DNS Lookup
A DNS lookup queries the Domain Name System for the records attached to a domain name: A and AAAA for IP addresses, MX for mail servers, TXT for SPF and DKIM, NS for nameservers. DNSX queries the resolver you pick (Google 8.8.8.8, Cloudflare 1.1.1.1, Quad9 9.9.9.9, OpenDNS 208.67.222.222, or the domain's own authoritative nameservers), and you can compare several side by side to catch a resolver still handing out a stale answer.
What is a DNS lookup?
A recursive resolver such as 8.8.8.8 answers from its cache and may return a record that is out of date. An authoritative nameserver holds the zone itself and answers with the record as it exists right now. Comparing the two is the fastest way to confirm whether a DNS change has actually taken effect or is simply still cached somewhere.
What do the DNS record types mean?
A Record
Maps a domain to an IPv4 address. The most fundamental DNS record type, used to point your domain to a web server.
AAAA Record
Maps a domain to an IPv6 address. Essential for IPv6 connectivity as the internet transitions from IPv4.
MX Record
Specifies mail servers for a domain with priority values. Lower priority numbers indicate preferred servers for email delivery.
TXT Record
Holds arbitrary text data. Commonly used for SPF email authentication, DKIM signatures, domain verification, and DMARC policies.
CNAME Record
Creates an alias from one domain to another. Used to point subdomains to other hostnames without duplicating A records.
NS Record
Delegates a domain or subdomain to specific nameservers. Defines which DNS servers are authoritative for the zone.
SOA Record
Contains zone administration details including the primary nameserver, admin email, serial number, and refresh intervals.
CAA Record
Specifies which Certificate Authorities are allowed to issue SSL/TLS certificates for the domain, preventing unauthorized issuance.
Why do DNS results differ between resolvers?
Two DNS resolvers return different answers for three reasons. First, each resolver caches independently and only discards a record when that record's TTL expires, so one resolver can still be serving the previous value. Second, some domains use GeoDNS and deliberately answer differently depending on where the query arrives from. Third, filtering resolvers such as Quad9 withhold answers for domains they classify as malicious.
Querying the authoritative nameserver removes the first two variables: it is the source of the zone, it applies no cache, and its answer is what every other resolver will eventually converge on.
How long does DNS propagation actually take?
DNS propagation is not a global replication process. Authoritative nameservers are updated the moment the zone is published; what takes time is cache expiry at every recursive resolver that already holds the old record. Each of those resolvers keeps its cached copy for exactly the TTL that was in force when it fetched the record, and no longer.
A record with a 300-second TTL is therefore fully replaced within five minutes. A record with an 86,400-second TTL can take up to 24 hours. Because the TTL that governs the wait is the old one, lowering a TTL only speeds up a future change. Lower it at least one old-TTL period before the cutover.
How do I look up DNS records from the command line?
Every DNSX lookup URL returns JSON to non-browser clients, so no API key, account or separate API host is needed:
With a local resolver, dig google.com MX +short does the same job, and dig @ns1.google.com google.com MX queries the authoritative nameserver directly. Note that Windows nslookup and PowerShell Resolve-DnsName cannot query NAPTR records at all.