter a name
A domain, subdomain, URL or email address. Paste an IP address for a reverse lookup.
-
2
Pick type and resolver
Common types is the usual start. Choose “Compare all three” after a DNS change to see whether it has spread.
-
3
Look up and copy
Read the summary, then copy the zone-file lines or download them. Open the MX, SPF, DMARC or DKIM checker for mail records.
DNS-over-HTTPS from your browser
Browsers cannot send classic DNS packets, but three public resolvers answer DNS questions over HTTPS with a JSON response. This tool calls them directly; nothing goes through TapCub.
- Each query is one HTTPS GET with the name and type, for example
?name=tapcub.com&type=MX - The resolver follows CNAME chains and returns the whole chain; the summary points out aliases
- Status codes: NOERROR (answer, possibly empty), NXDOMAIN (the name does not exist), SERVFAIL (the domain’s name servers did not answer properly)
- The AD flag means the resolver validated DNSSEC signatures. Unsigned zones never get it
- TXT records longer than 255 bytes are stored as several strings and joined when read (RFC 7208 §3.3)
- What you see is a public resolver’s view. Your office or ISP resolver can still hold an older cached answer
| Type | Holds | Typical use |
|---|---|---|
| A / AAAA | IPv4 / IPv6 address | Website, API |
| CNAME | Another name | www, CDN, SaaS custom domains |
| MX | Priority + mail server | Receiving email |
| TXT | Free text | SPF, site verification |
| NS / SOA | Name servers / zone data | Which DNS provider is in charge |
| CAA | Allowed certificate authorities | Restricting who may issue HTTPS certificates |
| SRV | Priority, weight, port, host | SIP, XMPP, some game and chat services |
| PTR | Name for an IP | Reverse DNS, mail server checks |
tapcub.com, looked up on 2026-11-11
The default result above, read line by line.
| Record | Value | What it tells you |
|---|---|---|
| A / AAAA | 172.67.145.35, 104.21.65.106 and two IPv6 | Addresses on Cloudflare’s network: the site sits behind Cloudflare’s proxy |
| NS | chip.ns.cloudflare.com, olivia.ns.cloudflare.com | Cloudflare also hosts the DNS zone |
| MX | 10 mx.zoho.com, 20 mx2, 50 mx3 | Email is hosted by Zoho Mail; the priority-10 server is tried first |
| TXT | v=spf1 include:zohomail.com ~all | SPF: Zoho’s servers may send for the domain; others soft-fail |
| TXT | google-site-verification=… | Proves ownership to Google Search Console |
| CAA | none | Any certificate authority may issue certificates for the domain |
Records change. Click Look up for the current values; the sample keeps its date.
Why a DNS change “does not work”
Usually the record is fine and something else is in the way.
Not waiting out the old TTL
A record that used to have a 24-hour TTL can stay cached for 24 hours after you change it. Lower the TTL a day before planned changes.
Editing the wrong DNS provider
Only the provider named in the NS records answers. Changes made at your registrar do nothing if NS points elsewhere.
CNAME next to other records
A name with a CNAME cannot also have MX or TXT records. That is why the bare domain usually cannot be a CNAME.
Two SPF records
Adding a second v=spf1 TXT for a new email service breaks both. Merge them into one record; the SPF checker shows how.
Where domains show up in your analytics
DNS answers practical questions behind the reports: who sent this traffic, which network a crawler came from, and how the tracking script is served.
Referring domains
Sources lists the sites that send visitors. Look up an unfamiliar one to see whether it resolves and who hosts it before you trust its traffic.
Learn moreBots counted separately
TapCub separates crawlers from people with five layers, one of them hosting networks. A PTR lookup shows the hostname a crawler’s IP publishes.
Learn moreNo CNAME tricks
TapCub does not use CNAME aliasing to make its requests look first-party. The cookie policy lists what else it deliberately does not do.
Learn moreDNS lookup questions
Still have a question?
Chat with the team behind TapCub — we usually reply within a few hours on business days.
How do I check a domain’s DNS records?
Enter the domain above, keep “Common types” and click Look up. You get the A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records as a public resolver sees them now. Use the record-type menu for SRV, or enter an IP address for a reverse lookup.
Why do different DNS checkers show different results?
Each resolver caches answers for the record’s TTL, so after a change some still serve the old value. Some sites also answer differently by location. Choose “Compare all three” to see Cloudflare, Google and Alibaba Cloud side by side.
How long does DNS propagation take?
There is no fixed time: each cached answer expires after its TTL, often 5 minutes to 24 hours. NS changes at the registry can take longer because the parent zone’s records have their own TTL, commonly up to 48 hours.
What is a reverse DNS (PTR) lookup?
It asks which name an IP address belongs to. Mail servers use it to check senders, and you can use it to see whether a “Googlebot” IP really reverse-resolves to a Google hostname. Enter the IP address and the tool builds the in-addr.arpa or ip6.arpa name for you.
Is my lookup private?
TapCub never sees it: your browser sends the name and type straight to the resolver you pick, only after you click. The resolver’s own privacy policy applies to that query, as it does whenever you browse.
Why does my site show Cloudflare IP addresses?
Because traffic is proxied through Cloudflare (the orange cloud). Visitors connect to Cloudflare, which fetches from your server. To see the origin address, check your DNS provider’s dashboard; it is not public by design.
What does NXDOMAIN mean?
The name does not exist in DNS: not registered, deleted, or misspelled. NOERROR with no records means the name exists but has nothing of that type, which is normal for, say, AAAA on an IPv4-only site.
Update history
New features, fixes and data refreshes for this tool, newest first.
-
· v1.0
LaunchedFirst release.
Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates
From the domain to the visitors it brings
TapCub shows where visitors come from, separates bots from people, and adds live chat on the same snippet. No cookies in the default mode.