DNS Lookup / inspect DNS records

How does DNS work?

The Domain Name System (DNS) is the phone book of the internet. When your browser opens tools.kernelhost.com, the domain is first translated into an IP address. DNS is not a single server but a hierarchical chain: root servers (.), TLD servers (.com, .de, .at) and finally the authoritative nameserver of the domain. The resolver walks this chain and caches the result locally.

A DNS query consists of question and answer: which records of type X exist for domain Y? The reply contains one or more records plus a TTL (time to live), which tells a resolver how long it may cache the entry. DNS changes therefore are not visible worldwide instantly, they propagate along the cache hierarchy.

Our tool starts a UDP/TCP lookup via the system resolver of the container in Frankfurt FRA01. There is no tracking, no logging of the queried domain and no third-party API. The reply usually returns within a few milliseconds because the Frankfurt node is connected directly to DE-CIX.

Which record types exist?

Each DNS record type has a specific job. Our tool shows the eight most common types you actually need to operate a domain.

• A: Maps a domain to an IPv4 address. A domain can have multiple A records (round-robin DNS, load balancing).
• AAAA: Maps a domain to an IPv6 address. Mandatory for modern web setups, Google ranks IPv6 connectivity positively.
• MX: Mail exchanger. Which server accepts mail for this domain. Carries a priority (lower number is preferred) for failover.
• TXT: Free-form text. In practice almost exclusively used for SPF, DKIM, DMARC, domain verification (Google, Microsoft) and _acme-challenge (Let's Encrypt).
• CNAME: Alias to another domain. www.kernelhost.com may be a CNAME pointing to kernelhost.com. CNAME is not allowed on the apex domain itself.
• NS: Which nameservers are authoritative for this domain. NS records are set during domain registration and define where all other records are managed.
• SOA: Start Of Authority. Defines the primary nameserver, the admin email, and the refresh/retry/expire/minimum TTL values for zone transfers.
• CAA: Certificate Authority Authorization. Which CAs may issue TLS certificates for this domain. Protection against unauthorized certificate issuance.

MX vs SPF vs DKIM vs DMARC: email setup explained

A complete email setup consists of four DNS components. If one is missing, your mail either does not arrive or lands in the spam folder.

• MX (receive): Tells the world which server accepts incoming mail for your domain. Without MX, nobody can write to you. MX typically points to a hostname like mx.kernelhost.com which is then resolved via A/AAAA.
• SPF (sender authentication): TXT record with v=spf1 specifying which IPs may legitimately send mail for your domain. -all at the end is mandatory (otherwise anyone can spoof your domain).
• DKIM (cryptographic signature): Each outgoing mail is signed with a private key, the public key sits in DNS at selector._domainkey.your-domain.com as TXT v=DKIM1. Receivers verify the signature and detect tampering.
• DMARC (policy + reporting): TXT under _dmarc.your-domain.com with v=DMARC1; p=reject; rua=mailto:dmarc@... DMARC combines SPF and DKIM, tells the receiver what to do with failed mail, and provides reports.

Our tool parses SPF, DKIM and DMARC inline and shows green, yellow or red badges so you immediately see whether the setup is clean or whether e.g. -all is missing, the DKIM key is too short, or DMARC is only in monitoring mode.

TTL and DNS caching

TTL (time to live) tells a resolver in seconds how long it may cache a DNS record. With TTL=3600 the resolver only re-queries the authoritative server after one hour. This saves bandwidth but makes DNS changes not immediately visible.

The right TTL depends on what you want. Stable production: high TTL (1 hour to 1 day). Upcoming server move: lower TTL to 60-300 seconds days in advance, then move, then raise again.

• Short TTL (60-300s): Quick changes but more load on the authoritative server and slightly higher lookup latency.
• Long TTL (3600-86400s): Less load, faster cache replies, but changes take hours to days to be visible worldwide.
• For migrations: Lower TTL to 60-300 seconds at least 24 hours before the move so all resolver caches expire just before the cutover.

What is DNSSEC and do I need it?

DNSSEC (DNS Security Extensions) signs DNS records cryptographically so a resolver can verify whether the answer was tampered with on the way. Without DNSSEC, a malicious ISP or public-WiFi resolver can return forged IPs (DNS spoofing).

DNSSEC uses two keys: ZSK (zone signing key) signs the records, KSK (key signing key) signs the ZSK. The KSK hash is published as a DS record at the registrar, closing the chain of trust up to the root.

Do you need it? For banks, public services, mail providers and anyone using SMIMEA, TLSA or OPENPGPKEY records (DANE): yes. For a normal webshop DNSSEC is a nice-to-have that costs nothing if your provider supports it. KernelHost DNS supports DNSSEC out of the box.

Common debugging use cases

What you actually need this tool for in everyday life:

• Mail does not arrive: Check MX records, then SPF, DKIM, DMARC. If any of the four is broken, mail ends up in spam or is rejected by the receiver.
• Domain points to wrong IP: Check A and AAAA records. Often during a server move only A records were updated and old AAAA records remain.
• Subdomain does not respond: Check the CNAME or direct A record on the subdomain. Common bug: the subdomain was created in the hosting panel but DNS still points nowhere.
• Check DNS propagation: After a change, run several lookups spaced in time. Once the TTL has expired, all resolvers should see the new records.
• Lets Encrypt refuses certificate: Check CAA records. If they only list another CA and Lets Encrypt is missing, Lets Encrypt refuses to issue.

DNS at KernelHost

KernelHost web hosting includes complete managed DNS: all records are managed via our control panel, DNSSEC is enabled by default, and geographically redundant anycast nameservers in Frankfurt and Vienna deliver fast responses worldwide.

If you only need DNS hosting without webspace, our domain service plans do the job. Domain registration, transfer and DNS management are included in every KernelHost hosting tier. For more complex setups (split horizon, geo DNS, high TTL precision) a VPS plus your own authoritative server is an option, and you can use this tool any time for diagnostics.

Frequently asked questions