Enter a domain or a link: 12 public resolvers are asked at once, so you see the DNS records, what each resolver answers right now, and a checkup grade for the answers, the mail setup and DNSSEC.
| Type | Value | TTL | Resolvers returning this |
|---|
Values are merged across resolvers; TTL is what each resolver has left.
What each resolver answers right now
Data: 12 public DNS resolvers over DNS over HTTPS; registration data comes from RDAP, and the 1ms.dog server asks the registry when a browser cannot.
Enter a domain: nine record types (A, AAAA, CNAME, MX, NS, TXT, CAA, SRV, SOA) are asked at 12 public DNS resolvers, each over DNS over HTTPS from your browser. The values are merged, and each resolver's own answer is shown under Resolver answers. Registration data comes from RDAP, the JSON version of WHOIS.
The letter is the lower of two grades: how the resolvers' answers compare, and how the mail setup looks. Agreement is counted among the resolvers that answered: if all of them said the same thing the answers get an A, and one different answer makes it a B. A resolver this page could not reach — usually your own network — counts neither for nor against; a SERVFAIL or REFUSED from the resolver is an answer and does count. Fewer than half of the twelve answering means no grade. The mail grade comes from SPF and DMARC and only applies when the domain has an MX that accepts mail. A signed domain whose DNSSEC fails to validate drops one more step. CAA and IPv6 are shown as badges and never change the letter.
DNSSEC lets a resolver prove that an answer really comes from the domain and was not altered. The page asks the parent zone for a DS record and reads the AD bit from resolvers that are known to validate. "On, and validates" means the domain is signed and those resolvers agree; "On, but validation fails" means a signed domain answers with a broken chain, and resolvers that check will refuse it. Off is normal and doesn't lower the grade; with too little evidence the page says it can't tell.
When a record changes, every resolver keeps its old copy until the TTL (time to live) runs out. So right after a change some resolvers still answer with the old value, and the Resolver answers panel shows which ones. The page can only see what public resolvers have cached: a browser cannot reach the domain's own authoritative server on port 53, so it cannot show the zone's current truth.
The queries go straight from your browser to each resolver. In mainland China, Cloudflare and Google DNS are usually blocked and some others are too, so those rows say they could not connect. That is a fact about the path, not an empty record set: a resolver that did not answer is never counted as disagreeing.
"Same answer" counts the resolvers that gave the most common answer, out of those that answered. TTL is the number of seconds that resolver may still keep the record; it counts down from the value in the zone and differs between resolvers, so it is not a disagreement.
SPF is read from the domain's TXT records: the page looks for more than one v=spf1 record, checks how the record ends (+all, -all, ~all or ?all), and counts the mechanisms that need another DNS lookup (include, a, mx, ptr, exists, redirect), where the limit is 10. It does not follow includes, so the count is a lower bound. DMARC is read from _dmarc.<domain>: the p= policy, whether reports (rua) are configured, and pct.
The registrar's list (RDAP) is what the registry has stored; the resolvers return what the domain actually publishes in its NS records. A difference usually means a change is still showing up, or the registry data is out of date. Both sides are shown as they are.
RDAP is the structured replacement for WHOIS, served by the registry. Some registries publish little, and privacy services replace registrant details; a missing field is shown as unknown, not as "none".
RDAP is served by each registry, and rdap.org only knows the suffixes listed in IANA's bootstrap file; some suffixes have RDAP that a browser is not allowed to read (DENIC for .de, for example). For both, the page asks the 1ms.dog server instead: it tries RDAP first, then the registry's port-43 WHOIS (currently .cn, .jp, .ru and .hk), and the page marks the answer as fetched on your behalf. It shows what the registry publishes, registrant included — name or company, e-mail, phone — and the registry's own reply is there under "Raw record", so nothing a registry makes public is hidden or rewritten. .vn's WHOIS does not answer, so there the page keeps the registry's link and says it cannot look the data up, never that there is nothing.
Every DNS query goes from your browser directly to the resolvers listed under Resolver answers. Registration data is asked by the browser too: rdap.org or the registry's own RDAP (like .io's). When the browser cannot read it — the registry sends no CORS header, or the suffix has no RDAP — the page asks the 1ms.dog server instead: it tries RDAP, then the registry's port-43 WHOIS, and the answer is marked as fetched on your behalf. We keep no log of your address or your queries. A shared link holds the domain's own public records and the registration data you saw — never your IP.
A shared result is a snapshot: it shows what the resolvers returned at that time, so two people compare the same data. Press "Look up mine" to query again.
Tests start from your browser. No account, and we don't collect your results.
310K+ visits© 2026 1ms.dog
