Free DNS lookup and diagnostics
nstool.app reads live DNS for any domain and says what is wrong with it. No sign-up, no ads, and every result has a link you can share.
- DNS records
- A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, PTR, HTTPS, DS, DNSKEY and TLSA from the resolver you choose.
- Authoritative nameservers
- Every NS queried directly: SOA serials, delegation and glue, lame delegation, DNSSEC.
- Propagation
- The same question to Cloudflare, Google, Quad9, OpenDNS and four more public resolvers.
- Mail DNS
- MX and reverse DNS, SPF lookup count, DMARC policy, DKIM keys, MTA-STS, TLS-RPT and BIMI.
Common DNS questions, answered
What does nstool.app do?
nstool.app is a free DNS lookup and diagnostics tool. It queries A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, HTTPS, DS, DNSKEY and other records, checks every authoritative nameserver of a domain, compares answers from public resolvers and verifies e-mail records such as SPF, DKIM and DMARC.
How do I check the MX records of a domain?
Enter the domain, pick MX and press Look up, or open nstool.app/example.com/mx. The Mail tab goes further: it resolves every mail server, checks reverse DNS and validates SPF, DMARC and DKIM.
How can I check if a DNS change has propagated?
Use the Resolvers tab. It asks Cloudflare, Google, Quad9, OpenDNS, AdGuard and other public resolvers the same question. Different answers mean some resolvers still serve the old record from cache until its TTL expires.
What is an authoritative nameserver check?
It queries each nameserver of the zone directly, without recursion. You see whether all of them answer, whether they are authoritative, whether their SOA serials match and whether the parent zone delegates to the same nameservers.
How do I verify SPF, DKIM and DMARC?
Open the Mail tab. SPF is checked for syntax, its final all mechanism and the 10 DNS-lookup limit, DMARC tags are explained, and DKIM keys are looked up for common selectors or the selector you enter.
Can I use nstool.app from the command line?
Yes. curl nstool.app/example.com prints the records as plain text, and curl nstool.app/mail/example.com runs the mail checks. A JSON API is available at /api/lookup, /api/auth, /api/resolvers and /api/mail.