An A record (address record) is the DNS record that gives a name its IPv4 address: its data is “a 32 bit Internet address” (RFC 1035 §3.4.1). To open www.example.com, a browser asks DNS for the A records of that name and connects to one of the addresses. The AAAA record does the same for IPv6: each one “stores a single IPv6 address” (RFC 3596 §2.1). A name can have A records, AAAA records or both.

This A record lookup asks for one type at exactly the name you enter: A, unless you choose AAAA. The question goes to our own recursive resolver, which runs on the same server as this site and asks the domain's name servers itself. If the name is an alias (a CNAME record), the resolver follows the alias and returns the addresses of the name at its end; the result shows the chain and whose addresses they are. The Raw evidence panel under every result keeps the DNS answer as it came.

The A records DNS returns are what the rest of the internet uses to reach the name, whatever your hosting panel says. That makes a lookup the way to check an A record: compare the address you expect with the one in the answer (see how to check an A record).

The domain and www are two names

example.com and www.example.com are separate names in DNS, each with its own records, so look up both. www can be an alias: on September 26, 2026, www.github.com was an alias for github.com, whose A record was 140.82.121.4. The domain itself, the top (apex) of its DNS zone, cannot be an alias: it must hold the zone's SOA and NS records, and a name with a CNAME may hold no other records (RFC 1034 §3.6.2, RFC 2181 §10.1). So the domain needs its own A records (and AAAA records if the server has an IPv6 address), or a DNS host's feature that answers with addresses for an alias at the apex, such as Cloudflare's CNAME flattening. The CNAME lookup explains aliases in depth.

The result opens with the verdict, a colored icon and a short label, together with the data that decided it: the first address and how many more (after an alias, also the name they belong to), the cause of a warning, or what the resolver answered instead. An A record lookup ends in one of three verdicts: Pass, Warning or Could not check. There is no Fail: the lookup reports what DNS publishes, and whether that is the address you meant is for you to compare.

Pass: A records found

The query came back with at least one A record (AAAA, if you chose it), it did not fail, and none of the warnings below applies. Pass does not say that the address is the right one, that it can be reached from the internet, or that a server answers there: we look up DNS only and connect to nothing. A private address such as 10.0.0.1 passes too, with a note under it (see below).

What the result shows

• The addresses, each with its TTL. Several addresses at one name are normal: “Hosts that have multiple Internet addresses will have multiple A records” (RFC 1035 §3.4.1), and a query always returns all records of one type at one name together (RFC 2181 §5.1). We list them in the order the resolver gave them; read nothing into it, because DNS does not guarantee an order (RFC 1794).
• The alias chain, when the name is an alias, for example www.github.com to github.com. The addresses then belong to the name at the end of the chain, and the table names it.
• The TTL, the number of seconds a resolver may keep the record before asking again (RFC 1035 §3.2.1 and §4.1.3). We show what is left at the resolver we asked, so it is often lower than the TTL set at your DNS host. After you change an address, resolvers that stored the old one can keep serving it until their copy runs out. This page also reuses a result for 60 seconds, except a Could not check result, which is never reused.
• A note under an address that is not public (see below), and a link to the same name's other type: AAAA from an A lookup, A from an AAAA lookup.

Addresses that are not public

Some addresses cannot be reached from the internet: the private ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, whose hosts “cannot have IP connectivity to any host outside of the enterprise” (RFC 1918 §3), the loopback range 127.0.0.0/8, documentation ranges such as 192.0.2.0/24, and IPv6 ranges such as ::1, fe80::/10 and 2001:db8::/32. IANA's special-purpose address registries mark all of them as not globally reachable. The result names the range under such an address. It is a note, not a warning: an internal name may point there on purpose. For a website or a server that people outside your network must reach, publish its public address, and keep private addresses in internal DNS: DNS clients outside your network “should not see addresses in the private address space” (RFC 1918 §5). IPv6 tunnel addresses (6to4 and Teredo) are shown as tunnels; the MX lookup explains why they are unreliable.

