DNS lookup & compare: why do answers differ?
Changed DNS but still seeing the old IP? Run a free DNS lookup and compare Google with Cloudflare side by side. Check A, AAAA, MX and TXT records, see TTLs, and understand different answers. No sign-up.
Two resolvers. One query. Ready to compare.
This looks up public records through Cloudflare and Google from our server. It does not identify your device’s DNS resolver or test VPN DNS leaks. How DNS queries are handled →
How to look up and compare DNS records
- Enter the exact DNS name, such as example.com or _dmarc.example.com.
- Select a record type and choose Compare DNS. Both resolvers are queried independently.
- Read the comparison summary, individual records, TTLs and response codes together. If you recently changed DNS, cached answers can remain until their TTL expires.
Which DNS records should I check?
- Website shows an old IP
- Compare A for IPv4 and AAAA for IPv6 at the exact hostname. A www hostname can use different records from the root domain. Look for CNAME aliases in the answer chain.
- Email still reaches an old server
- Look up MX at your mail domain, then compare the mail server names and priorities with your email provider’s settings. This lookup shows published routing records; it does not send a test email.
- Domain verification is pending
- Look up TXT at the name your provider requested. SPF usually uses the mail domain; DMARC uses _dmarc and DKIM needs the supplied selector. Check the exact text rather than assuming all TXT records belong at the root.
Why do Cloudflare and Google DNS disagree?
Each resolver has its own cache. After a DNS change, an older answer may remain until its TTL expires. CDNs, load balancing and geographic DNS can also return different valid addresses. A difference is a clue to investigate, not an automatic failure.
We compare answer record sets, ignoring order and TTL. DNS names are compared without case or a trailing dot; IPv6 spelling is normalized. TXT text remains case-sensitive. Authority records and DNSSEC flags are shown separately and are not part of the answer-value verdict.
Changed DNS but still seeing the old address?
- Check the exact hostname and record type you changed. A root domain and www can have different answers.
- Compare the returned values with your DNS provider’s published configuration.
- Read TTL as remaining cache lifetime, not a countdown to a guaranteed global update. Compare again later.
- If one resolver fails, retry and investigate the response code. Do not treat its missing response as agreement.
What each record type means
- A / AAAA
- IPv4 and IPv6 addresses published for the name. These may belong to a CDN or proxy rather than the origin server.
- MX
- Mail servers and their priority. Lower preference numbers are tried first.
- TXT
- Text records, such as SPF or domain verification. For DMARC use _dmarc.example.com; DKIM needs the correct selector name.
- NS / SOA
- Nameservers and zone administration data. Use the zone name for these queries.
- CNAME
- An alias to another DNS name. A and AAAA answers may also include a CNAME chain.
- CAA
- Certificate authority authorization records. A missing record alone is not a security failure.
- PTR
- Reverse DNS names. Enter a reverse name such as 1.1.1.1.in-addr.arpa, not a literal IP address.
Why are there no records?
NOERROR with an empty answer means the resolver returned no records for that name and type. NXDOMAIN means it reported that the name does not exist. SERVFAIL or REFUSED means the lookup did not complete successfully; neither proves that a domain is absent.
Does this test DNS propagation everywhere?
No. This shows two public resolver snapshots from the server handling your request, not probes from every country. Other resolvers, private networks, regions or authoritative servers can return different records. A CNAME query may also be empty when a provider flattens an alias into address records.
What does the DNSSEC field mean?
“Validated by resolver” means that resolver set the authenticated-data flag for the response. “Not asserted” is not a security verdict: the zone may be unsigned, or the response may not carry authenticated data. DNSSEC does not certify that a website is trustworthy.
Can this find a DNS leak?
No. A DNS leak test needs to observe which resolvers request unique test names. This record lookup asks two chosen public resolvers for published records. For other browser exposure checks, use the WebRTC and IPv6 VPN check.
Does this tell me which DNS resolver is faster?
No. These are server-side DNS-over-HTTPS requests. They do not measure your device’s DNS speed. For browser-to-edge response times, use the HTTP latency test.
Sources and related checks
Google Public DNS JSON API documentation
Cloudflare DNS-over-HTTPS response documentation