Google Public DNS
App · Utilities · 8 actions
Look up the public records behind any domain, using Google Public DNS - the resolver at 8.8.8.8 that answers for much of the internet. Find the servers a domain points at, who handles its email, who runs its DNS, and whether a name is an alias for somewhere else. Read the notes published on a domain to catch the moment a customer adds the verification record you asked them for. Check whether a domain is protected against people sending email that looks like it came from it, and get the answer as a sentence rather than a pile of records. Turn an IP address back into a name. Free, instant, and no account or API key required.
Actions
| Action | What it does |
|---|---|
| Check a domain's email security | Find out whether a domain is set up to stop other people sending email that appears to come from it. |
| Find a domain's alias | Find out whether a name is a signpost to somewhere else, and where it points. |
| Find a domain's IP addresses | Find the servers a domain points at - the addresses a browser would connect to. |
| Find a domain's mail servers | Find out who handles a domain's email, and whether it can receive any at all. |
| Find a domain's name servers | Find out who runs a domain's DNS - the servers that answer every question about it. |
| Find a domain's text records | Read the notes a domain's owner has published on it. |
| Find the host name for an IP address | Turn an IP address back into a name. |
| Look up any DNS record | Read any kind of DNS record, for the questions the other steps do not cover: which authorities may issue certificates for a domain, where a service lives, when its records were last changed. |
Check a domain's email security
Find out whether a domain is set up to stop other people sending email that appears to come from it. Three records have to agree for that to work, and this reads all three and says what they add up to in a sentence, with a list of anything missing. Use it to audit your own domains, to check a client's before taking on their email, or to score a prospect's security posture.
Inputs
- Domain or email address
domaintextRequired - The domain to check, such as example.com. Paste a whole email address and the domain is taken out of it.
- DKIM selector
dkim_selectortext - A domain's signing keys are filed under short names, and there is no way to list them, so checking one means naming it. Your email provider's setup page gives it - 'google' for Google Workspace, 'selector1' for Microsoft 365, 'k1' for Mailchimp. Leave it empty to check the other two records only.
Outputs
dkimobject- The signing key published under the selector you named, if you named one.
dmarcobject- What the domain asks inboxes to do with email that fails the checks.
dnssec_validatedtrue/false- True when the answer was signed by the domain's owner and the signature checked out, so it is proof against tampering. Most domains are not signed, so False is normal and does not mean anything is wrong.
domaintext- The domain that was looked up, as it was sent: trimmed down from a link or an email address, and in plain letters.
domain_existstrue/false- True when the domain is registered and its name servers answered. False means no such domain, which is an answer rather than an error - the step still succeeds so a workflow can branch on it.
issue_countnumber- How many issues were found.
issueslist- What is missing or misconfigured, one plain sentence each. Empty when nothing is.
protected_from_spoofingtrue/false- True only when both halves are in force: the domain names the servers allowed to send as it, and it tells inboxes to reject or quarantine anything else. A domain that publishes the records but asks for nothing to be done is False, because nothing is being blocked.
spfobject- Which servers are allowed to send email as this domain.
summarytext- The whole answer in one sentence, ready to put in a message or a ticket.
Example output
{
"dkim": {
"checked": false,
"found": false,
"key_type": "",
"record": "",
"selector": ""
},
"dmarc": {
"aggregate_report_addresses": [
"mailauth-reports@google.com"
],
"forensic_report_addresses": [],
"found": true,
"percentage": 100,
"policy": "Reject",
"record": "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com",
"subdomain_policy": "Reject"
},
"dnssec_validated": false,
"domain": "google.com",
"domain_exists": true,
"issue_count": 0,
"issues": [],
"protected_from_spoofing": true,
"spf": {
"found": true,
"includes": [
"_spf.google.com"
],
"policy": "Mark as spam",
"record": "v=spf1 include:_spf.google.com ~all",
"record_count": 1
},
"summary": "google.com is protected: SPF says to treat mail from any other server as spam, and DMARC tells inboxes to reject anything that fails."
}Find a domain's alias
Find out whether a name is a signpost to somewhere else, and where it points. This is the check behind every 'point your domain at us' onboarding step: a customer is told to send support.their-company.com to your service, and this is how a workflow knows whether they have done it and finishes setting them up on its own.
