🌐 DNS Records
Enter a hostname to fetch all major DNS records (A / AAAA / CNAME / MX / NS / TXT / SOA) plus SPF and DMARC in one shot.
📖 What this check tells you
This page queries the resolver on our server for real and pulls A / AAAA / CNAME / MX / NS / TXT plus SPF and DMARC in one pass. What you see is the answer one resolver holds at this moment, which is not necessarily what every resolver worldwide returns. For rollout across regions use the DNS propagation check, and for signature validation the DNSSEC check.
| Item | What it means | How to fix it |
|---|---|---|
| CNAME alongside other records | Putting a CNAME next to an A or MX record on the same name violates RFC 1034. The apex (example.com itself) always carries NS and SOA, so a CNAME can never live there. Some resolvers silently drop one side, which is why it works in one place and fails in another. |
To point the apex at an external service, use an ALIAS / ANAME record, a Route 53 Alias record, or CNAME flattening on Cloudflare. If none is available, host the service on www and let the apex serve nothing but a 301. |
| The TTL value | TTL says how many seconds this answer may be cached. At 3600, traffic keeps hitting the old IP for up to an hour after you edit the record. The part people miss is that lowering the TTL itself takes the old TTL to spread. | Drop the TTL to 300 the day before a migration and wait out the old TTL before you switch. Once the new target is confirmed good, put it back to 3600–86400. Do not leave MX and NS on a low TTL, since they are queried constantly. |
| Two SPF records, or no DMARC | Two SPF TXT records is a permerror under RFC 7208, and the result is not that one wins but that SPF stops working entirely — a classic side effect of adding a second mail provider. Without DMARC you have no way to tell receivers what to do with mail that fails SPF or DKIM. | Merge SPF into a single record and chain providers with include:. The lookups from include and a are capped at ten in total; going over is also a permerror. Start DMARC at p=none; rua=mailto:…, read the reports for two to four weeks, then move to p=quarantine. |
Right after saving in a registrar panel, the change may not even have reached the authoritative servers yet. If nothing moves after a few minutes, ask whether the TTL has expired — or whether the zone you edited belongs to the nameservers actually in use. A mismatch between the NS records shown here and your panel points to the latter.