Eight record types, eight different questions
Most DNS tickets come from asking one record about another record's job. An A record knows nothing about mail. An MX record knows nothing about delegation. Keep the table below open while you work.
| Record | What it answers | Where it goes wrong | Tool |
|---|---|---|---|
| A | The IPv4 address serving this name | Two or more A records is normal. A CDN hands back a different edge per resolver. | Hostname to IP |
| AAAA | The IPv6 address for the same name | No AAAA means IPv6-only clients never reach the host. Nobody notices until one does. | DNS Records Lookup |
| CNAME | This name is an alias for another name | A CNAME at the zone apex collides with MX and NS. Providers paper over it with flattening. | DNS Records Lookup |
| MX | Where mail for the domain is delivered | The lower preference number wins. An MX pointing at a name with no A record bounces mail. | MX Lookup |
| NS | Which nameservers hold the zone | Delegation lives at the registrar. Editing records on the old host changes nothing. | Nameserver Lookup |
| SOA | Zone serial and refresh timers | The serial tells you whether your edit shipped. Same serial, same zone, no edit. | DNS Records Lookup |
| TXT | SPF, DKIM, DMARC, ownership proofs | Two SPF records is a hard fail, not a warning. Merge them into one string. | DNS Records Lookup |
| PTR | The name behind an address | Owned by whoever holds the address block. Most addresses have no PTR at all. | IP to Hostname |
The DNS Records Lookup pulls the whole set in one pass, which beats running four separate queries and comparing them by eye. Open the single purpose tools when you already know the record and want a clean answer to paste into a ticket.
Start from the symptom, not the tool name
Nobody wakes up wanting a nameserver lookup. They wake up to a bounced invoice or a support thread. Match the row to what broke, then open the tool. The full set lives on the Domain and IP tools index.
MX Lookup
Read the preference order first, then confirm every MX hostname resolves to a real address. A dangling MX name is the usual cause.
DNS Records Lookup
Compare the answer with the TTL on the record. A four hour TTL means four more hours of the old address for anyone already cached.
Nameserver Lookup
Delegation and zone content are two separate things. If NS still points at the old host, your new records are never asked for.
Domain Lookup
WHOIS returns registrar, status flags, and dates. Registrant contact is redacted for most domains under privacy rules.
Port Checker
Tests reachability from the public internet inward. Splits a firewall problem from an application problem in one attempt.
IP to Hostname
Reverse DNS names the noisy ones. Crawlers and cloud ranges show up immediately. Empty results are normal, not failures.
Website to IP
Strips the scheme and path, then resolves the host. Pin rules to a hostname where the platform allows it, because CDN addresses rotate.
What Is My IP
Shows the public address the far end sees, which is your VPN or carrier NAT exit, not the address on your laptop.
Working an incident right now? Run the full record set first. It rules out four causes in one query and gives you something to paste into the thread.
Run a full lookupOne address, five notations
An IPv4 address is a 32 bit number wearing dots. Change the base and the same host looks like a different machine. Here is 104.21.58.189, one of the addresses answering for toolexe.com, written five ways.
Two of these earn their keep beyond curiosity. Storing addresses as integers keeps range comparisons fast, so an audit query over a log table wants the decimal form. The other case is security work. A filter comparing user input against the string 127.0.0.1 waves through 0177.0.0.1 and 2130706433, and both reach loopback. Convert the input before trusting a string match.
The phone converters sit apart from the rest. They map digits into dotted notation for VoIP teaching material. No carrier is queried and no subscriber is found, so treat the output as a classroom exercise rather than a lookup result.
