First CH Apps / DNS Record Checker
Enter a domain name and our server asks Cloudflare's resolver (1.1.1.1) for its A, AAAA, CNAME, MX, TXT, NS, SOA and CAA records. We also check the things people trip over: where www points, whether SPF is published exactly once, and whether a CAA record exists.
You do not need dig or nslookup — the browser is enough. We only show published DNS records; ownership data (Whois) is out of scope.
e.g. example.com (pasting a full URL or an email address works too — we read the domain part)
www.example.com is a different name from example.com. An A record on the apex alone does not make www resolve. The usual setup is a CNAME on www pointing at the main host, plus a 301 so that one of the two wins. If this page says www does not resolve, visitors given a www URL cannot reach your site.
SPF declares which servers may send mail for the domain, published as a TXT record starting with v=spf1. The classic accident is adding a second TXT every time a new mail service is introduced. Two SPF records cause a permerror and none of them apply — merge them with include:. We also report the trailing ~all (soft fail) or -all (hard fail).
CAA names the certificate authorities allowed to issue for this domain. Certificates work without it, but publishing one blocks issuance by anybody else. For Let's Encrypt you would write 0 issue "letsencrypt.org". If automatic certificate renewal suddenly stops, a CAA that disagrees with your CA is the first thing to check.
TTL is how long resolvers keep a cached answer. Change a record with a 24 hour TTL and the old value may be served for that long. Lowering the TTL to around 300 seconds the day before a migration makes the switch land quickly. The values here are the remaining time from Cloudflare's resolver, so they count down between queries.
Sent: only the domain name you type. Our server (Cloudflare Workers) sends ten queries to Cloudflare's public DNS over HTTPS (cloudflare-dns.com): eight record types for the domain plus two for www.<domain>.
Stored: nothing. The lookup lives entirely inside one request and writes neither the domain nor the result to any database (no KV, no D1). It leaves memory when the request ends.
Returned: the record values DNS gave us and our assessment of them. We do not fetch ownership data (Whois) or any content from the site.
Note: only public DNS records can be looked up. localhost, internal domains (.internal, .local) and IP addresses are rejected.
POST /dns/api/lookup with JSON ({"domain": "example.com"}) or a form body and you get the same result as JSON (no auth, nothing stored).