DNS Lookup and WHOIS: How to Investigate Any Domain

Every time you type a domain name into your browser, a chain of lookups translates that human-readable name into an IP address that computers can route traffic to. This system is DNS, the Domain Name System, one of the foundational pieces of internet infrastructure.

Most people never think about DNS until something breaks. A website goes down, email stops arriving, or a newly registered domain does not resolve. That is when DNS lookup tools earn their place. They show you exactly what the DNS records say for any domain, which helps you diagnose problems, verify configurations, and trace how traffic flows.

A DNS Lookup tool queries DNS servers and returns the records tied to a domain: A records (IPv4 addresses), AAAA records (IPv6), MX records (mail servers), CNAME records (aliases), and TXT records (verification and policy). If you manage websites or email, these tools belong in your regular workflow.

Understanding DNS Record Types

DNS has over a dozen record types, but you will work with five of them in 95% of situations.

A Record: Maps a domain to an IPv4 address. When someone visits example.com, the A record tells the browser which server to connect to. Most domains have at least one A record. Some have multiple for load balancing or redundancy.

AAAA Record: Same as the A record but for IPv6 addresses. As IPv6 adoption continues, more domains are adding AAAA records alongside their A records.

CNAME Record: Creates an alias from one domain to another. If www.example.com has a CNAME pointing to example.com, both addresses reach the same server. CNAME records cannot coexist with other record types at the same name, which is a common source of configuration errors.

MX Record: Specifies which mail servers handle email for the domain. MX records have priority values (lower numbers = higher priority), so you can set up primary and backup mail servers. If your email is not working, incorrect MX records are one of the first things to check.

TXT Record: Holds arbitrary text data. Used for email authentication (SPF, DKIM, DMARC), domain verification (Google, Microsoft, SSL providers), and various other purposes. A single domain often has multiple TXT records for different services.

The DNS Lookup tool lets you query for any of these record types individually or see all records at once.

WHOIS: Finding Out Who Owns a Domain

WHOIS is a protocol for querying databases that store information about registered domain names. A WHOIS Lookup tells you who registered a domain, when it was registered, when it expires, and which registrar manages it.

The information available through WHOIS has become more limited since GDPR went into effect in 2018. Most registrars now redact personal contact details by default, replacing the registrant's name, email, and address with the registrar's privacy service. You will still see the registrar name, registration dates, expiration date, and name servers.

WHOIS lookups are useful in several scenarios:

Buying a domain: If the domain you want is already registered, WHOIS tells you when it expires. Some domains are parked and might not be renewed, making them available in the future.

Investigating suspicious sites: Checking when a domain was registered can tell you a lot. A website claiming to be an established company but registered last week is a red flag. Scam sites often use freshly registered domains.

Verifying business legitimacy: If someone claims to represent a company, checking the WHOIS data for their domain against their claimed identity adds a layer of verification.

Troubleshooting DNS: The WHOIS record shows which name servers are authoritative for the domain. If you are debugging DNS propagation issues, confirming the correct name servers are listed is step one.

Troubleshooting Common DNS Problems

When a website or email stops working, DNS is often the first suspect. Here are the most common DNS problems and how to diagnose them.

Domain not resolving at all: Run a DNS lookup. If there are no A records, the domain has no configured web destination. This happens when you register a domain but forget to add DNS records, or when you change name servers and the records were not migrated.

Website works but email does not: Check the MX records. If they are missing or pointing to the wrong mail server, email will bounce. Also verify SPF and DKIM TXT records, because missing authentication records cause emails to land in spam or be rejected entirely.

DNS changes not taking effect: DNS records have a TTL (Time To Live) value, measured in seconds, that tells resolvers how long to cache the record. If you changed an A record but the old IP still resolves, the old record is probably cached. Check the TTL value in the DNS lookup results. Some registrars set TTLs as high as 86400 seconds (24 hours), meaning changes can take a full day to propagate worldwide.

SSL certificate errors after domain transfer: When you move a domain to a new host, the SSL certificate needs to be reissued for the new server. DNS changes resolve before the new certificate is provisioned, causing a brief window where visitors see security warnings.

Subdomain not working: Verify that the subdomain has its own DNS records. Many people assume subdomains inherit the parent domain's records, but they do not. blog.example.com needs its own A record or CNAME record, separate from example.com.

IP Address Lookups and Geolocation

Once you know the IP address behind a domain (from the A record in a DNS lookup), an IP Address Lookup reveals additional information about the server.

