FernTool

DNS lookup

Check the DNS records of any domain: A and AAAA (IP addresses), MX (mail), TXT (SPF, DKIM, verification), NS, CNAME and SOA. Queries go to Cloudflare’s 1.1.1.1 resolver over encrypted DNS-over-HTTPS.


DNS records for wikipedia.org

Status: NOERROR

A

208.80.154.224   (TTL 158)

AAAA

2620:0:861:ed1a::1   (TTL 120)

MX

10 mx-in1001.wikimedia.org.   (TTL 300)
10 mx-in2001.wikimedia.org.   (TTL 300)

TXT

yandex-verification: 35c08d23099dc863   (TTL 10)
v=spf1 include:_cidrs.wikimedia.org ~all   (TTL 10)
google-site-verification=AMHkgs-4ViEvIJf5znZle-BSE2EPNFqM1nDJGRyn2qk   (TTL 10)

NS

ns0.wikimedia.org   (TTL 168439)
ns1.wikimedia.org   (TTL 168439)
ns2.wikimedia.org   (TTL 168439)

CNAME

No records

SOA

ns0.wikimedia.org. hostmaster.wikimedia.org. 2026102315 43200 7200 1209600 3600   (TTL 3600)

WHOIS for wikipedia.org

JSON
{
  "ok": true,
  "domain": "wikipedia.org",
  "status": "NOERROR",
  "dnssec_validated": false,
  "resolver": "Cloudflare 1.1.1.1 (DNS over HTTPS)",
  "records": {
    "A": [
      {
        "name": "wikipedia.org",
        "ttl": 158,
        "data": "208.80.154.224"
      }
    ],
    "AAAA": [
      {
        "name": "wikipedia.org",
        "ttl": 120,
        "data": "2620:0:861:ed1a::1"
      }
    ],
    "MX": [
      {
        "name": "wikipedia.org",
        "ttl": 300,
        "data": "10 mx-in1001.wikimedia.org.",
        "priority": 10,
        "exchange": "mx-in1001.wikimedia.org"
      },
      {
        "name": "wikipedia.org",
        "ttl": 300,
        "data": "10 mx-in2001.wikimedia.org.",
        "priority": 10,
        "exchange": "mx-in2001.wikimedia.org"
      }
    ],
    "TXT": [
      {
        "name": "wikipedia.org",
        "ttl": 10,
        "data": "yandex-verification: 35c08d23099dc863"
      },
      {
        "name": "wikipedia.org",
        "ttl": 10,
        "data": "v=spf1 include:_cidrs.wikimedia.org ~all"
      },
      {
        "name": "wikipedia.org",
        "ttl": 10,
        "data": "google-site-verification=AMHkgs-4ViEvIJf5znZle-BSE2EPNFqM1nDJGRyn2qk"
      }
    ],
    "NS": [
      {
        "name": "wikipedia.org",
        "ttl": 168439,
        "data": "ns0.wikimedia.org"
      },
      {
        "name": "wikipedia.org",
        "ttl": 168439,
        "data": "ns1.wikimedia.org"
      },
      {
        "name": "wikipedia.org",
        "ttl": 168439,
        "data": "ns2.wikimedia.org"
      }
    ],
    "CNAME": [],
    "SOA": [
      {
        "name": "wikipedia.org",
        "ttl": 3600,
        "data": "ns0.wikimedia.org. hostmaster.wikimedia.org. 2026102315 43200 7200 1209600 3600"
      }
    ]
  }
}

What each DNS record type means

A
The IPv4 address the name points to, e.g. 93.184.215.14. This is what browsers connect to.
AAAA
The IPv6 address. Sites with both A and AAAA records are reachable over either protocol (test your IPv6).
MX
Mail exchangers: the servers that accept email for the domain, with a priority (lower is tried first).
TXT
Free-form text. Used for SPF (which servers may send mail), DKIM keys, DMARC policy and ownership checks such as google-site-verification.
NS
The authoritative name servers for the domain, which hold the real records.
CNAME
An alias: this name is another name, e.g. www pointing to a hosting provider.
SOA
Start of authority: the primary name server, admin contact and timers for the zone.

How DNS resolution works

When you type a domain into a browser, your device asks a recursive resolver (usually your ISP’s, or a public one like 1.1.1.1 or 8.8.8.8) for the address. If it hasn’t cached the answer, the resolver asks the root servers which servers handle the top-level domain, asks those which name servers handle the domain, and finally asks the domain’s own authoritative servers for the record. Each answer carries a TTL, the number of seconds it may be cached. FernTool shows the TTL beside each record so you can see how long a change will take to spread.

Troubleshooting with a DNS lookup

Why DNS-over-HTTPS?

Classic DNS travels unencrypted, so anyone on the network path can see and tamper with lookups. DNS-over-HTTPS wraps queries in normal HTTPS. FernTool’s server queries Cloudflare this way, and the DNSSEC validated flag tells you when the answer was cryptographically signed by the domain owner and checked by the resolver. You can turn on secure DNS in your own browser’s privacy settings, which also helps against the DNS leaks covered in our VPN leak test.

Frequently asked questions

What is a DNS lookup?

A DNS lookup asks the Domain Name System for the records stored for a domain name: the IP addresses it points to (A and AAAA), its mail servers (MX), text records (TXT), name servers (NS), aliases (CNAME) and zone details (SOA).

Which DNS server does FernTool use?

FernTool queries Cloudflare’s public resolver 1.1.1.1 over DNS-over-HTTPS. That shows what most of the internet sees, rather than a cached answer from your own ISP or router.

Why don’t my new DNS records show up yet?

Resolvers cache records for the TTL (time to live) shown next to each record. After a change, old answers can persist until the TTL runs out, from a few minutes to 48 hours for NS records at the registry.

How do I check a domain’s MX records?

Enter the domain and look at the MX section. Lower priority numbers are tried first. Microsoft 365 domains point to *.mail.protection.outlook.com and Google Workspace to smtp.google.com or aspmx.l.google.com.

What does NXDOMAIN mean?

NXDOMAIN means the name does not exist in DNS: the domain is unregistered, or the subdomain has no records at all. An empty result with NOERROR means the name exists but has no record of that type.

More network tools

API: GET /api/dns/{domain}?type=A,MX (types: A, AAAA, MX, TXT, NS, CNAME, SOA) · MCP tool dns_lookup. Resolver: Cloudflare 1.1.1.1.