DNS lookups that actually tell you what's going on.
Query every record type from every major resolver, watch propagation across 16 cities, and trace the DNSSEC chain — in one place, in under a second.
Six tools. One window. No dark patterns.
Built by SREs who got tired of switching tabs to debug a single misconfigured MX record.
Every record type, all at once
A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, PTR, SRV, DS, DNSKEY — fetched in parallel, displayed by section.
Side-by-side resolver compare
See exactly what Cloudflare, Google, Quad9, OpenDNS and authoritative delegation each return — diffs highlighted.
Live global propagation
Watch DNS rollout from 16 probe cities on six continents. Tap any node for raw response + RTT.
DNSSEC chain visualizer
Walks the trust chain from root to leaf. Highlights broken signatures, missing DS records and KSK rollovers.
Mail deliverability check
Validates SPF, DKIM, DMARC, BIMI, MTA-STS and reverse DNS in one pass. Plain-English fix instructions.
Free public API
JSON, JSONP, and DoH endpoints. No auth, no rate-limit pages, no tracking. Use it in your monitor.
From a domain name to a full DNS picture in three steps.
Type once. Get every record type, every resolver, and a global propagation map without bouncing between tabs.
- STEP 01
Type a domain or an IP
Paste any hostname or address. Add /mx, /ns, or /txt for a focused query — or leave it blank to fetch every record type at once.
- STEP 02
We fan out in parallel
Each request hits Cloudflare, Google, Quad9, OpenDNS and the authoritative nameservers simultaneously, plus 16 probe cities for propagation.
- STEP 03
Read the answer in plain English
Records are grouped by type, diffs are highlighted, and DNSSEC, mail, and CAA health appear inline. Share a link or export JSON.
What you'll see for github.com
Resolver agreement
5/5 matchPlain-English guides to every record type.
Search-indexed, regularly updated, written by humans who run nameservers.
Address (IPv4)
Points a hostname to an IPv4 address. The most common record on the internet.
Address (IPv6)
The IPv6 equivalent of an A record. 128-bit addresses.
Canonical Name
Alias one hostname to another. Cannot coexist with most other records.
Mail Exchange
Directs email delivery to mail servers, ordered by priority.
Text
Arbitrary text. Used for SPF, DKIM, DMARC and domain verification.
Name Server
Delegates a zone to the authoritative DNS servers for it.
Start of Authority
Administrative info about the zone — primary NS, contact, serial, timers.
Certificate Authority
Restricts which CAs can issue SSL certificates for the domain.
Common questions about DNS lookups.
Quick answers about how DNSfish works, what we log, and why the same record can look different from another tool.
Is DNSfish free to use?
Yes. The web tools and the public API at api.dnsfish.com are free, with no signup required for up to 1,000 queries per day. Higher limits are available on Pro and Enterprise plans.
Which resolvers does DNSfish query?
Every lookup runs against Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9 9.9.9.9, OpenDNS, and the authoritative nameservers for the zone — in parallel, so you can compare answers side by side.
Why do different resolvers return different answers?
Some domains use geo-aware DNS, anycast pools, or CDN-style steering that returns different IPs per region or per resolver. DNSfish highlights those differences so you can tell a misconfiguration from intentional load balancing.
How does the global propagation checker work?
After a record change, we resolve the domain from 16 probe cities across six continents and report each city's answer and RTT. This shows how quickly recursive caches around the world picked up your change.
Does DNSfish support DNSSEC validation?
Yes. The DNSSEC analyzer walks the chain of trust from the root to the leaf, checking DS, DNSKEY, and RRSIG records. Broken signatures and missing DS records are called out in plain English.
What data do you log?
We keep the queried domain and a hashed IP for 14 days for abuse prevention, then delete it. We don't run ads, sell data, or embed third-party trackers. Full details live on the Privacy page.
Can I use the DNSfish API in my product?
Yes. The /v1/lookup endpoint returns JSON, JSONP, and DNS-over-HTTPS responses. It's safe to call from monitors, CI pipelines, or client-side code. See the API page for the full reference.
How do I report a bug or request a feature?
Email hello@dnsfish.com or open an issue on the Contact page. A human engineer answers within one business day.
Same engine, available over HTTPS and DoH.
Drop our API into your uptime monitor, deploy pipeline, or staging healthcheck. 100 requests/sec free; no card needed.