DNS lookup

What does a domain's DNS say about it?

Every domain publishes records that tell the internet where its website is, who handles its email and which services it uses. Enter a domain to see them all, explained in plain words.

Try:github.com wikipedia.org ip5.io

EXAMPLE

github.com

In plain words

Website: 140.82.112.4 · GitHub, Inc.No IPv6 address.
Email arrives at: Microsoft 365
Allowed to send its email: Microsoft 365, Google, Zendesk, Salesforce, Mailchimp, Marketo, SendGrid, its own serversOther senders are marked as suspicious.
Fake emails using it: Go to spamFor its subdomains: rejected.
DNS is run by: NS1, Amazon Route 53
HTTPS certificates from: DigiCert, GlobalSign, Let's Encrypt, SectigoNo other company may issue them.

Registration and hosting: website lookup →

Services it has verified

Many services ask domain owners to add a record to prove they own the domain. Together these records hint at the tools an organization uses.

Adobe
Anthropic
Apple
Atlassian
Calendly
DocuSign
Facebook
Google
Jamf
Krisp
Loom
Microsoft
Miro
OpenAI
Salesforce
Shopify
Stripe
Tailscale

All records

AWebsite address (IPv4)1Where browsers connect to open the site.

140.82.112.4GitHub, Inc. · Look up →

AAAAWebsite address (IPv6)0None

CNAMEAlias1Where www.github.com points.

www.github.com → github.comTwo names for the same site.

MXEmail1Where email for github.com is delivered.

0 github-com.mail.protection.outlook.comMicrosoft 365

NSName servers8The servers that answer for this domain.

dns1.p08.nsone.netNS1
dns2.p08.nsone.netNS1
dns3.p08.nsone.netNS1
dns4.p08.nsone.netNS1
ns-1283.awsdns-32.orgAmazon Route 53
ns-1707.awsdns-21.co.ukAmazon Route 53
ns-421.awsdns-52.comAmazon Route 53
ns-520.awsdns-01.netAmazon Route 53

TXTText records24Email rules and ownership proofs.

00Dd0000000hHE0=1TBKg000000TN2r
MS=6BF03E6AF5CB689E315FB6199603BABF2C88D805
MS=ms44452932
MS=ms58704441
TAILSCALE-xOzoDvFUzZr5YYVCQFuDProves ownership to Tailscale.
adobe-idp-site-verification=b92c9e999aef825edc36e0a3d847d2dbad5b2fc0e05c79ddd7a16139b48ecf4bProves ownership to Adobe.
anthropic-domain-verification-4az7qn=if8YWuRRqwLycGJDooumzHtxmProves ownership to Anthropic.
apple-domain-verification=RyQhdzTl6Z6x8ZP4Proves ownership to Apple.
atlassian-domain-verification=jjgw98AKv2aeoYFxiL/VFaoyPkn3undEssTRuMg6C/3Fp/iqhkV4HVV7WjYlVeF8Proves ownership to Atlassian.
calendly-site-verification=at0DQARi7IZvJtXQAWhMqpmIzpvoBNF7aam5VKKxPProves ownership to Calendly.
cursor-domain-verification-gtfwmt=1rfLOtiTngX5QSxD5HvNKTvm3
docusign=087098e3-3d46-47b7-9b4e-8a23028154cdProves ownership to DocuSign.
facebook-domain-verification=39xu4jzl7roi7x0n93ldkxjiaarx50Proves ownership to Facebook.
google-site-verification=82Le34Flgtd15ojYhHlGF_6g72muSjamlMVThBOJpksProves ownership to Google.
google-site-verification=UTM-3akMgubp6tQtgEuAkYNYLyYAvpTnnSrDMWoDR3oProves ownership to Google.
jamf-site-verification=XtaPNIYghF_e_xRDI8CjgQProves ownership to Jamf.
krisp-domain-verification=ZlyiK7XLhnaoUQb2hpak1PLY7dFkl1WEProves ownership to Krisp.
loom-site-verification=f3787154f1154b7880e720a511ea664dProves ownership to Loom.
miro-verification=d2e174fdb00c71e0bcf58f8e58c3da2dd80dcfa9Proves ownership to Miro.
openai-domain-verification=dv-3nh33eQwdkotMIAzLrIDVZo1Proves ownership to OpenAI.
serval-domain-verification-ydryhj=qbkiEakpwEpTvHh5fIiCqtaue
shopify-verification-code=t1YPwcmvnxZyBycaCpk1MPyWoFs72oProves ownership to Shopify.
stripe-verification=f88ef17321660a01bab1660454192e014defa29ba7b8de9633c69d6b4912217fProves ownership to Stripe.
v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~allSPF: who may send its email.

DMARCEmail policy1What happens to fake emails using this domain.

v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1Go to spam For its subdomains: rejected. Reports go to dmarc@github.com.

CAACertificate rules7Which companies may issue HTTPS certificates.

0 issue "digicert.com"DigiCert
0 issue "globalsign.com"GlobalSign
0 issue "letsencrypt.org"Let's Encrypt
0 issue "sectigo.com"Sectigo
0 issuewild "digicert.com"DigiCert, also for wildcard certificates
0 issuewild "letsencrypt.org"Let's Encrypt, also for wildcard certificates
0 issuewild "sectigo.com"Sectigo, also for wildcard certificates

SOAZone details1Technical settings of the domain's DNS.

ns-1707.awsdns-21.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400Primary name server: ns-1707.awsdns-21.co.uk.

What a DNS lookup can't tell

Who owns the domainDNS shows where things point. For registration dates, use the website lookup; owners' names are mostly hidden.

Every subdomainDNS answers questions about names you already know. There is no list of all names under a domain.

What other networks seeThese are Cloudflare DNS's answers. Right after a change, some networks can still have the old ones for a while.

From the terminal

curl ip5.io/dns-lookup/github.com
curl "ip5.io/dns-lookup/github.com?format=json"

5 questions

Q1What is DNS?

The internet's address book. When you type a website's name, your device asks DNS which address to connect to. Domains also publish where their email goes and rules about who may send it.

Q2What do the record types mean?

A and AAAA are the website's addresses (IPv4 and IPv6). CNAME is an alias for another name. MX says where email is delivered. NS lists the servers that answer for the domain. TXT holds text like email rules and ownership proofs. CAA says who may issue HTTPS certificates.

Q3Why do companies publish verification records?

Services like Google, Microsoft or Stripe ask for a record to prove that whoever sets up an account really controls the domain. The records often stay after setup, so they quietly show which services an organization uses.

Q4Why don't I see my DNS change yet?

DNS answers are kept for a while by the servers that asked, as set in each record's time to live. Most changes show up within minutes to a few hours.

Q5Does the domain owner see my lookup?

No. ip5.io asks Cloudflare DNS, which answers from its own copy or asks the domain's name servers. The question comes from Cloudflare, not from you, and ip5.io doesn't keep it.