How to check dns records

No single query returns every record. Ask for one type at a time: nslookup -type=A example.com 8.8.8.8, then AAAA, MX, NS, SOA, TXT and CAA. An ANY query answers with the RFC 8482 placeholder HINFO CPU = RFC8482, not with the zone, and a zone transfer is limited to the secondaries a nameserver is configured for.

Why check this

Run this on the day a domain moves: a DNS cutover, a new staging environment, a mail provider swap, a CDN switch. The zone is configuration that nobody deploys and nobody reviews, and the failure it produces is delayed. A missing CAA record does not break anything until the certificate is renewed three months later and the issuer refuses. An MX left on the previous provider does not break anything until the first password reset mail is sent.

The check is an inventory, not a verdict. It tells you which types exist at a name and what they hold at the moment you ask. It does not tell you whether every resolver on the internet agrees with that answer yet, which is a separate question, or whether the values are the right ones for the service.

Prerequisites

• nslookup. It is installed on Windows by default and comes from bind-utils or dnsutils on Linux. The last argument is the resolver to ask, so the same command can be pointed at a public resolver or at the authoritative server.
• Node 22 for step 3. The script uses dns.Resolver with an explicit server, because the default resolver list is taken from the operating system and is not always usable.
• RFC 8482, which defines what a resolver may answer when it is asked for ANY.

Steps

1. 1

   Step 1.

   Ask for every record at once and read the refusal.

   nslookup -type=ANY example.com 8.8.8.8
   

   Non-authoritative answer:
   Server:  dns.google
   Address:  8.8.8.8
   
   example.com	HINFO CPU = RFC8482example.com	??? unknown type 46 ???

   HINFO CPU = RFC8482 is a synthetic record the resolver made up in place of the zone. Type 46 is RRSIG. Both records printed on one line because this nslookup writes no newline after a HINFO.

2. 2

   Step 2.

   Ask for each type in turn against the same name.

   for t in A AAAA MX NS SOA TXT CNAME; do echo "--- $t"; nslookup -type=$t example.com 8.8.8.8 2>&1 | sed -n '4,20p'; done
   

   --- A
   
   Name:    example.com
   Addresses:  172.66.147.243
     104.20.23.154
   
   --- AAAA
   
   Name:    example.com
   Addresses:  2606:4700:10::ac42:93f3
     2606:4700:10::6814:179a
   
   --- MX
   
   example.com	MX preference = 0, mail exchanger = (root)
   --- NS
   
   example.com	nameserver = elliott.ns.cloudflare.com
   example.com	nameserver = hera.ns.cloudflare.com
   --- SOA
   
   example.com
   primary name server = elliott.ns.cloudflare.com
   responsible mail addr = dns.cloudflare.com
   serial  = 2413856909
   …
   --- TXT
   
   example.com	text =
   
   "v=spf1 -all"
   example.com	text =
   
   "_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9"
   --- CNAME
   example.com
   primary name server = elliott.ns.cloudflare.com
   …

3. 3

   Step 3.

   Run the same sweep from Node, which reports an absent type by name and adds CAA. Save it as dns-records.js and run node dns-records.js cloudflare.com.

   const { Resolver } = require('node:dns');
   const name = process.argv[2];
   const r = new Resolver();
   r.setServers(['8.8.8.8']);
   const types = ['A', 'AAAA', 'CNAME', 'MX', 'NS', 'SOA', 'TXT', 'CAA'];
   (async () => {
     for (const t of types) {
       await new Promise((done) => {
         r.resolve(name, t, (err, recs) => {
           if (err) console.log(`${t.padEnd(6)} ${err.code}`);
           else console.log(`${t.padEnd(6)} ${JSON.stringify(recs).slice(0, 110)}`);
           done();
         });
       });
     }
   })();
   

   A      ["104.16.133.229","104.16.132.229"]
   AAAA   ["2606:4700::6810:84e5","2606:4700::6810:85e5"]
   CNAME  ENODATA
   MX     [{"exchange":"mxb.global.inbound.cf-emailsecurity.net","priority":10},{"exchange":"mxa.global.inbound.cf-email
   NS     ["ns7.cloudflare.com","ns6.cloudflare.com","ns4.cloudflare.com","ns5.cloudflare.com","ns3.cloudflare.com"]
   SOA    {"nsname":"ns3.cloudflare.com","hostmaster":"dns.cloudflare.com","serial":2414136692,"refresh":10000,"retry":2
   TXT    [["v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.ma
   CAA    [{"critical":0,"issuewild":"digicert.com; cansignhttpexchanges=yes"},{"critical":0,"issue":"comodoca.com"},{"c

4. 4

   Step 4.

   Ask nslookup for the one type it cannot render, and watch what it prints first.

   nslookup -type=CAA cloudflare.com 8.8.8.8
   

   Non-authoritative answer:
   Server:  dns.google
   Address:  8.8.8.8
   
   Name:    cloudflare.com
   Addresses:  2606:4700::6810:85e5
     2606:4700::6810:84e5
     104.16.133.229
     104.16.132.229
   
   unknown query type: CAA

How to read the result

| What you see | What it means | What to do | | --- | --- | --- | | HINFO CPU = RFC8482 | The resolver declined the ANY query and returned a placeholder | Query each type separately, as in step 2 | | mail exchanger = (root) | A null MX, RFC 7505. The domain publishes that it receives no mail | Correct for a send-only domain, a defect on one that accepts mail | | ENODATA next to a type | The resolver answered with no record of that type | Nothing, unless the service needs that type | | unknown query type: CAA | This nslookup cannot ask for the type, after printing the default answer | Read the type from Node or a DNS over HTTPS resolver | | ??? unknown type 46 ??? | An RRSIG, so the zone is signed | Confirm validation separately, presence of a signature is not validation |

Common mistakes

What to check next

• How to check a record of domain: the type most checks start from, with the TTL that nslookup hides.
• How to check cname record: the type this sweep is most likely to miss, because other queries resolve through it.
• How to check txt record of a domain: where verification tokens live, and where a record can be split into several strings.
• How to check mx records: the null MX in step 2 is read here.
• How to check DNS lookup time: once the records are right, this measures what they cost a client.

FAQ

How to check all dns records for a domain?

Ask each type in turn, as in step 2. A zone transfer (AXFR) would list the zone, and authoritative servers allow it only to the secondaries they are configured for. The practical list for a web service is A, AAAA, CNAME, MX, TXT, NS, SOA and CAA, plus SRV if the service publishes one.

How to use nslookup command?

nslookup -type=<TYPE> <name> <resolver>. The type defaults to A and AAAA, the resolver defaults to the one the operating system gives you, and both are worth setting. Typing nslookup with no arguments opens an interactive prompt where set type=MX does the same thing.

Does an ANY query work anywhere?

Against 8.8.8.8 it returned the RFC 8482 placeholder on 2026-09-11. Some authoritative servers still answer ANY in full when you query them directly rather than through a recursive resolver, which is why the answer depends on which server you asked.

Which resolver should a tester query?

Both. A public resolver shows what most clients see, including stale cached values. The authoritative server named in the SOA answer shows what the zone currently holds, with no cache in the way. A difference between the two is propagation, not a configuration error.

Verified