IP geolocation shows you the approximate physical location of the server. This is useful for verifying that a website is hosted where you expect it to be. If a supposedly European company's website resolves to a server in a country known for hosting scam operations, that is worth investigating.

IP lookups also show the hosting provider or ISP that owns the IP address range. For competitive research, this tells you whether a competitor is using AWS, Google Cloud, Cloudflare, or a specific hosting company. For troubleshooting, knowing the hosting provider helps you contact the right support team.

Reverse DNS lookups translate an IP address back to a hostname. This is useful for verifying that a server's identity matches its claimed domain, and it is commonly used in email authentication to prevent spoofing.

Keep in mind that IP geolocation is approximate, typically accurate to the city level but not the street address. CDN providers like Cloudflare also complicate geolocation because the IP might belong to a Cloudflare data center rather than the origin server.

DNS for Email Authentication: SPF, DKIM, and DMARC

Email authentication relies heavily on DNS TXT records. Three protocols work together to prevent email spoofing and improve deliverability.

SPF (Sender Policy Framework): A TXT record that lists which servers are authorized to send email on behalf of your domain. When a receiving server gets an email claiming to be from your domain, it checks the SPF record to see if the sending server is on the approved list. If not, the email is flagged as potentially spoofed.

A basic SPF record looks like: v=spf1 include:_spf.google.com ~all

This says: accept email from Google's mail servers, and soft-fail everything else.

DKIM (DomainKeys Identified Mail): Uses a public/private key pair. Your mail server signs outgoing emails with the private key, and the public key is published as a DNS TXT record. Receiving servers use the public key to verify the signature, confirming the email was not tampered with in transit.

DMARC (Domain-based Message Authentication, Reporting, and Conformance): Ties SPF and DKIM together with a policy that tells receiving servers what to do when authentication fails: do nothing, quarantine the email, or reject it outright. DMARC also provides reporting, sending you data about who is trying to send email as your domain.

Use a DNS lookup to verify all three are correctly configured. Missing or misconfigured authentication records are the number one reason legitimate emails end up in spam folders.

Security Considerations When Using DNS Tools

DNS tools are publicly accessible because DNS itself is a public system. Anyone can look up the DNS records for any domain. This is by design. The internet depends on open DNS resolution to function.

However, there are a few security considerations to keep in mind.

DNS lookup data is not secret: Do not put sensitive information in DNS records. Anything in a TXT record is visible to anyone who queries it. Some organizations accidentally expose internal infrastructure details through overly descriptive DNS records.

WHOIS privacy matters: If you register a domain with your personal contact information and without privacy protection, your name, address, email, and phone number are publicly queryable. Always enable WHOIS privacy protection through your registrar.

DNS can be spoofed: DNS cache poisoning attacks redirect traffic to malicious servers by feeding fake records to DNS resolvers. DNSSEC (DNS Security Extensions) protects against this, but adoption is still not universal. Check whether your domain has DNSSEC enabled using a DNS lookup tool.

Reconnaissance tool: DNS and WHOIS lookups are standard tools in both legitimate security research and malicious reconnaissance. If you run these tools against a domain you do not own, be aware that some organizations monitor for unusual query patterns.

FAQ

How long does DNS propagation take?

DNS propagation depends on the TTL (Time To Live) of the old record. If the TTL was set to 3600 seconds (1 hour), most resolvers will have the new record within an hour. If the TTL was 86400 seconds (24 hours), it can take up to a day. To speed up future changes, lower the TTL to 300 seconds (5 minutes) a day before making the actual change.

Can I find the real IP address behind Cloudflare?

Cloudflare hides the origin server's IP by proxying traffic through its own network. The IP shown in a DNS lookup is Cloudflare's, not the origin server's. Finding the real IP requires other techniques (checking historical DNS records, looking for exposed subdomains, or finding the IP in email headers). This is by design.

What does it mean when a domain has no DNS records?

Either the domain is not registered, the name servers are not configured, or the DNS zone file has no records. Check WHOIS first to confirm the domain is registered. If it is, the issue is likely that the DNS zone has not been set up at the registrar or hosting provider.

Can WHOIS tell me the physical location of a website's server?

WHOIS shows the registrant's information (often redacted for privacy) and the registrar's location, but not the server location. For server location, use an IP address lookup tool with the IP from the DNS A record.

Is it legal to perform DNS and WHOIS lookups on domains I do not own?

Yes. DNS and WHOIS are public protocols designed for open access. Querying them is legal and standard practice for developers, security researchers, and system administrators. The information is intentionally public.