Inputs
- Domain
domaintextRequired - The name to check, such as support.example.com. A full web address or an email address works too - the domain is taken out of it.
Outputs
alias_chainlist- If this name is an alias, the names it points through, in order. Empty when it is not an alias.
alias_targettext- The name it points at. Empty when it is not an alias.
dnssec_validatedtrue/false- True when the answer was signed by the domain's owner and the signature checked out, so it is proof against tampering. Most domains are not signed, so False is normal and does not mean anything is wrong.
domaintext- The domain that was looked up, as it was sent: trimmed down from a link or an email address, and in plain letters.
domain_existstrue/false- True when the domain is registered and its name servers answered. False means no such domain, which is an answer rather than an error - the step still succeeds so a workflow can branch on it.
final_nametext- Where the signposts end up. The same as the domain you asked about when it is not an alias, so this field always names something.
is_aliastrue/false- True when this name is a signpost to another one. False when it stands on its own, which is what a top-level domain like example.com normally does.
ttl_secondsnumber- How many seconds this answer stays cached before it is looked up again. This is how long a change to these records can take to show up here. Empty when there were no records.
Example output
{
"alias_chain": [
"dyna.wikimedia.org"
],
"alias_target": "dyna.wikimedia.org",
"dnssec_validated": false,
"domain": "www.wikipedia.org",
"domain_exists": true,
"final_name": "dyna.wikimedia.org",
"is_alias": true,
"ttl_seconds": 5779
}Find a domain's IP addresses
Find the servers a domain points at - the addresses a browser would connect to. Use it to check a site is pointed where you expect after a move, to confirm a customer's domain has gone live, or to find out whether a domain exists at all. Both modern and older address types are looked up together.
Inputs
- Domain
domaintextRequired - The domain to look up, such as example.com. A full web address or an email address works too - the domain is taken out of it, www and all, because www.example.com and example.com can point to different places.
Outputs
address_countnumber- How many addresses there are in total.
alias_chainlist- If this name is an alias, the names it points through, in order. Empty when it is not an alias.
dnssec_validatedtrue/false- True when the answer was signed by the domain's owner and the signature checked out, so it is proof against tampering. Most domains are not signed, so False is normal and does not mean anything is wrong.
domaintext- The domain that was looked up, as it was sent: trimmed down from a link or an email address, and in plain letters.
domain_existstrue/false- True when the domain is registered and its name servers answered. False means no such domain, which is an answer rather than an error - the step still succeeds so a workflow can branch on it.
foundtrue/false- True when the domain has at least one IP address. A domain can exist and still have none, which is normal for one that only handles email.
ip_addresseslist- Every address the domain points at, modern and older together.
ipv4_addresseslist- Just the older-style addresses, like 93.184.216.34. These are the ones almost everything still uses.
ipv6_addresseslist- Just the modern addresses, like 2606:2800:220:1::. Empty for the many domains that do not use them yet.
ttl_secondsnumber- How many seconds this answer stays cached before it is looked up again. This is how long a change to these records can take to show up here. Empty when there were no records.
Example output
{
"address_count": 1,
"alias_chain": [
"github.com"
],
"dnssec_validated": false,
"domain": "www.github.com",
"domain_exists": true,
"found": true,
"ip_addresses": [
"140.82.112.3"
],
"ipv4_addresses": [
"140.82.112.3"
],
"ipv6_addresses": [],
"ttl_seconds": 60
}Find a domain's mail servers
Find out who handles a domain's email, and whether it can receive any at all. The servers come back in the order mail is offered to them, so the first one is the one that normally takes it. Use it to check an address is worth sending to before a campaign, to see which provider a company's mail runs through, or to confirm a mail migration has finished.
Inputs
- Domain or email address
domaintextRequired - The domain whose mail servers you want, such as example.com. Paste a whole email address and the domain is taken out of it.