Size the prefix before you write the rule
Two addresses per subnet disappear into the network and broadcast slots. Forget those two and a /29 sized for six devices holds four, which surfaces on the day someone racks the seventh.
| CIDR | Mask | Total | Usable | Typical fit |
|---|---|---|---|---|
| /30 | 255.255.255.252 | 4 | 2 | Point to point link |
| /29 | 255.255.255.248 | 8 | 6 | A pair of appliances |
| /28 | 255.255.255.240 | 16 | 14 | One rack, one service tier |
| /27 | 255.255.255.224 | 32 | 30 | Small office floor |
| /26 | 255.255.255.192 | 64 | 62 | Branch site |
| /24 | 255.255.255.0 | 256 | 254 | The default everyone assumes |
| /22 | 255.255.252.0 | 1024 | 1022 | Campus or VPC block |
Worked example: 10.20.30.0/26
- Network
- 10.20.30.0
- First host
- 10.20.30.1
- Last host
- 10.20.30.62
- Broadcast
- 10.20.30.63
- Mask
- 255.255.255.192
- Next block
- 10.20.30.64/26
Sixty two usable addresses, and the next subnet starts at .64 rather than .65. Boundaries land on powers of two, never on round decimal numbers.
The CIDR Calculator prints the same breakdown for any prefix you paste, mask included. Copy the range into the firewall rule from there instead of counting octets in your head at the end of a change window.
What these tools will not tell you
A hub listing only wins is a brochure. Four honest limits, worth knowing before you quote a result to somebody else.
- Geolocation places a block, not a person
- Address to location data comes from registry allocations and vendor databases. It lands the right country most of the time and the right city far less often. A VPN exit or carrier NAT moves the answer hundreds of miles. Never treat it as identity evidence.
- WHOIS is redacted by default
- Registrar, status flags, and dates come back reliably. Registrant name and email usually resolve to a privacy service. A missing name is a policy outcome, not a hidden owner.
- Reverse DNS is optional
- PTR records belong to whoever holds the address block. Most public addresses have none, so an empty result from IP to Hostname means no record exists rather than a failed query.
- A port check tests one path
- The probe leaves our side of the internet. An open result proves a listener answered us. Your office egress rules, a proxy, or an intermediate hop still block the same port for you.
Questions from real tickets
- 01
I changed an A record an hour ago and the old server still answers. What now?
Read the TTL on the record before assuming a failure. A resolver holds the previous answer until the TTL expires, so a value of 14400 means four hours of stale replies for anyone already cached. Check the SOA serial to confirm your edit reached the zone, then wait out the timer. Drop the TTL to 300 the day before a planned move and you skip this next time.
- 02
The MX record looks right and mail still bounces. Where do I look?
An MX record names a host. The host still needs an A or AAAA record, and the receiving side still checks your TXT records. Two SPF strings on one domain is a hard fail. A DKIM selector dropped during a migration fails quietly for weeks. Pull the full record set, not the MX row alone.
- 03
Is 0177.0.0.1 a real address?
It resolves to 127.0.0.1. Octal notation with a leading zero, decimal notation like 2130706433, and hex notation all reach loopback, and plenty of allowlist filters compare strings instead of parsing the address. Convert the value first, then decide whether the input belongs anywhere near an outbound request.
- 04
Two lookups of one domain returned different addresses. Is something broken?
Usually no. A domain holds several A records, and anycast networks answer from the edge nearest the resolver asking. A lookup run from our servers reports the edge we reached. Treat a single answer as one sample, not the map.
- 05
Does an open port mean the service is reachable from my office?
No. A port check reaches the host from one place on the internet. Your office egress rules, a corporate proxy, or a hop in between still block the same port for you. Open means the listener exists and answered us. It stops short of proving your path works.
- 06
Do these lookups leave a trace?
Public DNS and WHOIS are public systems, and the resolvers on the far end keep their own logs. Nothing you look up here stays private from them. Treat a lookup box the way you treat a query typed into a shared terminal.
Where to go after the record checks out
DNS answers stop at the edge of the host. Certificate chains, headers, and hashes sit in the security set. Encoding a payload for transport sits elsewhere again.
Read the record before blaming the server. Read the TTL before blaming the record. Convert the address before trusting a string comparison.
