DNS / MX Lookup

DNS / MX Lookup queries DNS servers for a domain’s records — from A and AAAA addresses through NS, SOA and TXT. The MX mode produces a full email report: the servers receiving mail, the SPF and DMARC configuration and the detected mailbox provider, with tests in the style of MX Toolbox.

What are DNS records?

DNS is the internet’s address book: it translates domain names into IP addresses and stores instructions for the services tied to a domain. Each such instruction is a DNS record of a specific type, kept in the domain’s DNS zone on its name servers. When you type an address into your browser, a resolver walks the DNS servers asking for the A record — and when you send an email, the sender’s server looks up the recipient’s MX records.

Records also carry a TTL (time to live) parameter, which says how long a response may be cached. That’s why DNS changes aren’t visible instantly — DNS propagation takes anywhere from minutes to a day, depending on the TTL of the old entries.

How to use the tool

1. Enter a domain — e.g. sycope.com, without https:// or slashes.
2. Pick a record type — MX, A, AAAA, TXT, NS, SOA, CNAME, SPF or DMARC.
3. Click ‘Check’ — the results appear in a table with each record’s values and TTL.

For the MX type, the tool doesn’t stop at the list of mail servers: it also checks the SPF, DMARC and BIMI records, identifies the email provider (e.g. Microsoft 365, Google Workspace) and runs a series of configuration tests with verdicts — from whether the records are published at all to how strict the DMARC policy is.

Record types at a glance

• A / AAAA — map a name to an IPv4 (A) or IPv6 (AAAA) address; the foundation every website stands on.
• CNAME — an alias pointing to another name, common for subdomains like www and for SaaS services attached to your own domain.
• MX — designate the servers that receive mail for the domain, with priorities setting the order of delivery attempts.
• TXT — arbitrary text attached to the domain; in practice the carrier for SPF, DMARC, domain ownership verification and DKIM keys.
• NS — the name servers hosting the domain’s DNS zone; they’re the ones asked about all the other records.
• SOA — the zone’s metadata: primary server, administrator email, serial number and refresh timers — handy when diagnosing propagation.

The email records layered on top of TXT form a family of their own: SPF lists the servers authorised to send mail on the domain’s behalf, DKIM signs messages cryptographically, and DMARC ties the two together with a policy telling recipients what to do with messages that fail verification (none — just report, quarantine — send to spam, reject — refuse outright).

Why check DNS and email configuration?

The most common scenarios are diagnostics after changes — is the new hosting visible yet, does the CNAME point to the right target, are stale records still lingering in caches — and email deliverability problems. When mail from a domain lands in spam, the cause is almost always a missing or broken SPF, DKIM or DMARC record: without them, anyone can impersonate your domain, so filters treat it with suspicion.

The MX report shows the whole picture: whether the records exist, whether SPF ends with a strict qualifier, whether the DMARC policy actually protects anything (a bare p=none is monitoring only), and even whether the domain is ready for BIMI — displaying your brand logo next to messages in recipients’ inboxes. A complete, strict configuration is now the price of admission to Gmail and Microsoft inboxes. On the security side, DNS is also a well-known channel for attacks and data exfiltration — which is why network monitoring systems such as Sycope analyse DNS traffic for anomalies, tunnelling and queries to malicious domains.

Frequently asked questions (FAQ)

What does the priority on an MX record mean?

The order of delivery attempts: the server with the lowest number is tried first, and the rest act as backups. Several records sharing the same priority means traffic is spread evenly between them.

Why don’t DNS changes take effect immediately?

DNS responses are cached according to their TTL — resolvers along the way keep serving the old value until it expires. Before a planned migration, lower the TTL in advance; afterwards, be patient and let propagation finish.

What’s the difference between SPF and DMARC?

SPF says which servers may send mail on the domain’s behalf. DMARC builds a policy on top of SPF and DKIM: it instructs receiving servers what to do with a message that fails verification, and where to send reports. Full protection requires both (plus DKIM).

What does p=none in a DMARC record mean?

Monitoring-only mode: recipients report verification results but don’t block impersonating messages. It’s a fine starting point, but the policy should eventually move to quarantine or reject — only then does DMARC actually protect the domain.

Can I have two SPF records?

No — the standard allows exactly one SPF record per domain; two cause a verification failure. Additional providers are appended with the include: mechanism inside that single record, while keeping to the limit of 10 DNS lookups.

What is BIMI?

Brand Indicators for Message Identification — a standard that lets mailbox providers (including Gmail) display a verified brand logo next to messages. It requires a DMARC policy at quarantine or reject level and a published BIMI record pointing to the logo in SVG format.

Where do I edit DNS records?

In the control panel of whoever runs the domain’s name servers — usually the domain registrar or hosting provider, or the Cloudflare dashboard if you use Cloudflare. You can find out who hosts the zone with this very tool, using the NS record type.