How long does a DNS change take to propagate?

As long as the previous record's TTL, plus resolver behaviour. There is no global push: each resolver refreshes when its cached copy expires, so a 3600-second TTL means up to an hour for most users and longer for resolvers that extend TTLs.

Why does my record show here but not on my machine?

Your operating system, browser and local resolver each keep their own cache. Flush the OS cache and query again; if the value here is correct, the change published and the rest is caching.

What is the difference between A, CNAME and ALIAS?

A maps a name directly to an IPv4 address. CNAME aliases a name to another name and cannot coexist with other records, which forbids it at the zone apex. ALIAS/ANAME is a provider-side flattening that returns the target's A record and is therefore legal at the apex.

Can I look up an internal or private domain?

No. Queries go to a public resolver, which has no visibility into private zones, VPN-only namespaces or split-horizon views. Use dig against your internal resolver for those.

Network & DNS🌐 YAS server-sideAPI availableintermediate

DNS Lookup

Queries DNS records (A, AAAA, MX, TXT, NS, CNAME, SOA) for any domain.

Processed by YAS · not stored

Ready to runInstant execution

All tools →

Result

—

What does this tool do?

Queries DNS records (A, AAAA, MX, TXT, NS, CNAME, SOA) for any domain.

Why would I use it?

You moved hosting and want to confirm DNS propagated.
You are troubleshooting why a domain does not resolve.
You want to inspect SPF/DMARC TXT records.

Real-life example

Input

example.com

Output

A 93.184.216.34 · AAAA 2606:2800:... · MX 0 . · NS a.iana-servers.net · TXT v=spf1 -all

Each record type is listed with its value.

Input → Process → Output → Next

Input: Enter a domain (no https://).
Process: YAS queries public DNS for each record type.
Output: A table of records by type.
Next action: Compare against expected records; check propagation across resolvers.

Common mistakes

Including https:// (enter the bare domain).
Expecting instant propagation — TTLs delay changes.
Forgetting subdomains like _dmarc.example.com need full names.

What the result means

Records show how the domain is configured globally.

Privacy & security

Your input is sent to YAS infrastructure because the tool requires server-side processing or public network queries. Input is not stored.

API

Endpoint

POST https://yas.sh/api/v1/tools/dns-lookup

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/dns-lookup" \
  -H "Content-Type: application/json" \
  -d '{"input":"yas.sh"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/dns-lookup", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "input": "yas.sh"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/dns-lookup", json={"input":"yas.sh"})
data = r.json()

Field	Type	Required	Description
input	string	Yes	Domain, e.g. example.com (no scheme, no IP literals)
type	string	No (default "all")	all \| A \| AAAA \| MX \| TXT \| NS \| CNAME \| SOA

Success response

{ "result": { "domain": "yas.sh", "A": [{ "address": "93.184.216.34", "ttl": 300 }], "MX": [{ "priority": 10, "exchange": "mx1.example.com" }], ... } }

Resolve A, AAAA, MX, TXT, NS, CNAME, SOA records for a domain (TTLs included).

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How DNS Lookup works

A lookup asks a resolver for a specific record type at a specific name. The query travels from a recursive resolver to the root servers, to the TLD servers for the zone, and finally to the domain's authoritative nameservers, which return the answer with a TTL. This tool queries over DNS-over-HTTPS, so the result reflects what a modern client resolver sees rather than what your local network's resolver has cached.

Record types answer different questions. A and AAAA map a name to IPv4 and IPv6 addresses; CNAME aliases one name to another (and may not coexist with other records at the same name); MX lists mail exchangers with priorities; TXT carries free-form strings used by SPF, DKIM, DMARC and domain-verification tokens; NS delegates a zone; SOA holds the zone's serial and timing parameters.

The TTL is the contract for caching. Until it expires, resolvers worldwide may serve the previous answer regardless of what your authoritative zone now says. This is why a record change appears instantly here and not for a colleague — and why you lower the TTL before a planned migration, not during it.

When to use it: real-world scenarios

Verifying a DNS change actually published

After editing a zone, query the record directly. If the authoritative answer is correct but users still see the old value, you are waiting out a TTL, not debugging a broken change.

Diagnosing mail delivery failures

Check MX, then the SPF TXT record, then DMARC at _dmarc.<domain>. A missing MX means nothing can be delivered; a broken SPF record means mail is delivered and then rejected. The MX Health and SPF Inspector tools evaluate the policy semantics.

Confirming domain ownership for a third-party service

Verification usually requires a TXT record at the apex or a subdomain. Querying it shows whether the record published, whether the provider silently appended the domain to the host field, and whether quoting split it into two strings.

Investigating a subdomain takeover risk

A CNAME pointing at a deprovisioned cloud resource can be claimed by anyone. Resolve the CNAME chain, then run the Dangling CNAME Checker for the vulnerability classification.

Pro tips

Lower the TTL to 300 seconds at least 24–48 hours before a migration, then raise it afterwards. Lowering it at cutover has no effect on records already cached at the old value.
A CNAME cannot exist alongside any other record at the same name, which is why an apex CNAME is invalid; use ALIAS/ANAME or a provider flattening feature.
TXT strings are limited to 255 characters each. Long DKIM keys are split into multiple quoted strings that resolvers concatenate — a record that looks broken here may simply be displayed unjoined.
Negative answers are cached too. The SOA minimum field sets how long NXDOMAIN is remembered, so a record created after a failed lookup can stay invisible for that period.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

Results come from a public resolver, so split-horizon DNS and internal-only zones will not resolve, and geo-steered records may return the answer for the resolver's location rather than yours.
The tool reads DNS; it does not validate DNSSEC chains. Use the DNSSEC Check tool for signature and chain-of-trust verification.
Answers may be served from cache. To confirm the authoritative value you must query the domain's own nameservers, which is what a dig +trace does.
Rate limits apply to the public resolver, so rapid bulk lookups may be throttled.

Frequently asked questions

How long does a DNS change take to propagate?: As long as the previous record's TTL, plus resolver behaviour. There is no global push: each resolver refreshes when its cached copy expires, so a 3600-second TTL means up to an hour for most users and longer for resolvers that extend TTLs.
Why does my record show here but not on my machine?: Your operating system, browser and local resolver each keep their own cache. Flush the OS cache and query again; if the value here is correct, the change published and the rest is caching.
What is the difference between A, CNAME and ALIAS?: A maps a name directly to an IPv4 address. CNAME aliases a name to another name and cannot coexist with other records, which forbids it at the zone apex. ALIAS/ANAME is a provider-side flattening that returns the target's A record and is therefore legal at the apex.
Can I look up an internal or private domain?: No. Queries go to a public resolver, which has no visibility into private zones, VPN-only namespaces or split-horizon views. Use dig against your internal resolver for those.