DNSSEC Query Tool
Domain Name System (DNS) lookups with Domain Name System Security Extensions (DNSSEC) validation status.
Monitor this automatically
NetTests can run this check on a schedule, preserve historical results, compare changes over time, and alert you the moment something breaks.
Start monitoring free → See all monitoring productsFrequently Asked Questions
What is a DNS query tool?
A Domain Name System (DNS) query tool sends a direct request to a DNS resolver and shows you the raw records a domain has published — A, AAAA, MX, TXT, CNAME, NS, SOA, and more. Unlike a browser lookup, you choose the record type and resolver, so you can see exactly what a nameserver is returning.
What DNS record types should I know?
- A — IPv4 address of the domain.
- AAAA — IPv6 address.
- CNAME — alias pointing to another hostname.
- MX — mail server(s) for the domain.
- TXT — free-text records; used for SPF, DKIM, domain verification.
- NS — nameservers authoritative for the domain.
- SOA — start-of-authority; holds the primary NS and serial number.
- PTR — reverse DNS; maps an IP to a hostname.
What is TTL and why does it matter?
Time To Live (TTL) is the number of seconds resolvers are allowed to cache a Domain Name System (DNS) record. A TTL of 300 means the record may be cached for up to 5 minutes. Lower TTLs allow faster propagation of changes; higher TTLs reduce DNS query load but mean old records stick around longer after a change.
Why do I get different results from different resolvers?
Results can differ due to caching (each resolver may have cached a different version), geo-DNS (some Content Delivery Networks (CDNs) return different IPs based on the resolver's location), or propagation delays after a recent Domain Name System (DNS) change. Use the DNS Propagation tool to query many resolvers simultaneously.
What is the difference between dig, nslookup, host, and drill?
All four query DNS records; they differ in output format and default behaviour. dig is the most verbose and widely used by network engineers. nslookup is the classic Windows/Unix tool. host gives concise output. drill (from ldns) adds Domain Name System Security Extensions (DNSSEC) chain verification. Use whichever output format you find easiest to read.