Look up any domain’s DNS records and check its email authentication in one place. Type a domain to see its A, AAAA, CNAME, MX, NS, TXT, SOA and CAA records, compare the answers from three public resolvers, or switch to the email check to test SPF, DMARC and DKIM with plain-English results. Type an IP address to get its reverse DNS (PTR) record.
Every result includes the matching dig and nslookup command, so you can repeat the check from a terminal. Queries go straight from your browser to the resolvers over DNS-over-HTTPS. LiberianGeek does not see or store what you look up.
Enter a domain and press Look up. Results come straight from public DNS resolvers and nothing is stored.
What the tool checks
| Mode | What you get | Typical use |
|---|---|---|
| DNS records, one resolver | A, AAAA, CNAME, MX, NS, TXT, SOA and CAA at once, or any single type including SRV, PTR, HTTPS, DS and DNSKEY, with TTLs | Check that a record you just created is live |
| DNS records, compare all three | The same query sent to Cloudflare (1.1.1.1), Google (8.8.8.8) and AliDNS (223.5.5.5) side by side, with an “agree / disagree” verdict | See whether a DNS change has reached resolvers in different regions |
| IP address | The PTR (reverse DNS) record | Confirm a mail server’s reverse DNS matches its host name |
| Email check | MX, SPF (including the DNS lookup count), DMARC policy and reporting, DKIM keys on common selectors or your own, MTA-STS, TLS-RPT and BIMI | Find out why email lands in spam or gets rejected |
How to read the results
| Result | Meaning |
|---|---|
NOERROR | The name exists. If the table is empty, the name simply has no record of that type. |
NXDOMAIN | The name does not exist. Check the spelling, or add the record at your DNS provider. |
SERVFAIL | The resolver could not get a valid answer. Broken DNSSEC and unreachable name servers are the usual causes. |
| TTL | How many seconds resolvers may cache the answer. After you change a record, old answers can be served until the TTL runs out. |
| DNSSEC validated | The resolver verified the answer’s DNSSEC signatures (the ad flag in dig output). |
Why the three resolvers can disagree
Each resolver caches answers independently. Right after a change, one may still hold the old value until its cached copy expires. Large sites behind CDNs also return different IP addresses depending on where the query comes from, so different A or AAAA answers are not always a problem. If MX, TXT or NS records disagree for more than a few hours after a change, check the authoritative name servers directly with dig @ns1.yourdns.com example.com.
The email check, explained
| Check | Good result | Common problem |
|---|---|---|
| SPF record | Exactly one TXT record starting with v=spf1 | Two SPF records, which receivers treat as a permanent error |
| SPF DNS lookups | 10 or fewer, counting every include, a, mx, ptr, exists and redirect (RFC 7208) | Too many include: entries from marketing and CRM tools |
| SPF ending | ~all or -all | +all, which lets anyone send mail as your domain |
| DMARC policy | p=quarantine or p=reject once reports look clean | No DMARC record at all. Google and Yahoo require one for bulk senders |
| DMARC reports | A rua=mailto: address | No reports, so you cannot see who is sending as you |
| DKIM | A public key at selector._domainkey.yourdomain, ideally 2048-bit | Wrong selector, or a 1024-bit key that should be rotated |
DKIM records live under a selector name chosen by your email provider, and there is no way to list every selector a domain uses. The tool tries the selectors used by Google Workspace, Microsoft 365, SendGrid, Mailchimp, Zoho, Proton Mail, Fastmail, iCloud and others. If yours is not found, copy the s= value from the DKIM-Signature header of an email you sent and enter it in the selector box.
Run the same checks from a terminal
Each result card shows the exact command. These are the ones you will use most:
dig example.com MX +short
dig example.com TXT +short @1.1.1.1
dig _dmarc.example.com TXT +short
dig google._domainkey.example.com TXT +short
dig -x 8.8.8.8 +shortnslookup -type=MX example.com
nslookup -type=TXT _dmarc.example.com 8.8.8.8On Debian and Ubuntu both commands come from the bind9-dnsutils package. See how to install and use dig and how to install nslookup, including how to read every section of the output.
Privacy and limits
- Lookups run in your browser and go directly to Cloudflare, Google or AliDNS over HTTPS. Nothing is sent to or stored on LiberianGeek’s server.
- These are public recursive resolvers, so you see cached answers. To see what your DNS provider is publishing right now, query its authoritative name servers with
dig. - Zone transfers (AXFR) and private or internal names cannot be queried from a browser.
Frequently asked questions
How long does DNS propagation take?
It depends on the TTL of the old record. Resolvers keep serving the cached value until it expires, so a record with a TTL of 3600 can take up to an hour to change everywhere. Lowering the TTL a day before a planned change makes the switch faster.
Why does my SPF record say too many DNS lookups?
Every include: can contain more includes, and SPF allows 10 DNS lookups in total. Remove services you no longer use, or replace an include with the ip4: ranges it resolves to.
Is it safe to set DMARC to reject?
Yes, once DMARC reports show that all of your legitimate mail passes SPF or DKIM in alignment. Start with p=none, watch the reports for a few weeks, then move to quarantine and reject.
Can I share the results?
Yes. After each lookup the page address updates with your query, so you can copy the link from the results and send it to a colleague or your DNS provider.
If your email still lands in spam after the records look right, or you would rather have someone fix your DNS and mail setup for you, see Server and WordPress Help.