Warning: no A records found

The resolver answered, and the name has no A records (no AAAA records, if you chose AAAA). The result says which answer came back. NXDOMAIN means the name does not exist. NODATA (NOERROR with an empty answer) means no records of this type at this name; it does not prove that the name exists, because some DNSSEC-signed zones give this answer for names that do not exist (RFC 9824). The usual reasons:

• a typo, or the other name: records at www.example.com are not records at example.com;
• the name has only the other type. A name can have A records and no AAAA records: on September 26, 2026, the AAAA lookup of www.github.com led to github.com and found none there, while its A lookup found 140.82.121.4. The result links to the other type;
• the record was added at a DNS host the domain does not use; the nameserver lookup shows which one it uses;
• the name was doubled. Some dashboards add your domain to whatever you type in the name field, so a full name typed there ends up as www.example.com.example.com;
• the record is new, and the resolver still remembers the earlier “no record” answer (negative caching). The result shows how much longer the resolver we asked may keep it.

Warning: the alias leads to a name that does not exist

The name is an alias (CNAME), DNS follows it, and the name at the end of the chain does not exist. When an alias chain ends in an error, the error is about the last name of the chain, not the name you typed (RFC 6604 §3), so the fix belongs to whoever owns that last CNAME: point it at a name that exists, or delete it when the service it pointed to is gone. We can tell only from an NXDOMAIN answer: when the DNS host of the target answers NODATA for names that do not exist, the result shows the no-records warning above, with NODATA at the target, instead of this one. The DNS lookup explains dangling aliases in more depth.

Warning: a CNAME at the top of the zone

The name you looked up is the top (apex) of its zone, such as example.com itself, and it has a CNAME record. The addresses shown are those of the alias target, but the apex must also hold the zone's SOA and NS records, and a name with a CNAME may hold no other records (RFC 2181 §10.1). Some DNS servers then refuse the other records, MX and TXT included (RFC 1912 §2.4 describes BIND doing this). Replace the CNAME with A records (and AAAA records if the server has an IPv6 address), or use your DNS host's apex alias feature, such as Cloudflare's CNAME flattening. From an address lookup we recognize the top of a zone only when the name is a registered domain, such as example.com or example.co.uk; the CNAME lookup says more.

Could not check

The query got no usable answer: it timed out, the resolver reported a server failure (SERVFAIL), refused the query or returned another error code, the answer could not be decoded safely, or a network error stopped the query. That says nothing about whether the name has A records, and we never count it as a pass or a warning. SERVFAIL covers many errors (RFC 8914 §1). One of them is DNSSEC: a resolver that validates signatures answers SERVFAIL when they do not validate (RFC 4035 §5.5). Try again: a Could not check result is never reused. The DNS propagation checker asks several public resolvers, which shows whether the failure is everywhere.

Could not check: a fault on our side

Rarely, the result says the check could not be completed because of an internal error. That is a fault in our software, not a finding about your domain and not a network problem, so trying again will most likely give the same result. Please write to support@mxverdict.com with the address of the result page, and we will fix it.

The lookup shows what is published. To change it, edit the records at your DNS host:

1. Find your DNS host. It is the provider your NS records name, which is not always the company you bought the domain from. Records added anywhere else have no effect.
2. Get the address from whoever runs the server, usually your hosting provider's control panel: its IPv4 address for the A record, and its IPv6 address, if it has one, for an AAAA record.
3. Add or edit the record. Type A for an IPv4 address, AAAA for an IPv6 address. At Cloudflare, GoDaddy and Namecheap the name is entered without your domain: @ for the domain itself, www for www.example.com. Several addresses at one name are several records of the same type.
4. Remove what no longer applies. When a server moves, update or delete its old AAAA record too. Clients that have IPv6 prefer it (RFC 6724 §2.1), so a stale AAAA record can send them to the old server while IPv4 visitors reach the new one.
5. Mind the TTL before a planned change. Lower it in advance, as the DNS propagation checker describes step by step, then look the name up here again, both types, both the domain and www.

Filled in, the records look like this at all three hosts below (the name field is called Host at Namecheap; the addresses are documentation examples, so use your server's):

dig prints the same record as one line: the full name, the TTL, the class IN, the type and the address, as in the command-line example below.

Cloudflare

1. In the Cloudflare dashboard, open your domain and go to the DNS Records page.
2. Select Add record, or Edit on an existing record.
3. Choose the Type A (AAAA for IPv6). As Name, use @ for the domain itself or www; enter the server's address in the IPv4 (or IPv6) address field.
4. Set the Proxy status and the TTL, then select Save.

