An audit of 20 brand domains, a list of customer domains to migrate, or a check after a DNS provider change: sooner or later you need the same record for many domains, and running one lookup at a time gets tedious and error-prone. Which of our domains still point MX at the old provider? Which ones have no SPF record? Which parked domains still have live name servers?
The Bulk DNS / Email Lookup answers that kind of question in one batch. You give it up to 25 domains and one record type; it returns one row per domain with the records found or the reason there are none. It is aimed at email audits (MX and TXT) but works for A, AAAA, CNAME, NS, SOA and CAA as well.
What is a bulk DNS lookup?
In simple terms
It is the same DNS query you would run with dig or nslookup, repeated for a whole list of domains, with the answers collected in a table. Instead of 25 separate lookups you get one overview you can scan or copy.
Technical background
Every DNS lookup asks a recursive resolver for a name and a record type (RFC 1035). The resolver answers from its cache or asks the authoritative name servers. Three outcomes matter for an audit:
- Answer: one or more records of the requested type.
- NODATA: the name exists but has no record of that type (shown as "no records").
- NXDOMAIN: the name does not exist.
Failures (timeout, SERVFAIL, REFUSED) mean the resolver could not give a reliable answer, which is different from "no record". Email-related data lives in a few types and names:
| What | Name | Type |
|---|---|---|
| Inbound mail servers | example.com | MX |
| SPF | example.com | TXT (v=spf1 …) |
| DMARC | _dmarc.example.com | TXT (v=DMARC1 …) |
| MTA-STS | _mta-sts.example.com | TXT (v=STSv1 …) |
| TLS-RPT | _smtp._tls.example.com | TXT (v=TLSRPTv1 …) |
| DKIM | <selector>._domainkey.example.com | TXT |
Why use the Bulk DNS / Email Lookup?
- Inventory: see which mail provider each domain uses from its MX records.
- Gap finding: spot domains without MX, without SPF or without DMARC.
- Migration tracking: confirm which domains already point to the new provider.
- Name server audits: check NS records after moving zones to a new DNS provider.
- Certificate policy: compare CAA records across a domain portfolio.
Who should use it?
- Administrators managing many domains or brands.
- MSPs and agencies auditing customer domains.
- Security teams reviewing a domain portfolio for unused or misconfigured domains.
- Anyone preparing a mail or DNS migration across several domains.
How the Bulk DNS / Email Lookup works
- The domain list is split on commas, spaces or semicolons, lowercased and de-duplicated.
- The NetTools.tech server validates every entry as a public domain name. Internal or reserved names (
.local,.internal,.test, …) are refused; more than 25 domains or one invalid entry rejects the batch. - The server queries Cloudflare's public resolver (1.1.1.1) directly, five domains in parallel at a time, with one try and a 3-second timeout per domain.
- Each domain's answer is classified as answer, no records, NXDOMAIN, timed out, SERVFAIL, refused or error.
- MX records are sorted by priority and shown as
priority host; TXT strings are joined and shortened to 1,024 characters; SOA is shown as one line with all fields.
The operation has a 25-second time limit. Because one batch sends many queries, it uses more of your per-client rate limit than a single lookup.
How to use the NetTools.tech Bulk DNS / Email Lookup
- Open Bulk DNS / Email Lookup.
- Enter the Domains, separated by commas, for example
example.com,example.org,example.net(at most 25). - Choose the Type: MX (default), A, AAAA, CNAME, TXT, NS, SOA or CAA.
- Press Run Bulk DNS / Email Lookup. In the terminal the same lookup is
/bulk-lookup example.com,example.org --type MX. - Scan the result table; rows that are not "answer" usually need attention.
- Press Copy to copy the table as text for your notes, then run the next record type.
Understanding the results
| Result | Meaning | What to look for |
|---|---|---|
| Domain | The name that was queried, lowercased | Duplicates appear once |
| Record column (named after the type) | The records returned, one per line, or — | For MX: 10 mail.example.com; for TXT: the full strings |
| answer | Records of this type exist | Check the values, not just the presence |
| no records | The name exists, but has no record of this type | A domain without MX cannot receive mail unless it falls back to A/AAAA |
| NXDOMAIN (does not exist) | The name is not in DNS | Expected for unused _dmarc names; for a main domain it means the domain is not delegated or has expired |
| timed out | No answer within 3 seconds | Repeat; persistent timeouts point to slow or broken name servers |
| SERVFAIL | The resolver could not resolve the name | Often a DNSSEC or delegation problem |
| refused / error | The query was refused or failed | Repeat later; check the domain with DNS Lookup |
Example: MX and DMARC audit of three domains
Step 1, MX. Domains example.com,example.org,example.net, type MX:
Domain MX Result
example.com 10 mx1.example.net answer
20 mx2.example.net
example.org — no records
example.net 0 . answerexample.com uses two MX hosts, example.org has no MX at all (mail falls back to its A record or fails), and example.net publishes a null MX (0 ., RFC 7505), stating that it accepts no mail.
