DNS Lookup and Reverse DNS
Query any record type, read DNSSEC data along the way, pick the resolver per query and check PTR records with forward confirmation.
DNS Lookup and Reverse DNS are the basic tools of the Toolbox and work without a license. The lookup replaces dig and nslookup; Reverse DNS checks whether an IP address has a clean PTR record.
DNS Lookup
Type a domain into Name oder IP (name or IP), pick the Typ (type) and click Abfragen (query).
Record types
| Type | Used for |
|---|---|
A, AAAA |
IPv4 and IPv6 addresses |
CNAME |
alias to another name |
MX |
mail servers |
NS, SOA |
name servers and zone data |
TXT |
SPF, verifications and other text |
CAA |
which certificate authorities may issue certificates |
SRV |
services with a port, e.g. for SIP or XMPP |
PTR |
reverse entries |
HTTPS, SVCB |
service bindings, e.g. for HTTP/3 |
DS, DNSKEY |
DNSSEC keys and their anchoring in the parent zone |
TLSA |
DANE certificate bindings |
NAPTR, SSHFP |
name rewriting and SSH key fingerprints |
ANY |
whatever the server will hand out (many servers answer this only partially) |
If you enter an IP address, the lookup automatically queries the PTR record under in-addr.arpa or ip6.arpa. You can also paste a URL or email address; the app takes the host name from it. Domains with umlauts and other non-ASCII characters work as they are.
Querying DNSSEC data
The DNSSEC toggle sets the DO bit in the query. The response then also contains the signatures (RRSIG), which you see in the table and under Rohdaten (raw data). If the resolver validates itself, the app also reports Per DNSSEC validiert (AD-Flag des Resolvers) (validated via DNSSEC, resolver’s AD flag).
That’s a quick look. Whether the whole chain of trust from the root down to the domain holds is what the DNSSEC check verifies.
Choosing a resolver
Next to the type is the resolver picker. It applies to this one query only:
- Standard (Einstellungen): the resolver from Einstellungen › Resolver (Settings › Resolver), out of the box your system’s
- System-Resolver
- DoH Cloudflare, DoH Google, DoH Quad9, DoH AdGuard, DoH dns0.eu, DoH OpenDNS
- 20 public resolvers queried directly over UDP/TCP, such as Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9), DNS.WATCH or Digitalcourage
This quickly shows whether a particular resolver still has an old answer cached. To compare many resolvers at once, use DNS propagation.
In the settings you choose which resolver applies when none is picked explicitly, which DoH provider is used, whether to ask your own server and how long a query may take at most (Zeitlimit je Abfrage, timeout per query, 5 seconds out of the box). The browser has no direct queries; everything goes over DNS over HTTPS there.
Findings
| Finding | Meaning and what to do |
|---|---|
| n A-Records gefunden (n A records found) | All there. |
| Keine A-Records (no A records, warning) | The name exists but has no entry of this type (NODATA). Check you’re asking for the right type or name, or create the record. |
| Den Namen gibt es nicht (NXDOMAIN) (the name doesn’t exist, error) | A typo, or the zone isn’t delegated. Check the spelling and the name servers at the registrar. |
| Antwort SERVFAIL or another error code (error) | The resolver couldn’t answer. With signed domains, a broken DNSSEC chain is often behind it. |
| CNAME-Kette (CNAME chain, note) | The name points to the target via one or more aliases. |
| Lange CNAME-Kette (long CNAME chain, warning) | More than three hops. Each one costs a lookup; better to point straight at the target. |
| Erweiterter Fehler (extended error, warning) | The resolver returned an Extended DNS Error, for example about DNSSEC or a timeout. |
| Antwort abgeschnitten (TC) (response truncated, warning) | The response didn’t fit into one UDP packet. |
| Sehr kurze TTL (very short TTL, note) | Under 60 seconds. Changes take effect quickly, but every query goes all the way to the name server. |
| Antwort von … über … in … ms (answer from … via … in … ms, note) | Which server answered over which protocol, and how fast. |
Reverse DNS
Reverse DNS looks up the PTR record of an IP address and checks whether the name it finds points back to the same IP (forward-confirmed reverse DNS, FCrDNS for short). This matters for mail servers, because many receivers reject mail from servers without a matching PTR.
Type an IPv4 or IPv6 address into IP-Adresse and click Prüfen (check). The Reverse DNS table shows, for each PTR, the name, the addresses it resolves to and whether confirmation succeeded.
| Finding | Meaning and what to do |
|---|---|
| IP → Name → IP (Forward-bestätigt) (forward-confirmed) | PTR and A/AAAA match. |
| Kein PTR-Record (no PTR record, warning) | The PTR is set by whoever owns the IP network, usually your provider or host, not your DNS. Normal for private addresses. |
| … zeigt nicht zurück auf … (doesn’t point back to, warning) | The name in the PTR doesn’t resolve to this IP. Create an A or AAAA record for the name with this IP, or have the PTR changed. |
| Mehrere PTR-Records (multiple PTR records, warning) | Exactly one is usual and recommended. |