Querying DNS yourself with nslookup, dig, and online tools
Want to know what the DNS of your domain really says? For example, whether a new record is already visible, where your mail arrives, or which nameservers your domain uses? You can look this up yourself: online, or on your own computer with nslookup or dig. This article lists the most useful queries and how to read the answer. Replace yourdomain.com with your own domain each time.
The easiest way: online
- Domain health: in a few seconds, see whether your domain points to the right server, with an explanation per item. If your domain is with us, you'll find the same check on the domain page in My WebOké, with repair buttons.
- Email check: whether MX, SPF, DKIM, and DMARC are set up correctly.
- dnschecker.org: what DNS servers in different countries answer. Useful after a change.
- internet.nl and DNSViz: modern standards and DNSSEC.
On your own computer
On Windows, you use nslookup in Command Prompt (search for cmd). On a Mac and under Linux, you use dig in Terminal; nslookup also works there.
| What do you want to know? | Windows | Mac and Linux |
|---|---|---|
| Which IP address does my website point to? | nslookup yourdomain.com | dig +short A yourdomain.com |
| Where does my mail arrive? | nslookup -type=mx yourdomain.com | dig +short MX yourdomain.com |
| Which TXT records are there (SPF, verification)? | nslookup -type=txt yourdomain.com | dig +short TXT yourdomain.com |
| Is my DMARC record set? | nslookup -type=txt _dmarc.yourdomain.com | dig +short TXT _dmarc.yourdomain.com |
| Which nameservers does my domain use? | nslookup -type=ns yourdomain.com | dig +short NS yourdomain.com |
| Where does a CNAME point to? | nslookup -type=cname www.yourdomain.com | dig +short CNAME www.yourdomain.com |
Asking the nameserver directly
Normally, you get the answer from your internet provider's DNS server, which might still remember an old answer. If you ask the nameserver of your domain directly, you'll see immediately what's there now. At WebOké, these are ns1.webawere.nl and ns2.webawere.nl:
- Windows:
nslookup -type=mx yourdomain.com ns1.webawere.nl - Mac and Linux:
dig MX yourdomain.com @ns1.webawere.nl
Is the new value present at the nameserver, but you still see the old one at home? Then your change is correct, and you just need to wait until the old retention time has passed. Read How long does a nameserver or DNS change take?
Reading the answer
- A value, such as an IP address or
10 linux2023.webawere.nl.: the record exists. For MX, the priority comes before it; the lowest number is used first. - A number after the name (without
+short), such as3600: the TTL, how long in seconds other computers may remember the answer. - Nothing, or No answer: the name exists, but there's no record of this type.
- NXDOMAIN or Non-existent domain: the name doesn't exist at all. Check if you typed it correctly, whether the domain is active, and whether the nameservers are correct.
- SERVFAIL or Server failed: the DNS server couldn't give a proper answer. Often DNSSEC is broken then, for example after a move. Read DNSSEC and moving: turn it off first, or bring the key along.
- A name with your domain name doubled at the end, such as
shops.example.com.yourdomain.com: a period is missing at the end of a CNAME or MX record. See CNAME records and the trailing dot.
For advanced users
dig +trace yourdomain.comfollows the entire path, from the root via the registry to your own nameservers. This shows which nameservers the registry actually passes on.dig -x 192.0.2.10ornslookup 192.0.2.10gives the reverse DNS (PTR) of an IP address.dig +dnssec yourdomain.comshows the DNSSEC signatures. Ifadappears in the flags line, your DNS server has validated the signature.
Changing records yourself? Then read Managing DNS records in My WebOké.