DNS Lookup & Diagnostics

Query a specific record, follow aliases, compare every reachable authority, and inspect delegation and DNSSEC evidence without confusing an empty record set with a missing name.

21 supported types
Direct authority checks
No automatic lookup
Abortable profiles

Run a DNS lookup

The useful default is ready, but nothing is sent until you choose Lookup DNS. Pasted HTTP(S) URLs are reduced to their hostname; IDNs are queried in ASCII form.

Hostname, URL, reverse name, or IP

Examples: example.com, https://www.example.com/path, bücher.example, 8.8.8.8, or 2001:4860:4860::8888.

Record type

SPF is honestly sent as TXT by the analyzer. ANY and zone transfers are not supported.

Lookup profile

Profiles make 2–4 full analyses in a visible, sequential queue. They are never the default.

Recursive resolver

Used for authority discovery and DNSSEC resolver claims. Record values below come from direct authoritative queries, not this resolver’s cache.

Analysis depth

Protocol depth additionally compares plain UDP, EDNS + DNSSEC OK, and TCP against one endpoint per authority.

One standard analysis will run after you submit. Typical completion is within 12 seconds; network dependencies can fail or return partial evidence.

Ready. No DNS request has been made.

Live analysis depends on Octetify’s same-origin DNS service, public DNS reachability, authoritative nameservers, and a bounded validation engine. A timeout, HTTP 429, capacity error, or incomplete trace is shown as such—never converted into a DNS answer. Standard analyses may be cached in memory for about 60 seconds.

Read the evidence correctly

NOERROR / NODATA is not NXDOMAIN

NODATA means the name exists but the requested type has no records. NXDOMAIN means the queried name does not exist. This tool derives NODATA from a NOERROR response with no relevant answer.

Authority is not propagation

Direct authority agreement shows what zone servers publish now. It does not prove what every recursive cache worldwide currently serves; use a propagation checker for that separate question.

DNSSEC verdicts have limits

Secure means a validation chain was verified; insecure means an unsigned branch was proven. Bogus is a validation failure. Indeterminate means evidence was insufficient—not that the zone is safe or unsafe.

Terminology follows RFC 1035, RFC 2308, and the DNSSEC specification family. DNSSEC authenticates DNS data; it does not encrypt queries or prove service availability.