Outputs
accepts_emailtrue/false- True when the domain can receive email. That usually means the mail servers listed below, but a domain with no mail servers and a website can still receive mail, and that counts too. False means mail to this domain will bounce.
dnssec_validatedtrue/false- True when the answer was signed by the domain's owner and the signature checked out, so it is proof against tampering. Most domains are not signed, so False is normal and does not mean anything is wrong.
domaintext- The domain that was looked up, as it was sent: trimmed down from a link or an email address, and in plain letters.
domain_existstrue/false- True when the domain is registered and its name servers answered. False means no such domain, which is an answer rather than an error - the step still succeeds so a workflow can branch on it.
foundtrue/false- True when the domain lists mail servers of its own.
mail_server_countnumber- How many mail servers there are.
mail_serverslist- The mail servers, best first. Only the servers the domain actually lists appear here.
primary_mail_servertext- The server mail is offered to first, lifted to the top. Empty when the domain lists none.
ttl_secondsnumber- How many seconds this answer stays cached before it is looked up again. This is how long a change to these records can take to show up here. Empty when there were no records.
Example output
{
"accepts_email": true,
"dnssec_validated": false,
"domain": "gmail.com",
"domain_exists": true,
"found": true,
"mail_server_count": 3,
"mail_servers": [
{
"host": "gmail-smtp-in.l.google.com",
"priority": 5
},
{
"host": "alt1.gmail-smtp-in.l.google.com",
"priority": 10
},
{
"host": "alt2.gmail-smtp-in.l.google.com",
"priority": 20
}
],
"primary_mail_server": "gmail-smtp-in.l.google.com",
"ttl_seconds": 2597
}Find a domain's name servers
Find out who runs a domain's DNS - the servers that answer every question about it. The names give away the provider, so this is how you tell that a domain is on Cloudflare, or Route 53, or still with the registrar. Use it to confirm a domain transfer has taken effect, or to check a customer has pointed their domain at you before you go looking for the records.
Inputs
- Domain
domaintextRequired - The domain to look up, such as example.com. A full web address or an email address works too - the domain is taken out of it.
Outputs
dnssec_validatedtrue/false- True when the answer was signed by the domain's owner and the signature checked out, so it is proof against tampering. Most domains are not signed, so False is normal and does not mean anything is wrong.
domaintext- The domain that was looked up, as it was sent: trimmed down from a link or an email address, and in plain letters.
domain_existstrue/false- True when the domain is registered and its name servers answered. False means no such domain, which is an answer rather than an error - the step still succeeds so a workflow can branch on it.
foundtrue/false- True when the domain lists name servers of its own. A subdomain usually does not - its parent answers for it.
name_server_countnumber- How many name servers there are.
name_serverslist- The name servers, in alphabetical order. They are equals, so there is no first among them.
ttl_secondsnumber- How many seconds this answer stays cached before it is looked up again. This is how long a change to these records can take to show up here. Empty when there were no records.
Example output
{
"dnssec_validated": true,
"domain": "example.com",
"domain_exists": true,
"found": true,
"name_server_count": 2,
"name_servers": [
"elliott.ns.cloudflare.com",
"hera.ns.cloudflare.com"
],
"ttl_seconds": 21600
}Find a domain's text records
Read the notes a domain's owner has published on it. This is where verification codes live: when a service asks a customer to 'add this record to prove you own the domain', this is where it lands. Give it the code you are waiting for and the step tells you whether it has appeared yet, so a workflow can check every hour and carry on the moment it does.
Inputs
- Domain
domaintextRequired - The domain to read, such as example.com. A full web address or an email address works too - the domain is taken out of it.
- Text to look for
containstext - Waiting for a particular record to appear? Put part of it here - a verification code, or something as short as 'v=spf1' - and the step reports whether any record contains it. Leave it empty to just get every record back.
Outputs
dnssec_validatedtrue/false- True when the answer was signed by the domain's owner and the signature checked out, so it is proof against tampering. Most domains are not signed, so False is normal and does not mean anything is wrong.
domaintext- The domain that was looked up, as it was sent: trimmed down from a link or an email address, and in plain letters.
domain_existstrue/false- True when the domain is registered and its name servers answered. False means no such domain, which is an answer rather than an error - the step still succeeds so a workflow can branch on it.
foundtrue/false- True when the domain has at least one text record.
match_foundtrue/false- True when a record contains the text you asked about. False when none does, and also when you did not ask about any - check 'searched_for' to tell those apart.
matching_recordslist- The records that contain the text you asked about. Empty when the field was left blank.
record_countnumber- How many text records there are.
searched_fortext- The text that was looked for, echoed back. Empty when the field was left blank.
text_recordslist- Every text record on the domain. A record too long to store in one piece is joined back up first, so what you read here is what was written.
ttl_secondsnumber- How many seconds this answer stays cached before it is looked up again. This is how long a change to these records can take to show up here. Empty when there were no records.
