DNS Detective — Documentation

Usage Guide

Running a DNS Lookup

Getting started is straightforward — just type a domain name into the search field and hit Lookup DNS. You can enter the domain in whichever way feels natural:

• example.com
• https://example.com
• www.example.com
• example.com/some-page

DNS Detective will automatically strip away any protocols, www prefixes, and trailing paths so you're always querying the bare domain. No need to clean it up yourself.

Once you submit, the tool performs a comprehensive scan behind the scenes and returns your results in a matter of seconds — no page reload required.

Understanding Your Results

Results are displayed in clearly labelled, collapsible groups organised by record type. Click any record type header to expand or collapse that section. Here's what each type tells you:

Each individual record shows:

• Host — the specific hostname the record belongs to
• TTL — time-to-live in seconds, indicating how long the record is cached
• Value — the actual data (IP address, mail server, text content, etc.)
• Priority / Weight / Port — additional fields shown for MX, SRV, and CAA records where applicable

Cloudflare Detection

If the domain uses Cloudflare nameservers, DNS Detective will display a warning banner at the top of your results:

⚠️ This domain uses Cloudflare nameservers. The A and AAAA records shown may be Cloudflare proxy IPs, not the actual origin server IPs.

This is important context — when Cloudflare is in the picture, the IP addresses you see for A and AAAA records typically belong to Cloudflare's edge network rather than the actual hosting server. The warning ensures you don't mistake proxy IPs for origin IPs.

Zone File Export

Every lookup automatically generates a BIND-compatible zone file — a standardised, plain-text representation of all the DNS records found. This is incredibly useful for:

• Migrating a domain to a new DNS provider
• Creating a backup of your current DNS configuration
• Auditing a domain's full DNS setup at a glance
• Importing records into DNS management tools that accept BIND format

The zone file appears at the bottom of the results. You have two options:

• Copy — copies the entire zone file to your clipboard with one click. A confirmation toast will appear when successful.
• Download — saves the zone file as a .txt file to your computer. The filename follows the format domain_com_zone.txt for easy identification.

The generated zone file includes proper $ORIGIN and $TTL directives, and records are sorted logically (SOA → NS → A → AAAA → CNAME → MX → TXT → SRV → CAA) for maximum readability.

Troubleshooting

No records found for my domain

If the lookup returns no results, here are the most common causes:

• The domain doesn't exist or has expired. Double-check the spelling and verify the domain is active.
• DNS propagation is still in progress. If you've recently registered or transferred a domain, it can take up to 48 hours for records to propagate globally.
• The domain has no publicly resolvable records. Some internal or parked domains may not have DNS records configured.

Some record types are missing

Not every domain uses every record type. For example:

• AAAA records only exist if the domain has IPv6 configured.
• SRV records are mostly used by specific services like VoIP or messaging.
• CAA records are optional and only present if the domain owner has explicitly restricted which certificate authorities can issue SSL certificates.

If you expected to see a specific record type and it's not showing up, it likely means the record simply hasn't been configured for that domain.

The IP address shown doesn't match my hosting

This is almost always caused by one of two things:

1. Cloudflare or another CDN/proxy is active. Look for the Cloudflare warning banner. If present, the IPs shown belong to Cloudflare, not your origin server.
2. DNS caching. Your domain's records may have been recently changed, but the old values are still being served from cache. Check the TTL values — they indicate how long (in seconds) before the cached data expires.

Copy to clipboard not working

The copy feature requires a secure context (HTTPS). If you're accessing the page over plain HTTP, the clipboard API may be blocked by your browser. DNS Detective includes a fallback method, but in rare cases you may need to manually select the zone file text and use Ctrl+C / Cmd+C.

FAQ

What exactly is a DNS record?

DNS records are instructions stored on authoritative nameservers that tell the internet how to handle requests for your domain. They map domain names to IP addresses (A/AAAA records), specify mail servers (MX records), prove domain ownership (TXT records), and much more. Think of them as the phone book of the internet.

Can I look up any domain, or only my own?

You can look up any publicly registered domain. DNS records are public information — that's how the internet works. DNS Detective simply queries the same data that any DNS resolver would.

What's the difference between A and AAAA records?

A records map a domain to an IPv4 address (e.g., 93.184.216.34). AAAA records map to an IPv6 address (e.g., 2606:2800:220:1:248:1893:25c8:1946). IPv6 is the newer protocol designed to handle the exhaustion of IPv4 addresses. Many domains have both.

Why do I see multiple A records for a single domain?

Multiple A records are common and typically mean the domain uses load balancing or redundancy. Traffic is distributed across several IP addresses to improve performance and reliability.

What do the priority values on MX records mean?

MX priority determines the order in which mail servers are tried. Lower numbers = higher priority. So an MX record with priority 10 will be tried before one with priority 20. If the primary server is unavailable, email is routed to the next one in line.

What are DKIM and DMARC records?

Both are email authentication mechanisms stored as TXT records:

• DKIM (DomainKeys Identified Mail) uses cryptographic signatures to verify that an email was actually sent from the domain it claims to be from and hasn't been tampered with in transit.
• DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving mail servers what to do with emails that fail SPF or DKIM checks — quarantine them, reject them, or let them through.

DNS Detective automatically checks for common DKIM selectors (Google, Zoho, Mailchimp, Mandrill, and more) so you can quickly verify whether email authentication is properly configured.

What is a zone file and why would I need one?

A zone file is a standard text format (defined by RFC 1035) that describes all DNS records for a domain. It's the universal format used by DNS servers like BIND. You might need one to:

• Migrate your DNS to a new provider — most providers accept zone file imports
• Keep a backup of your DNS configuration before making changes
• Share your DNS setup with a colleague or support team in a standardised format

What does TTL mean and why does it matter?

TTL (Time To Live) is measured in seconds and tells DNS resolvers how long to cache a record before checking for updates. A TTL of 3600 means the record is cached for one hour. Lower TTLs mean changes propagate faster but result in more DNS queries. Higher TTLs reduce query load but mean changes take longer to take effect.

Why are some subdomains discovered but not others?

DNS Detective checks a curated list of the most commonly used subdomains. If a particular subdomain isn't in the list, it won't appear in the results — this doesn't mean it doesn't exist, just that it wasn't probed. The focus is on the subdomains most likely to reveal useful information about a domain's infrastructure and email configuration.