Step 2, DMARC. Domains _dmarc.example.com,_dmarc.example.org,_dmarc.example.net, type TXT:
Domain TXT Result
_dmarc.example.com v=DMARC1; p=quarantine; rua=mailto:[email protected] answer
_dmarc.example.org — NXDOMAIN (does not exist)
_dmarc.example.net v=DMARC1; p=reject answerexample.org needs a DMARC record. The equivalent shell loop for comparison:
for d in example.com example.org example.net; do dig @1.1.1.1 +short TXT "_dmarc.$d"; doneCommon use cases
- Mail provider inventory across all company domains (MX).
- SPF coverage check: TXT for all domains, then look for
v=spf1. - DMARC rollout tracking: TXT for
_dmarc.<domain>names. - Parked-domain hygiene: confirm null MX,
v=spf1 -alland a reject DMARC policy on non-sending domains. - DNS provider migrations: NS and SOA for all moved zones.
- CAA review before switching certificate authorities.
Troubleshooting
The whole batch is rejected
One entry is invalid (typo, a URL with https://, an email address, an internal TLD) or there are more than 25 domains. The error message names the first invalid entry. Remove protocol prefixes and paths; enter bare domain names.
Only some domains time out
Their authoritative name servers are slow or unreachable from Cloudflare. Run the same domain in DNS Lookup, which uses its own resolvers, and check the NS records.
TXT results show many strings
Domains often have several TXT records (SPF, site verification, other services). The SPF record is the one starting with v=spf1; there must be only one. Check it in detail with SPF Lookup.
A recent change is not visible
The bulk lookup uses one resolver's cache. Compare across resolvers with Email DNS Propagation or DNS Propagation.
Common mistakes
- Expecting SPF or DMARC as separate record types; use TXT, and the
_dmarc.prefix for DMARC. - Reading "no records" for MX as harmless: such a domain may silently accept mail at its web server's address.
- Mixing up NXDOMAIN on
_dmarc.<domain>(no DMARC record, common) with NXDOMAIN on the domain itself (domain not in DNS). - Treating a timeout as "no record".
- Pasting full URLs or email addresses instead of domain names.
Limitations
- One record type per run and at most 25 domains.
- One resolver (Cloudflare 1.1.1.1), queried from the NetTools.tech server; its cached answers can differ from other resolvers, and anycast means a site near that server answers.
- Records are listed, not validated: the tool does not check SPF syntax, DMARC tags or MX reachability. Use the dedicated lookups for that.
- TTL values are not shown, and TXT strings are shortened to 1,024 characters.
- SRV and PTR lookups are not available here; DKIM requires knowing each domain's selector.
- Results can be copied as text; there is no CSV or JSON export.
Security & privacy
The list of domains is sent to the NetTools.tech server, which queries Cloudflare's public resolver; neither internal DNS nor your own name servers' private views are used. Internal names are rejected before any query. DNS data is public, but a domain list can still reveal which domains you manage or are investigating, so only enter what you need. No credentials are required, and results are not stored by the tool.
Related tools
- DNS Lookup – all record types for one domain, with TTLs (guide).
- MX Lookup – MX hosts with addresses and reverse DNS (guide).
- SPF Lookup – validate one domain's SPF record (guide).
- DMARC Lookup – explain one domain's DMARC policy (guide).
- Email DNS Propagation – one email record across eight resolvers (guide).
- DNS & domain tools overview – more DNS tools.
Summary
The NetTools.tech Bulk DNS / Email Lookup queries one record type for up to 25 domains through Cloudflare's resolver and lists the records or the reason there are none. Use MX and TXT (including _dmarc. names) for email audits, and NS, SOA or CAA for portfolio checks. It lists records rather than validating them, so follow up on interesting rows with the dedicated lookup tools.
Frequently asked questions
How many domains can I check at once?
Up to 25 domains per lookup. Duplicates are removed first, and if any entry is not a valid public domain name the whole batch is rejected with a message naming that entry.
Which record types are supported?
One type per run: A, AAAA, CNAME, MX (the default), TXT, NS, SOA or CAA. To check another type for the same domains, run the lookup again with a different type.
How do I check SPF records for many domains?
Choose the TXT type and enter the domains. SPF is the TXT string starting with v=spf1; the result shows all TXT strings at each domain, so look for that one and check it in detail with SPF Lookup if needed.
How do I check DMARC records for many domains?
DMARC records live at _dmarc.<domain>, so enter names such as _dmarc.example.com and _dmarc.example.org with the TXT type. Underscore labels are accepted in the domain list.
Which resolver does the bulk lookup use?
All queries go from the NetTools.tech server to Cloudflare's public resolver at 1.1.1.1, five domains at a time, with a 3-second timeout per domain. Results reflect that resolver's cache, which can briefly differ from other resolvers after a change.
Can I export the results?
The Copy button copies the whole result table as plain text, including the command that produced it, which you can paste into a ticket, spreadsheet or document. There is no separate CSV download.
Why does a domain show "no records" instead of NXDOMAIN?
No records means the name exists but has no record of the type you asked for, for example a domain without MX. NXDOMAIN means the name itself does not exist in DNS.