DNS tools to check records and find what broke

A small set of tools for seeing what your domain is really doing in DNS. Look up records, follow a lookup from the root servers down to the final answer, compare what public resolvers still have cached against the real source, and check the quieter pieces that break email, certificates, and websites when they go wrong.

What are you trying to fix?

DNS LookupI only need to see the current records.DNS lookup shows what a public resolver or the domain's authoritative nameserver returns now.DNS Trace ExplorerThe domain returns SERVFAIL.DNS Trace Explorer follows the handoffs from the root and shows where the path stops.DNS Change CheckerA DNS change still looks old.DNS Change Checker compares the source with the copies held by public resolver caches.Nameserver Delegation CheckerI moved nameservers.Nameserver Delegation Checker checks the parent handoff, glue, and whether every server answers.DNSSEC Chain CheckerDNSSEC looks broken.DNSSEC Chain Checker validates the signed chain from the root to one answer.SOA Consistency CheckerNameservers may be out of sync.SOA Consistency Checker compares the serial and timing values served by every nameserver.CAA Policy CheckerA certificate will not issue.CAA Policy Checker finds which certificate authorities may issue normal and wildcard certificates.