DNS lookup (multi-resolver)
Queries three public DoH resolvers in parallel and lines up the answers side by side.
How this tool works
DNS lookup queries three independent public DNS resolvers in parallel — Google (8.8.8.8), Cloudflare (1.1.1.1) and AdGuard — over the encrypted DoH (DNS-over-HTTPS) protocol. You instantly see whether all three return the same answer, or whether geo-split DNS, propagation lag after a DNS change, or a misconfiguration is at play. All common record types are supported: A, AAAA, MX, NS, TXT, CNAME, CAA, SOA and PTR.
Typical use cases
- After a DNS change, check if new records have propagated to all resolvers
- Surface geo-split DNS (CDN, Akamai, Cloudflare) — resolvers in different networks see different IPs
- Inspect MX records when emails suddenly stop being delivered
- View TXT records for SPF, DMARC, DKIM, _acme-challenge or domain verification
- Display CAA entries that govern which CA may issue certificates for the domain
Frequently asked questions
How long does DNS propagation really take?
Resolvers normally honor the record TTL: with TTL=300 the old values stick for at most 5 minutes, with TTL=86400 up to 24 hours. Some ISPs ignore TTL and cache longer — hence the multi-resolver comparison.
What is DoH and why does XICTRAQ use it?
DNS-over-HTTPS encrypts DNS queries over HTTPS. We use it because it prevents tampering by ISPs or networks between our server and the resolver — you see exactly what the resolver returns.
Why do the three resolvers see different IPs?
Most often it is geo-specific routing: CDNs return different edge locations depending on the resolver origin. Sometimes it is DNS cache lag or a misconfiguration at one provider.
Which record types are supported?
A, AAAA, MX, NS, TXT, CNAME, CAA and SOA. PTR reverse lookups are integrated in the reverse IP tool.
Can I run the lookup for any domain?
Yes — DNS data is public. Fair-use limits prevent bulk scraping; for higher volume use the authenticated API with a paid plan.
Why is DNSSEC validation status missing?
The DNS lookup tool does not surface the AD bit. For full DNSSEC validation with DS, DNSKEY and trust chain, use the dedicated [DNSSEC validator](/en/tools/dnssec) tool.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.