DNS Lookup (A and AAAA)

What A and AAAA records do

An A record maps a host name to an IPv4 address and an AAAA record maps it to an IPv6 address. They are the records a browser, API client or mail server finally needs once it has a name and wants somewhere to connect. A name may carry several of either type, and clients normally try the addresses in an order of their own choosing, so the order shown in a response is not a priority.

This tool asks for both types of the host name you enter. It sends the question to the system resolver of the scanner and also finds the zone's authoritative name servers and asks them directly with recursion switched off. Showing both views lets you tell the difference between what the zone says and what a cache is currently repeating.

How to read the result

Each address family is reported separately, because a name can have a healthy A record and no AAAA record at all. The lookup for each type ends in one of a small set of states, and they mean different things.

The most common mistake when reading a DNS answer is to treat every empty result as 'the record does not exist'. The tool keeps the precise state of every query so that a failed query is never shown as an absent record.

• Records found: the addresses are listed with the remaining TTL. The tool notes whether the answer came through an alias (a CNAME) and shows the chain target, because the addresses then belong to the target name rather than to the name you typed.
• NODATA: the name exists but has no record of that type. For AAAA this usually just means the host is not published over IPv6, which is informational rather than a fault.
• NXDOMAIN: the name itself does not exist. Check for typos, a missing label, or a record that was never created or was deleted.
• SERVFAIL, REFUSED, timeout or transport error: the server could not give an answer. Nothing is known about the record, and the headline says explicitly that this is not evidence of absence.
• Non-public addresses: if an address is private, loopback or otherwise not routable on the internet, the tool flags it, since outside clients cannot reach it.

Authoritative servers versus the system resolver

The authoritative answer is what the zone currently publishes. The system resolver answer may be older, because resolvers keep a record until its TTL runs out. If the two differ shortly after you edited a record, that is usually ordinary caching, and the TTL tells you how long it can last. If they still differ long after the TTL has passed, look at whether all authoritative servers agree with each other; the NS tool reports that, and the propagation tool compares ten public resolvers.

The tool queries up to eight authoritative servers per run and uses one address for each server. A zone served by anycast or by a load balancer can answer differently from places this scanner cannot see.

Common address-record problems

• Wrong or stale IP after a migration: the A record still points at the old host. Compare the address with the one your hosting provider gave you, and remember that resolvers may serve the old value until the TTL expires.
• AAAA published but broken: a AAAA record that points at a host that does not listen on IPv6 can make dual-stack clients slow or fail on their first attempt. Either fix the IPv6 service or remove the AAAA record until it works.
• Private address in public DNS: an A record such as a 10.x or 192.168.x address works only inside one network. It is a common leftover from internal testing.
• CNAME at a name that also needs other records: the lookup follows aliases, but an alias cannot sit beside other record types at the same name. The CNAME tool checks this.
• Missing record on the bare domain: many sites publish www but forget the apex name, so example.com fails while www.example.com works.

How to change address records safely

Before editing, copy the current records and their TTL from the zone editor, and note the old addresses so you can restore them. If the change is planned, lower the TTL a day or more ahead so caches hold the old value for less time, then change the address, and restore a longer TTL once you are satisfied.

Bring the new server up and serving the right content before you point DNS at it, and keep the old server running until traffic has drained. Changing an A record is easy to undo in DNS, but the TTL you set before the change decides how fast the undo reaches clients.

1. Record the current A and AAAA values and the TTL.
2. Lower the TTL in advance and wait at least the old TTL.
3. Change the address at the authoritative provider.
4. Run this lookup again and confirm the authoritative servers show the new value.
5. Check the new host over HTTPS from outside your network, then raise the TTL.
6. To roll back, put the old addresses back; clients converge after the TTL you set.

What this test does not cover

A lookup shows that DNS publishes an address. It does not prove that anything answers on that address, that a certificate matches, or that a firewall allows the visitor in. Use the web and network tools for that. Results are a single measurement from one scanner at one moment, not a view from every region, and a content delivery network that gives different answers to different resolver locations will only show you the answer given to this scanner.

Frequently asked questions

Scope of this tool

• Reachability of the addresses is not tested.

Written by DNS Tools editorial · Last updated 2026-10-09