One query · every record
Look up a domain’s A, AAAA, CNAME, HTTPS, MX, CAA, TXT, NS and SOA records in one go, read the TTLs or the raw dig-style response, then compare what five public resolvers answer.
DNS Prism builds each DNS query in your browser, encodes it in the DNS wire format and sends it with DNS-over-HTTPS (RFC 8484) straight to the resolver you pick. There is no DNS Prism server in between, so the answer you see is exactly what that resolver returned, including the TTL, the response code and the AD flag it sets when DNSSEC validation succeeded.
Compare resolvers asks all five resolvers for every record type and highlights any record set that differs. Keep in mind what that comparison means: each resolver answers from its own cache, and four of them (all but dnsforge.de, which runs in Germany) from the anycast site closest to you, so it shows whether those caches agree after a change. It is not a test from different countries. Remaining TTLs almost always differ, because they count down while an answer is cached.
Changed MX, SPF or DKIM records? Send a message from your domain to a free disposable inbox and watch it arrive, without touching your own mailbox. No sign-up, a choice of hundreds of domains, and messages are deleted automatically after 3 days.
Temp Mail API for automated delivery tests (opens in a new tab)
Open a temporary inbox (opens in a new tab)Open your site in a disposable cloud browser (Chrome, Firefox, Edge, Brave or Chromium on an isolated Linux desktop that is deleted after each session) to check it away from your own device and caches. Free daily time, nothing to install.
IP lookup (opens in a new tab)Website audit (opens in a new tab)All free tools (opens in a new tab)
Try the cloud browser (opens in a new tab)Cloudflare (1.1.1.1), Google Public DNS (8.8.8.8), dnsforge.de (a filtering resolver in Germany), DNS.SB and the free unfiltered endpoint of Control D. Your browser queries them directly over DNS-over-HTTPS; DNS Prism has no server of its own in between.
No. Cloudflare, Google, DNS.SB and Control D answer from their anycast site closest to you, and dnsforge.de from its servers in Germany. The comparison shows whether those resolvers’ caches agree, not what someone in another country gets.
A TTL counts down while an answer sits in a cache. A resolver that fetched the record a minute ago shows the original TTL minus a minute; one that just asked the authoritative nameserver shows the full value. Different TTLs are normal; different records are what matter.
AD (authenticated data) means the resolver checked the answer’s DNSSEC signatures and they were valid. Unsigned domains never get it. The DNSSEC checker shows the keys and signatures behind the flag.
Its default service blocks ads, trackers and malware using public blocklists, so for blocked domains it does not return the real records. If only dnsforge.de differs while the other resolvers agree, the domain is probably on one of those lists.