DNS lookup tool

Query any domain's DNS records — A, AAAA, MX, TXT, NS, CNAME — over encrypted DNS-over-HTTPS, straight from your browser.

How to use the dns lookup tool

  1. Enter a domain and choose a record type.
  2. Press Look up.
  3. Read the records returned over DNS-over-HTTPS.

How this works

Every lookup is sent over DNS-over-HTTPS (DoH) to a public resolver, so the query itself travels inside an encrypted HTTPS connection. A records point to IPv4 addresses, AAAA to IPv6, MX to mail servers, TXT to text data (like SPF/DKIM), NS to nameservers, and CNAME to aliases. To go the other way — IP to hostname — use the reverse DNS lookup.

Code & API examples

Use this from the command line or your code. The API is free, GET-only, and returns JSON.

API (curl)
curl "https://vpn.golf/api/tools/dns?name=example.com&type=A"
Shell (dig)
dig example.com A +short

See all endpoints at /api/tools/.

Frequently asked questions

DNS records map a domain to information: A/AAAA point to IP addresses, MX to mail servers, TXT to text data like SPF, NS to nameservers, and CNAME to aliases.

DoH sends DNS queries inside an encrypted HTTPS connection so they can't be read or tampered with in transit. This tool uses it for every lookup.

An A record maps a domain to an IPv4 address; an AAAA record maps it to an IPv6 address. A domain can have both, and clients pick whichever family they support.

A CNAME makes one name an alias for another, so lookups follow it to the target's records. You can't put a CNAME at a domain's apex alongside other records like MX.

Both live in TXT records. Look up the domain's TXT records for the SPF policy (starting v=spf1), and query the selector subdomain like selector._domainkey.example.com for DKIM.

That number is the priority. Mail servers try the lowest value first and fall back to higher ones, so 10 is preferred over 20. Equal values share load.

DNS results are cached for the length of the record's TTL. A resolver may keep the old answer until that timer expires, so changes can take minutes to hours to appear everywhere.

Time To Live is how many seconds a resolver may cache a record before re-querying. Lower TTLs propagate changes faster but generate more lookups.

No. The query goes over DNS-over-HTTPS to a public resolver, so it bypasses whatever resolver your device or router is configured to use and shows authoritative-side data.

Yes — vpn.golf exposes a free GET-only JSON endpoint at /api/tools/dns so you can script lookups; classic tools like dig and nslookup work too if you prefer the terminal.

Not every type is configured. A domain with no mail will have no MX records, and one with no IPv6 will have no AAAA — an empty result is normal, not an error.

This tool's lookups happen over an encrypted DoH channel and aren't logged to a profile here, but your everyday browsing DNS still goes to whatever resolver your system uses unless you're on a VPN or have DoH enabled.
Related tools
Reverse DNS (PTR) lookup DNS leak test DNS-over-HTTPS (DoH) test
Want to hide your IP for real?

vpn.golf is a no-logs WireGuard VPN. Pick a hole, take the shot.

Step up to the tee — free