Check DNS and email authentication
Live lookups from the assistant you already use
Three tools query public resolvers live; nothing queried is stored.
| Question | Tool |
|---|---|
| What are this domain's A, AAAA, CNAME, MX and NS records, and its SPF, DMARC and DNSSEC state? | check_dns |
| Is its SPF record valid, and how many of the ten allowed DNS lookups does it use? | check_spf |
| Does a record agree across independent resolvers after a change? | check_dns_propagation |
| What does a record type or mechanism mean? | get_dns_record (reference text, not a live lookup) |
Reading the SPF answer
check_spf returns the record, lookups against a limit of ten, void lookups against a limit of two, a status, a list of problems, and the include tree with each branch's cost. If it exceeds the limit it says where in the tree it broke.
After you change a record
Ask for check_dns_propagation with the record type. It asks four independent resolvers and reports whether they agree. consistent: false means some resolvers still hold the old answer; wait out the previous TTL and ask again.
Limits
The checks are rate-limited per IP address. They cannot see records only visible inside your network, and a resolver's cache can lag a change by up to the record's TTL.
The same lookups are available over HTTP: see /api/dns.