How to check a record of domain

Run nslookup -type=A example.com 8.8.8.8 and read the Addresses: list. An A record maps a name to an IPv4 address, and a name can carry several. Repeat with -type=AAAA for IPv6. Use Node when you also need the TTL, which nslookup never prints.

Why check this

Run this after any deploy that moves a host: a new load balancer, a region added, a blue-green swap, an environment rebuilt from scratch. The failure it prevents is the one where a test suite passes against an address that is no longer in the record, because the suite resolved the name once at start-up and the record changed ten minutes later.

The check answers one question: which addresses does this resolver hand out for this name right now, and for how long will it keep handing them out. It says nothing about whether anything is listening on those addresses. A name that resolves to a decommissioned IP looks healthy to nslookup and refuses every connection.

Prerequisites

• nslookup. Windows ships it, Linux gets it from bind-utils or dnsutils. The last argument selects the resolver, so the same line can ask a public resolver or the authoritative server.
• Node 22 for step 3. See the Node dns.Resolver documentation for the ttl option.
• A name you control or a public one. The examples use example.com and www.github.com, one lookup each.

Steps

1. 1

   Step 1.

   Read the IPv4 addresses.

   nslookup -type=A example.com 8.8.8.8
   

   Non-authoritative answer:
   Server:  dns.google
   Address:  8.8.8.8
   
   Name:    example.com
   Addresses:  172.66.147.243
     104.20.23.154

2. 2

   Step 2.

   Read the IPv6 addresses with the same command and a different type.

   nslookup -type=AAAA example.com 8.8.8.8
   

   Non-authoritative answer:
   Server:  dns.google
   Address:  8.8.8.8
   
   Name:    example.com
   Addresses:  2606:4700:10::ac42:93f3
     2606:4700:10::6814:179a

3. 3

   Step 3.

   Read both types with their TTL, which the nslookup output above does not carry. Save it as a-record.js and run node a-record.js example.com.

   const { Resolver } = require('node:dns');
   const name = process.argv[2];
   const r = new Resolver();
   r.setServers(['8.8.8.8']);
   r.resolve4(name, { ttl: true }, (err, addrs) => {
     if (err) { console.log('A    ' + err.code); return; }
     for (const a of addrs) console.log('A     ' + a.address + '  ttl ' + a.ttl);
   });
   r.resolve6(name, { ttl: true }, (err, addrs) => {
     if (err) { console.log('AAAA ' + err.code); return; }
     for (const a of addrs) console.log('AAAA  ' + a.address + '  ttl ' + a.ttl);
   });
   

   A     172.66.147.243  ttl 300
   A     104.20.23.154  ttl 300
   AAAA  2606:4700:10::6814:179a  ttl 300
   AAAA  2606:4700:10::ac42:93f3  ttl 300

   The IPv6 pair came back in the opposite order to step 2. Same records, same resolver, same session.

4. 4

   Step 4.

   Ask for the A record of a name that is an alias and read the whole answer, not the first line.

   nslookup -type=A www.github.com 8.8.8.8
   

   Non-authoritative answer:
   Server:  dns.google
   Address:  8.8.8.8
   
   Name:    github.com
   Address:  140.82.121.3
   Aliases:  www.github.com

   The name you asked for is on the last line. The Name: line holds the canonical name the alias points to.

How to read the result

| What you see | What it means | What to do | | --- | --- | --- | | One address under Addresses: | A single origin answers for this name | Nothing. Confirm the host serves, resolving is not reaching | | Several addresses | The name is load balanced across them | Test every address, not the first one a client picks | | Name: differs from the name you typed | The name is a CNAME and the answer is the target's | Read the Aliases: line and check the alias itself | | A ttl of 300 in step 3 | A resolver may reuse this answer for 300 seconds | Plan a cutover around that number, not around the change time | | Non-existent domain | The name has no records of any type | Check the spelling and the zone the name should live in |

Common mistakes

What to check next

• How to check cname record: what step 4 found, and why the alias hides in the answer.
• How to check dns records: the same name, every type, in one sweep.
• How to check txt record of a domain: the other type a deploy touches, and the one with the reading trap.
• How to check DNS lookup time: what this resolution costs a real client.
• How to check dns ttl: the number from step 3, and how to lower it before a cutover.

FAQ

How to check a record in dns without installing anything?

nslookup is already on Windows, macOS and most Linux images. Resolve-DnsName example.com -Type A does the same on PowerShell and prints the TTL, which nslookup omits. Node 22 needs no extra package for the script in step 3.

Why does nslookup show two addresses for one name?

The zone holds two A records at that name. Both are valid answers and a client picks one, usually the first it receives. Nothing in the protocol promises which, so treat the pair as a set.

Should an A record and a CNAME both exist at the same name?

No. A CNAME cannot share a name with any other record, so the two are mutually exclusive. If a zone editor accepts both, one of them is being ignored at answer time.

What if the address is right and the site is down?

Then DNS is not the fault. An A record is a mapping, not a health check. Confirm the port answers and the certificate matches the name before reopening the DNS question.

Verified