Example output
{
"dnssec_validated": true,
"domain": "example.com",
"domain_exists": true,
"found": true,
"match_found": true,
"matching_records": [
"google-site-verification=4ibFUgB-wXLQ_S7vsXVomSTVamuOXBiVAzpR"
],
"record_count": 2,
"searched_for": "google-site-verification",
"text_records": [
"v=spf1 include:_spf.google.com ~all",
"google-site-verification=4ibFUgB-wXLQ_S7vsXVomSTVamuOXBiVAzpR"
],
"ttl_seconds": 300
}Find the host name for an IP address
Turn an IP address back into a name. A visitor's address on its own says nothing; its name often says who they are - a company, a cloud provider, a home connection. Use it to put a name on an address in a log, or to check that a server you run is named the way your mail provider expects. Works for both address styles.
Inputs
- IP address
ip_addresstextRequired - The address to look up, such as 8.8.8.8 or 2001:4860:4860::8888.
Outputs
dnssec_validatedtrue/false- True when the answer was signed by the domain's owner and the signature checked out, so it is proof against tampering. Most domains are not signed, so False is normal and does not mean anything is wrong.
foundtrue/false- True when the address has a name. Plenty do not - naming an address is optional and its owner has to set it up.
host_nametext- The name, lifted to the top. Empty when there is none.
host_name_countnumber- How many names there are.
host_nameslist- Every name for the address. Usually one, occasionally several.
ip_addresstext- The address that was looked up, in its standard written form.
ttl_secondsnumber- How many seconds this answer stays cached before it is looked up again. This is how long a change to these records can take to show up here. Empty when there were no records.
Example output
{
"dnssec_validated": false,
"found": true,
"host_name": "dns.google",
"host_name_count": 1,
"host_names": [
"dns.google"
],
"ip_address": "8.8.8.8",
"ttl_seconds": 20035
}Look up any DNS record
Read any kind of DNS record, for the questions the other steps do not cover: which authorities may issue certificates for a domain, where a service lives, when its records were last changed. Pick the kind of record from the list and the values come back as they were published.
Inputs
- Domain
domaintextRequired - The name to look up, such as example.com. A full web address or an email address works too - the domain is taken out of it.
- Record type
record_typetextRequired - What kind of record to read. Not sure? Addresses, mail servers, text records, name servers and aliases each have a step of their own that does not ask.One of:
A(A (IPv4 address)),AAAA(AAAA (IPv6 address)),CNAME(CNAME (alias)),MX(MX (mail servers)),TXT(TXT (text records)),NS(NS (name servers)),SOA(SOA (zone details)),PTR(PTR (name for an address)),CAA(CAA (who may issue certificates)),SRV(SRV (service location)), and 7 more. Default:A.
Outputs
alias_chainlist- If this name is an alias, the names it points through, in order. Empty when it is not an alias.
dnssec_validatedtrue/false- True when the answer was signed by the domain's owner and the signature checked out, so it is proof against tampering. Most domains are not signed, so False is normal and does not mean anything is wrong.
domaintext- The domain that was looked up, as it was sent: trimmed down from a link or an email address, and in plain letters.
domain_existstrue/false- True when the domain is registered and its name servers answered. False means no such domain, which is an answer rather than an error - the step still succeeds so a workflow can branch on it.
foundtrue/false- True when the domain has at least one record of this kind.
record_countnumber- How many records there are.
record_typetext- The kind of record that was read.
recordslist- The records themselves.
ttl_secondsnumber- How many seconds this answer stays cached before it is looked up again. This is how long a change to these records can take to show up here. Empty when there were no records.
valueslist- Just the values, for reading or comparing without reaching into each record.
Example output
{
"alias_chain": [],
"dnssec_validated": false,
"domain": "google.com",
"domain_exists": true,
"found": true,
"record_count": 1,
"record_type": "CAA",
"records": [
{
"name": "google.com",
"ttl_seconds": 18292,
"value": "0 issue \"pki.goog\""
}
],
"ttl_seconds": 18292,
"values": [
"0 issue \"pki.goog\""
]
}