--- title: Free A Record Lookup description: Find the IPv4 address a domain resolves to — every A record, from the resolver of your choice. Spot a stale IP after a migration, a missing record behind a 'site can't be reached', or a round-robin set that is one address short. canonical: https://watchfor.io/a-record-lookup --- [Back to all free tools](/free-tools) # A Record Lookup Find the IPv4 address a domain resolves to — every A record, from the resolver of your choice. Spot a stale IP after a migration, a missing record behind a 'site can't be reached', or a round-robin set that is one address short. [How to use this tool](/blog/how-to-check-an-a-record) Result No result yet Fill in the form above and run it — the result appears here. Monitor this 24/7 — get alerted when a failure is confirmed. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## What is A Record Lookup ? An A record maps a name to an IPv4 address. It is the record almost every other thing depends on: the browser resolves example.com to 93.184.216.34 before it can send a single byte, the mail server resolves the MX target's A record before it can connect, the CDN's CNAME eventually bottoms out in an A record somewhere. When it is wrong, the symptom is never "DNS is wrong" — it is "the site can't be reached", "the certificate doesn't match", or "half the users see the old server". This tool asks a resolver of your choice for the A records of any name and shows you what came back — every address, the response code, and how long the lookup took. Round-robin sets show all their addresses. When nothing comes back the badge reads NXDOMAIN , which here covers two different problems: the name doesn't exist at all, or it exists without an A record. A lookup of another type on the same name (or dig ) tells you which. ## How it works One query, answered the way your application would see it: - 1 Ask the resolver — A standard DNS query for QTYPE=A goes to the resolver you picked — the probe's own resolver by default, a public one from the list ( 1.1.1.1 , 8.8.8.8 , 9.9.9.9 …), or any public IP you type, including an authoritative nameserver. - 2 Follow the alias if there is one — If the name is a CNAME, the resolver follows it and the tool shows the A records at the end of the chain. The aliases themselves aren't listed; run a CNAME lookup on the same name to see where it points. - 3 Report the answer unmodified — Each address, the status, the resolver address when you picked one, and the elapsed time. TTLs aren't shown for A records; the dig line below prints them. Run it from a specific probe location when the answer depends on where you ask from — GeoDNS and anycast setups return different addresses to different regions by design. ## When you'd use it ### After changing the IP You moved to a new server or a new load balancer and updated the A record. Look it up against two or three resolvers: the ones that still return the old address are still within the old TTL. dig against the same resolver shows how many seconds that cache has left. ### "This site can't be reached" Before touching the server, confirm the name resolves at all. NXDOMAIN with no addresses means the A record (or the whole zone) is missing — an expired domain, a deleted record, a typo in the zone. An address that resolves but doesn't answer is a different investigation. ### Certificate name mismatch The browser says the certificate is for another site. Often the A record points at a shared IP whose default virtual host serves someone else's certificate — the record is technically fine and practically wrong. The A lookup tells you which IP you're actually landing on. ### Verifying a round-robin set Three app servers, three A records. When one is decommissioned, its address has to leave DNS or a third of connections will fail. The lookup shows the full set as clients see it. ## Reading the result ### Multiple addresses Several A records for one name is normal — clients pick one (usually the first, and resolvers rotate the order). All of them must work; there is no health-checking in plain DNS. ### An old address after a change A stale address here after a change means you are looking at a resolver's cache, not at your zone. The record's TTL decides how long that lasts: low values (60–300 seconds) mean fast changes and more queries. This tool doesn't show A-record TTLs; dig does. ### NXDOMAIN with no records Either the name doesn't exist, or it exists without an A record (it may have a CNAME, MX, TXT or only an AAAA record). This tool reports both as NXDOMAIN ; in raw DNS the second case is NOERROR with an empty answer. Look up another type on the same name, or run the dig line below, to tell them apart. ### Private or reserved addresses An A record pointing at 10.x , 192.168.x or 127.0.0.1 on a public name is either a leak of internal DNS into the public zone or a deliberate split-horizon setup — either way, public clients can't reach it. ## Check it yourself The same query from a terminal, against Cloudflare's resolver: dig A example.com @1.1.1.1 +noall +answer Add +trace to walk from the root servers down to the authoritative answer and bypass every cache. ## Common pitfalls ### Looking up the apex when the site lives on www example.com and www.example.com are different names with different records. A CDN setup often has a CNAME on www and an A record (or ALIAS/ANAME flattening) on the apex. Check the name users actually type. ### Trusting your own machine's answer Your laptop's resolver, a VPN, a hosts-file entry or a corporate DNS can all return something the public internet doesn't see. This tool asks from a probe on the public internet; if the two disagree, the difference is the bug. ### Expecting the change to be instant The authoritative server changes instantly; every cache in the world waits out its TTL. Lower the TTL a day before a planned move, not at the moment of it. ## Run A Record Lookup on every change, not just once. Get alerted when an outage is confirmed — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 15 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions What's the difference between an A record and an AAAA record? A holds an IPv4 address (four numbers, 93.184.216.34 ); AAAA holds an IPv6 address ( 2606:2800:220:1:248:1893:25c8:1946 ). A dual-stack host publishes both; clients with IPv6 generally prefer the AAAA record. Can an A record point to a hostname? No — an A record's value is always an IPv4 address. To point a name at another name, use a CNAME (on anything but the zone apex) or your provider's ALIAS / ANAME flattening on the apex. How many A records can one name have? As many as fit in a response, in practice dozens. Large sets are used for crude load distribution; anything that needs health checks or weights belongs in a load balancer or a managed DNS with traffic policies. Why does the IP differ from what I see in ping ? ping uses your local resolver, which may have an older cached answer, a different GeoDNS region, or a hosts-file override. Query the same resolver here to compare like with like. What TTL should I use for an A record? 300 seconds is a sensible default for anything that might move; 3600 or more for stable infrastructure to reduce query load. Lower it to 60 before a planned change and raise it again afterwards. ## Related dns tools - [DNS LookupResolve A, AAAA, MX, TXT, NS, SOA, CNAME, PTR, CAA, SRV records for any domain.](/dns-checker) - [DNS PropagationCheck how a DNS record looks from every prober region simultaneously — spot stale anycast nodes and propagation gaps on a world map — plus an A+ to F DNS health grade for the zone: nameservers, delegation, DNSSEC and CAA.](/dns-propagation-checker) - [Whois LookupModern RDAP-based domain registration lookup: registrar, expiry, nameservers, status flags.](/whois-lookup) - [DNS Health CheckerGrade a domain's DNS A+ to F: how many nameservers it has and on which networks, lame delegation, whether the registry and the zone agree, SOA serials, DNSSEC and CAA, with the fix for every problem. Then see what every probe location answers, on a map.](/dns-health-checker) --- Canonical page: https://watchfor.io/a-record-lookup · Site guide: https://watchfor.io/llms.txt