Proxied records answer with Cloudflare's addresses, not yours. In Cloudflare's words, a DNS query to a proxied record “will be answered with Cloudflare anycast IP addresses” instead of the address you entered, while for a DNS-only record “Cloudflare responds with your server's actual IP address”. So a lookup here of a proxied name shows Cloudflare's addresses, and that is expected: the address to compare with your server is the one in the dashboard. If one of several A or AAAA records at a name is proxied, Cloudflare treats all of them as proxied. Proxied records have the TTL Auto, 300 seconds, which cannot be edited; the DNS propagation checker lists the TTL choices for DNS-only records.

GoDaddy

1. Sign in to your GoDaddy Domain Portfolio and select the domain to open its Domain Settings.
2. Select DNS, then Add New Record and choose A (or AAAA) in the Type menu. To change an existing record, select Edit next to it.
3. In Name, enter @ for the root domain or a prefix such as blog, without the domain name. In Value, enter the IP address; Add another value adds more addresses to the same record. The TTL defaults to 1 hour.
4. Select Save, or Save All Records if you added several records at once.

GoDaddy's guide to editing an A record adds: “If you're trying to change your www record, you'll need to edit your CNAME record instead.” A lookup of www here shows whether it is an alias and where it leads. These records are used only while the domain uses GoDaddy's nameservers.

Namecheap

1. Sign in, open Domain List, and select Manage next to your domain.
2. Open the Advanced DNS tab and, under Host Records, select Add New Record.
3. Select A Record as the type (AAAA Record for IPv6) and enter the Host: @ for the domain itself, www, or only the subdomain part. Enter the IP address, and choose a TTL or leave it on Automatic; Namecheap's default TTL is 30 minutes.
4. Save it with the green Save changes icon.

Namecheap also advises removing conflicting records at the same host, which can be URL redirects (unmasked, masked or permanent), A or CNAME records: for example an A record with an address you no longer use. Several A records that each point to a server of yours are not a conflict. Host records there work only while the domain uses Namecheap BasicDNS, PremiumDNS or FreeDNS.

An A record check compares two addresses: the one your server has, and the one DNS gives out.

1. Find the address you expect: your hosting provider's control panel, or the settings of the server itself.
2. Enter the domain in the form above with the type on A, then www and any other name visitors use.
3. Compare. The same address means DNS points where you want. Another address means the record is wrong or old, or the resolver we asked still has an old copy (the TTL next to it says for how much longer). A name proxied through Cloudflare shows Cloudflare's addresses (see Cloudflare).
4. Switch the type to AAAA and compare with the server's IPv6 address. If the server has none, the name should have no AAAA records. A wrong AAAA record matters even when the A record is right: clients that have IPv6 try it first (RFC 8305 sorts addresses by RFC 6724, which prefers IPv6), so they may reach an old server, or lose time on an address that does not answer before they try IPv4; RFC 8305 §5 recommends 250 milliseconds as a default delay before the next attempt.
5. With several addresses, check each one: a client may use any of them, and DNS gives them in no fixed order.

Large services can give different resolvers different addresses, so compare your own server's address, not a big site's. On September 26, 2026, google.com had six A records at the resolver 1.1.1.1 and six at 8.8.8.8, but not the same six; three answers in a row from 8.8.8.8 listed its six addresses in three different orders. The DNS propagation checker shows what several public resolvers answer at once.

Every result has its own address that you can send to someone; opening it looks the name up again. The type is part of that address: /a-record-lookup/example.com is the A lookup of example.com, and /a-record-lookup/aaaa:example.com its AAAA lookup (the colon may appear as %3A).

On macOS and Linux, dig asks for one type per command, and +short prints only the addresses:

dig example.com A +short
dig example.com AAAA +short

On September 26, 2026 they printed:

104.20.23.154
172.66.147.243
2606:4700:10::ac42:93f3
2606:4700:10::6814:179a

Without +short, the answer section shows an alias chain, with the TTL of each record:

dig +noall +answer www.github.com A
www.github.com.		2333	IN	CNAME	github.com.
github.com.		54	IN	A	140.82.121.4

The dot at the end of a name is the root of DNS; this page leaves it out. For nslookup and PowerShell, see the DNS lookup.