h2check

DNS record lookup

Asks Google Public DNS and Cloudflare for seven record types of one name over DNS-over-HTTPS, and shows what each resolver returned and where the two differ. Every TTL is the time that resolver has left in its cache, not the value written in the zone.

Checker offline. Follow the manual steps below, they give the same answer.

What it checks

  • A, AAAA, CNAME, MX, NS, SOA and TXT, each asked for explicitly at both resolvers, because no single query returns every record.
  • Whether the name exists. Only NXDOMAIN is read as "does not exist". An empty answer for every type is reported as not settling it either way, because on 2026-09-14 an A query for a made-up name under example.com, and one under github.com, came back NOERROR with no records from both resolvers.
  • The TTL each resolver returned, labelled as the time left in its cache. On 2026-09-14 the A record of example.com came back with 300 seconds from Google and 22 from Cloudflare, less than a second apart. The zone's own TTL is on its authoritative server.
  • An alias inside an address answer. An A query at www.github.com comes back with the CNAME to github.com followed by github.com's address, and the row names the alias.
  • Every TXT record in full, one per row. A record stored as several strings is joined with nothing between them (RFC 7208 section 3.3). The string count comes from Cloudflare, because Google returns such a record already joined.
  • A null MX (0 .), the RFC 7505 record for a domain that accepts no mail.
  • Agreement between the two resolvers, compared as sets, so record order and TTL do not count as differences.
  • The DNSSEC AD flag each resolver set, reported as that resolver's statement about its answer, not as a verdict on the zone.

What is not stored

This checker runs on a server, and the server is not deployed yet, so the form above is disabled. The manual steps on the procedures below return the same answer from your own machine, and they are what the checker automates.

Limits

  • Two public resolvers, asked from the server this checker runs on. Each answers from its cache at the site nearest that server, which can differ from what your own resolver holds.
  • No authoritative nameserver is asked, so a change made minutes ago can be missing here and present in the zone.
  • Every TTL is the time left in a resolver's cache, not the TTL in the zone. It differs between the two resolvers and between two runs.
  • Only the seven types listed. CAA, SRV, HTTPS, DS and other types are not shown. No ANY query is sent, because many servers answer ANY with a minimal placeholder (RFC 8482).
  • An empty answer with no error does not prove the name exists. Only NXDOMAIN is read as proof that it does not.
  • Public records only. Nothing connects to the domain, its web server or its mail servers, MX and NS targets are not looked up in turn, and no zone transfer is attempted.
  • Record order is not stable between answers. Read a result as a set, never as a list with positions.

Procedures that explain the result

Put it on your own page

Link to it with the value filled in, and the checker runs as soon as the page opens.

<a href="https://h2check.org/tools/dns-records/">DNS record lookup</a>