H
HTTPSense

DNS Inspector

Look up DNS records for any domain — A, AAAA, CNAME, MX, TXT, NS, and more.

What is a DNS Inspector?

A DNS inspector queries the Domain Name System to retrieve all public records associated with a domain. DNS records map human-readable domain names to IP addresses (A and AAAA records), define mail routing (MX), prove domain ownership and configure email security (TXT — SPF, DKIM, DMARC), delegate authority (NS and SOA), restrict which CAs may issue certificates (CAA), and create aliases (CNAME). Understanding these records is essential for troubleshooting connectivity, configuring email deliverability, securing certificate issuance, and verifying domain ownership.

HTTPSense's DNS Inspector performs parallel lookups across A, AAAA, CNAME, MX, TXT, NS, SOA, and CAA, returning each record with its TTL. It also runs a DNSSEC chain-of-trust check against the parent zone and surfaces the result alongside the records, so you can see at a glance whether the domain is properly signed and validating.

How to Use the DNS Inspector

  1. Enter a domain name or URL in the search bar and click Inspect DNS.
  2. Review the Overview tab for the DNSSEC status, record-type counts, and authoritative nameservers.
  3. Click on individual record-type tabs (A, AAAA, MX, TXT, NS, SOA, CAA) to see each record with its TTL.
  4. Use the Raw tab to copy or download the full JSON response for scripting or documentation.

How the DNS Inspector Works

When you submit a domain or URL, we strip the scheme, port, and path to extract the bare hostname. The hostname is then queried against Cloudflare’s public validating resolver (1.1.1.1) for A, AAAA, CNAME, MX, TXT, NS, SOA, and CAA records — all in parallel — along with DS and DNSKEY queries for DNSSEC analysis. Each record is captured with the TTL the resolver returned.

For DNSSEC, we issue queries with the DO (DNSSEC OK) flag set so the resolver returns its validation state. We then read the AD (Authenticated Data) bit on the DS response and combine it with the count of DS records at the parent zone to classify the domain as Signed & Validated, Signed but not validated (a likely bogus state), or Not signed. Any DS and DNSKEY algorithms in use are surfaced for diagnostic purposes.

DNS is a domain-level concern: the URL path and query are irrelevant to the lookup. We do not perform recursive zone walks or read the zone files directly — only what the public resolver returns is shown.

Key Features

  • Parallel lookups — Queries A, AAAA, CNAME, MX, TXT, NS, SOA, and CAA simultaneously.
  • DNSSEC validation — Verifies the chain of trust through Cloudflare’s validating resolver and reports DS / DNSKEY counts and algorithms.
  • CAA support — Lists Certificate Authority Authorization records so you can audit which CAs may issue certificates for the domain.
  • SOA inspection — Returns the authoritative SOA so you can verify serial number, refresh, retry, expire, and minimum TTL.
  • TTL display — Every record shows its TTL in human-friendly form (s, m, h, d) with the raw seconds in the tooltip.
  • Authoritative nameservers — Lists the NS records so you can confirm which DNS provider is in charge.
  • Raw JSON output — Provides the complete response for integration with scripts or reports.

Common Use Cases

  • System administrators — Verify DNS propagation after record changes and confirm correct A/AAAA resolution.
  • Email administrators — Check MX records, SPF (TXT), and DKIM entries to debug email deliverability issues.
  • DevOps engineers — Validate CNAME and NS configurations for CDN, load-balancer, or DNS migration cutover.
  • Domain managers — Audit all records associated with a domain before ownership transfer or registrar migration.

Frequently Asked Questions

Does this validate DNSSEC?

Yes. We query Cloudflare’s validating resolver (1.1.1.1) with the DNSSEC OK flag, then check the AD (Authenticated Data) bit on the response and look for DS records at the parent zone. The result is shown as Signed & Validated, Signed but unvalidated (a possible bogus state), or Not Signed. Algorithm details for any DS and DNSKEY records are also surfaced.

Why do I see different answers than dig from my laptop?

Resolvers can return geo-aware results, and our query travels from a different network than your laptop. Compare the AUTHORITATIVE answer (using dig +short @<authoritative-ns>) once propagation completes; that should match across networks.

Does it support DKIM, DMARC, and SPF lookups?

Yes — they all live in TXT records. Open the TXT tab and look for entries at the apex (SPF), under _dmarc.example.com (DMARC), and selectors like default._domainkey.example.com (DKIM). The Inspector queries the apex; for selector-specific DKIM, query that exact subdomain.

What record types are queried?

A, AAAA, CNAME, MX, TXT, NS, SOA, and CAA — all in parallel. DS and DNSKEY are queried separately for the DNSSEC card.

Is it free? Do I need to sign up?

Yes, the DNS Inspector is free and requires no signup or API key.