dns.gripe

About these lookups

What is sent where?

Your browser sends the names you type to dns.gripe's server (a Cloudflare Worker), which asks the resolver you picked over DNS-over-HTTPS: Cloudflare (1.1.1.1), Google Public DNS, Quad9, OpenDNS or AdGuard's unfiltered DNS. "Authoritative" and "Trace" skip resolvers and ask the zone's own nameservers, and the root servers, directly over TCP port 53. Those servers see the name and our server's address, not yours. Answers are cached at our edge for at most 60 seconds, and never longer than their TTL. Nothing is logged; your address is used only for a rate-limit counter.

Why do resolvers give different answers?

Every resolver caches an answer for its TTL. After you change a record, each one keeps the old answer until its copy expires, so "propagation" is really caches running out; check the old TTL to know how long. Answers can also differ on purpose: CDNs and big sites answer by location, Google passes part of the asking network to some nameservers while Cloudflare doesn't, and resolvers may filter. The zone's own nameservers ("Authoritative") show what is published right now; if they disagree with each other, look at the SOA serial.

What do the flags mean?

qr it's a response, aa authoritative answer, tc truncated, rd recursion desired, ra recursion available, ad DNSSEC-validated by the resolver, cd checking disabled. NXDOMAIN means the name doesn't exist; NOERROR with no answer means it exists but has no record of that type; SERVFAIL often means broken DNSSEC or unreachable nameservers. Extended errors (EDE) say why, when the resolver tells us. ANY queries get a minimal answer from most resolvers (RFC 8482), so ask for types one by one.

Record types

A

The IPv4 address(es) a name points to.

AAAA

The IPv6 address(es).

CNAME

An alias: this name is another name. It can't sit next to other records.

MX

Mail servers for the domain, lowest preference number first.

NS

The nameservers that are authoritative for the zone.

TXT

Free text: SPF, DMARC and DKIM for mail, and site-ownership checks.

SOA

The zone's primary server, contact, serial number and timers (the last is the negative-cache TTL).

CAA

Which certificate authorities may issue TLS certificates for the name.

SRV

Host and port of a service, at names like _sip._tcp.example.com.

PTR

Reverse DNS: the name for an IP address. Type an IP and it's looked up automatically.

DS

A hash of the zone's DNSSEC key, held by the parent zone: the link in the chain of trust.

DNSKEY

The zone's DNSSEC public keys (257 = key-signing key, 256 = zone-signing key).

RRSIG

A DNSSEC signature over a set of records (shown with +dnssec).

NSEC

DNSSEC proof that a name or type doesn't exist (NSEC3 is the hashed form).

HTTPS

Connection hints for browsers: HTTP/3 support, ECH keys, IP hints, or an alias.

SVCB

The general form of HTTPS, for other services.

TLSA

DANE: pins the TLS certificate a service at _port._proto.host must use.

NAPTR

Rewrite rules, used by SIP and ENUM phone-number lookups.

SSHFP

Fingerprints of a host's SSH keys.

CDS / CDNSKEY

The child zone's request to update its DS at the parent automatically.

DNAME

Aliases a whole subtree of names.

ANY

Whatever the server has cached; most return a minimal answer (RFC 8482).