Free DNS Records Lookup (A, MX, TXT, CAA, DNSSEC)
Look up any domain's A, AAAA, MX, NS, TXT, CAA and SOA records and check DNSSEC, CAA and SPF posture. Free, read-only DNS tool by Neurobyte.
About this tool
DNS records reveal a lot about how a domain is configured — where its mail goes, which servers host it, and whether basic email and certificate protections are in place. This free DNS lookup queries any domain's A, AAAA, MX, NS, TXT, CAA and SOA records and checks its DNSSEC, CAA and SPF posture, giving you a quick, read-only picture of a domain's setup.
It's handy for troubleshooting mail delivery, verifying a migration, auditing your own domain's security records, or investigating an unfamiliar domain. The lookup is read-only and changes nothing — it simply reports what the public DNS says about the domain you enter.
The records are not equally interesting. A and AAAA tell you which IP addresses answer for the name, which is where you notice a site still pointing at a decommissioned host after a migration. NS tells you who is actually authoritative — and it is worth checking against who you think is authoritative, because a domain whose nameservers still point at a former web agency is a domain that agency can still redirect. MX tells you where mail is accepted, and it is the fastest way to find out that a company you are about to email has no mail server at all, which is a common sign of a lookalike domain. TXT is where SPF, DKIM selectors and dozens of vendor verification strings accumulate over the years; SOA carries the zone's serial and its refresh timings.
The two records people most often have never heard of are the two that matter most for security. SPF (published as a TXT record) lists which servers are permitted to send mail using your domain. Without it — or with it ending in the permissive `~all` or `?all` rather than `-all` — anyone can forge mail from your domain, which is the mechanic behind most business email compromise and fake-invoice fraud. CAA names which certificate authorities are allowed to issue TLS certificates for the domain; with no CAA record, any public CA in the world may issue one, and mis-issuance is a real attack path. Both are single DNS records that cost nothing and take minutes to publish, and in our experience a clear majority of organisations we scope in Kenya and across East Africa have neither.
DNSSEC is the third gap. It signs your zone so resolvers can verify the answers they receive were not tampered with in transit, which is what stops DNS spoofing and cache-poisoning attacks from silently sending your users and your mail somewhere else. Adoption remains thin on `.co.ke` and on African second-level domains generally, partly because several local registrars still make it awkward to enable. The tool reports whether the domain you enter is signed, so you can check your own before you check anyone else's.
Read the flags as a starting point, not a verdict. A missing CAA record is not an incident; a permissive SPF record on a domain that sends invoices is closer to one. DNS also only shows you your external, publicly declared surface — it says nothing about what is running behind those addresses, whether it is patched, or whether it is exposed. That is what a penetration test is for. If you want a wider read on your external footprint without booking anything, the Security Posture check runs several of these tests at once, and the Email Security tool goes deeper on SPF, DKIM and DMARC specifically.
Frequently asked questions
What DNS records does the tool look up?
A and AAAA (addresses), MX (mail servers), NS (nameservers), TXT (including SPF and verification records), CAA (which certificate authorities may issue), and SOA — plus a DNSSEC check.
What is DNSSEC and why does it matter?
DNSSEC cryptographically signs DNS records so resolvers can verify they weren't tampered with in transit, protecting against DNS spoofing and cache poisoning. The tool reports whether a domain has it enabled.
Is this lookup read-only?
Yes. It only queries and displays public DNS data for the domain you enter. It makes no changes to any domain or record.
How do I check my SPF record, and what does a good one look like?
SPF is published as a TXT record beginning `v=spf1`. A healthy record names every service that legitimately sends mail for you (your mail provider, your CRM, your invoicing system) and ends in `-all`, which tells receivers to reject anything else. Ending in `~all` (softfail) or `?all` (neutral) leaves the door open to forgery, and having no SPF record at all means anyone can send mail as your domain. Beware the ten-lookup limit: too many `include:` statements silently invalidates the whole record.
Why does a missing CAA record matter?
A CAA record tells the world which certificate authorities are permitted to issue TLS certificates for your domain. With no CAA record, every publicly trusted CA on earth is allowed to — so an attacker who can pass one CA's domain-validation check, or a CA that mis-issues, can obtain a valid certificate for your name. Publishing a CAA record naming only the CA you actually use is a single DNS entry that removes most of that risk.
Is DNSSEC available on .co.ke domains?
Yes — the .ke zone is signed, so DNSSEC can be enabled on .co.ke domains. In practice adoption is low, and the friction is usually the registrar: some Kenyan registrars don't expose DS-record management in their control panel, so enabling it means raising a support ticket. It's worth doing, particularly for domains that carry mail or handle payments.
Can this tool find subdomains?
No. It queries the exact domain you enter, so it won't enumerate subdomains or find forgotten hosts — and forgotten subdomains pointing at deprovisioned cloud resources are exactly where subdomain takeovers happen. Mapping the full external surface is part of a vulnerability assessment or penetration test rather than a single DNS query.
What should I fix first if the tool flags several things?
Fix mail authentication before anything else: a missing or permissive SPF record on a domain that invoices customers is the flaw attackers actually monetise, through spoofed payment-detail emails. Then publish a CAA record, then enable DNSSEC. Confirm your NS records point at a provider you still control before you touch any of it.