How it works
Type a domain name, paste a full URL or an e-mail address, or enter an IPv4/IPv6 address. The host is extracted first; international names are converted to punycode for the query and shown in readable Unicode. Each selected record type is then requested from a public DNS-over-HTTPS resolver, and the answers are grouped by type with the TTL, the response status and the DNSSEC result.
example.com → A · AAAA · CNAME · MX · NS · TXT · SOA · CAA | 8.8.8.8 → 8.8.8.8.in-addr.arpa (PTR)
Record types
- A / AAAA: the IPv4 and IPv6 addresses of the name.
- CNAME: an alias that points to another name.
- MX: mail servers. The lowest priority number is tried first.
- NS / SOA: the zone's name servers and its start of authority: primary server, admin e-mail, serial and refresh timers.
- TXT: free text, used for SPF, DMARC, DKIM and site-ownership verification. Split strings are joined automatically.
- CAA: which certificate authorities may issue TLS certificates for the domain.
- SRV: service location with priority, weight, port and target host.
- PTR: reverse lookup from an IP address to a host name, via in-addr.arpa or ip6.arpa.
- HTTPS: connection hints such as supported protocols (alpn, e.g. HTTP/3) and IP hints.
- DS / DNSKEY: DNSSEC public keys and the delegation signer that links them to the parent zone. Key tags are calculated so you can match a DS to its key.
Quick checks
For domain names, five basic checks are shown as badges. A warning is not always a mistake, but it is worth a look.
- SPF: a TXT record starting with v=spf1 lists who may send mail for the domain. More than one SPF record is an error.
- DMARC: a TXT record at _dmarc.<domain> tells receivers what to do with mail that fails SPF/DKIM (p=none, quarantine or reject).
- CAA: limits which certificate authorities may issue certificates. Parent domains are checked too, because CAA is inherited.
- IPv6: an AAAA record means the name can be reached over IPv6.
- DNSSEC: the AD flag means the resolver verified the answer's signatures.
Comparing resolvers
Compare both sends the same queries to Cloudflare and Google and highlights records that only one of them returned. Different A/AAAA answers are often normal with CDNs and geo load balancing, while a different SOA serial or missing records can mean a change is still propagating. TTLs count down separately in each resolver's cache, so they are not treated as differences.
Privacy
Queries go from your browser straight to the resolver you chose, only when you press Look up or open a shared link that contains q=. beancuit has no server in between and stores nothing. A shared link contains the domain and the selected record types.
Standards and sources
- DNS: RFC 1034 and RFC 1035; reverse lookups via in-addr.arpa and ip6.arpa (RFC 3596)
- DNS over HTTPS (RFC 8484) JSON API of Cloudflare 1.1.1.1 and Google Public DNS
- SPF RFC 7208, DKIM RFC 6376, DMARC RFC 7489
- CAA RFC 8659, SRV RFC 2782, HTTPS/SVCB RFC 9460
- DNSSEC RFC 4033–4035 (key tag: RFC 4034 Appendix B)
Last reviewed October 12, 2026
Frequently asked questions
What can I look up?
A domain name, a full URL, an e-mail address or an IP address. For URLs and e-mail addresses the host is extracted automatically; for an IP address the PTR (reverse) record is looked up. You can choose from 13 record types: A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, PTR, HTTPS, DS and DNSKEY.
Why do Cloudflare and Google show different results?
Each resolver has its own cache and may reach a different server. Sites behind a CDN or geo load balancing return different IP addresses by location, and right after a change one resolver may still hold the old record until its TTL runs out. Use Compare both to see the differences highlighted.
What do NXDOMAIN and SERVFAIL mean?
NXDOMAIN means the name does not exist in DNS, which usually means a typo or an unregistered domain. SERVFAIL means the resolver could not get a valid answer, often because the name servers are down or DNSSEC validation failed. NOERROR with no records means the name exists but has no record of that type.
What does the DNSSEC AD flag mean?
AD (Authenticated Data) means the resolver checked the DNSSEC signatures of the answer and they are valid. If it is missing, the zone is probably unsigned or the parent zone has no DS record for it.
Why doesn't my DNS change show up yet?
Resolvers keep each answer for its TTL. If a record had a TTL of 3600, the old value can stay in caches for up to an hour after you change it. The TTL column shows how long the current answer will still be cached.
Is my query sent anywhere?
Only when you press Look up, or open a shared link containing q=, and only to the resolver you chose (Cloudflare or Google). The request goes directly from your browser; beancuit does not see or store it.