How to check your DNS records (and what each one does)

You can look up any domain's DNS records for free in under a minute, using a public lookup tool and the domain name alone - no login, no access to the domain required. For a small business, the records that actually matter are a short list: A/AAAA (where the website lives), CNAME (an alias to another name), MX (where email goes), TXT (where SPF and DMARC and verification strings live), NS (which provider answers for the domain), and CAA (who is allowed to issue certificates for it). Learn those six and you can read your own domain's setup well enough to spot when something is wrong.

The records worth knowing

DNS is just a public directory that turns your domain name into the addresses and instructions the internet needs. Every record is a row in that directory, and a handful do almost all the work for a small business.

A and AAAA - where the site lives. An A record points your domain at an IPv4 address; an AAAA record does the same job for IPv6. When someone types your domain, these are what send their browser to the right server. If your website is up but the domain shows nothing, a missing or wrong A record is the usual culprit.

CNAME - an alias. A CNAME record says "this name is really that name" - it points one hostname at another rather than at an address. www.yourbusiness.com.au pointing at yourbusiness.com.au is the classic case, and most hosted services (a shop platform, a booking tool, an email-marketing subdomain) ask you to add one. A name can have a CNAME or an A record, not both.

MX - where email goes. MX records decide which mail server receives email for your domain. Get these wrong and your email silently stops arriving. If you use Microsoft 365 or Google Workspace, the MX records point at their servers - and if they point somewhere you don't recognise, that is worth investigating today.

TXT - SPF, DMARC and verification. TXT records hold plain text, and that is where the records protecting your email name live: SPF (which servers may send as you) and DMARC (what receivers should do with mail that fails). A TXT record is also how services like Google or Microsoft confirm you own the domain. A domain with no SPF or DMARC TXT record is one anyone can more easily impersonate.

NS - which provider answers. Nameserver records name the servers that hold the authoritative copy of your DNS. They tell you who is actually in control of your records - your registrar, your web host, Cloudflare, or a developer's account you forgot about. When you "change DNS providers", you are really changing the NS records.

CAA - who may issue certificates. A CAA record lists which certificate authorities are allowed to issue HTTPS certificates for your domain. It is the one most small businesses have never heard of and don't publish - which is a quiet missed control, because it stops a rogue authority from minting a certificate in your name.

How to look them up, free

There are two ways in, and you don't need to be technical for either.

The fast way is a public DNS lookup tool. Open one like MXToolbox, type your domain, and it returns the live records - MX, then A, TXT, NS and the rest under their own tabs. It reads the same public directory every mail server and browser reads, so what it shows is exactly what the rest of the internet sees. This is the outside-in view, and it needs no access to anything you own - you can run it on a competitor's domain, a supplier's, or your own, and the result is the same kind of public truth.

The second way is your own control panel. Log in to your registrar or web host, find the DNS or "zone" section, and you'll see the same records in an editable table. Use this view when you want to change something; use the public tool when you just want to check, or when you want to see your domain as a stranger does. For the registrant and expiry side of the picture - who owns the domain and when it lapses - run it through auDA's WHOIS for any .au name; here's how to read that lookup.

If you've never looked before, start with the public tool. Four records in, you'll know more about your domain than most owners ever bother to learn.

What good looks like

A healthy small-business domain has a recognisable shape.

The email records are present and point where they should. MX records name your actual mail provider; an SPF TXT record exists and lists the services that send on your behalf; a DMARC record is published. The median Australian small-business domain scores grade E on Red Bridge Cyber's DNS category, and only 5% publish a CAA record^* - so a domain with email auth in place and a CAA record published is already ahead of most of the field.

There are no stray records. Old A records pointing at a server you decommissioned, a TXT verification string for a tool you stopped using, a CNAME for a subdomain that no longer exists - each is clutter, and clutter is where takeovers start. A subdomain still pointing at a service you closed is a known way attackers hijack a name.

The nameservers match your host. If your site is on one provider but the NS records point at another, your DNS may be answered from a place you've forgotten you control - a frequent finding when a long-gone web developer set things up. Your NS records should name the provider you actually manage your DNS through.

Common variations

A few normal things look like problems until you know them.

Subdomains have their own records. shop.yourbusiness.com.au or mail.yourbusiness.com.au carry their own A, CNAME or MX entries, separate from the bare domain. Looking up the root domain won't show them - you check each subdomain by name. This is by design, not a fault.

And a record you just added often "isn't showing yet". That is propagation: a change to DNS takes time to spread, anywhere from a few minutes to a day or so, governed by each record's TTL (time-to-live) value. The public lookup may show the new record while a colleague's machine still has the old one cached. Wait, re-check, and resist the urge to add the record a second time - duplicates cause their own problems. If a record still hasn't appeared after 24 hours, that's no longer propagation, and our guide on DNS problems and what to check first walks through where to look next.

When this isn't enough

Reading your records tells you what is there. It doesn't tell you how it compares - whether your email auth is strong or merely present, whether a stray record is a real exposure, how your domain stacks up against the typical Australian small business. Eyeballing a lookup tool is a spot check, not a baseline.

That correlation is what a scan does: it takes the outside-visible half of your domain - the same records a public tool shows - and grades it against the Australian small business baseline, flagging the gaps in plain English rather than leaving you to interpret a wall of records. It is the structured version of the manual check on this page.

If the records you find raise questions about who actually controls the domain, start with which Australian domain registrar to use and the tests in our guide to the best Australian domain registrar - because reading your DNS is most useful when you also know, and trust, the provider answering for it.