Most "the site is down" and "email stopped working" tickets end at the same few questions. Does the name resolve, and to what? Has the change reached the resolvers yet? Is the domain still registered, and delegated to the right name servers? Does the server present a valid certificate for that name? The DNS & Domains tools on NetTools.tech answer each of those from the outside, the way the rest of the internet sees your domain.
This guide gives an overview of the six tools in the category, shows which one fits which problem, and describes workflows that combine them. Each tool has its own detailed guide linked below.
What these tools cover
- Record lookups: Nslookup queries A, AAAA, CNAME, MX, NS, TXT, SOA, CAA and SRV records (or all common types at once) through Cloudflare 1.1.1.1 and Google 8.8.8.8.
- Change tracking: the DNS Propagation Checker compares one record across up to 60 public resolvers, with TTLs, response times and an optional expected value.
- Reverse DNS: Reverse DNS looks up the PTR record of a public IPv4 or IPv6 address.
- Registration data: Whois queries RDAP (with port-43 WHOIS fallback for TLDs without RDAP) for registrar, dates, status codes, name servers and DNSSEC, or for the network behind an IP address.
- Resolver exposure: the DNS Open Resolver Checker sends one recursive query to an IP address to see whether it resolves names for anyone on the internet.
- Certificates: the SSL Checker performs a TLS handshake on a TLS port and reports trust, hostname coverage, expiry, SANs, protocol and chain.
All of them run on the NetTools.tech server in Latvia, accept only public names and addresses, and are rate limited per visitor.
Why they matter
DNS sits in front of almost everything: websites, APIs, email, VPNs, certificate issuance. A wrong record, a stale cache, an expired domain or a broken DNSSEC delegation looks to users like "the service is down", even though every server is running. Checking from outside your own network matters because your workstation often uses an internal resolver, split-horizon zones or a cache that hides the problem.
The same applies to certificates and resolvers. An expired certificate or a missing intermediate breaks clients just as hard as a missing A record, and an accidentally open resolver turns your connection into a tool for DDoS attacks. These checks take seconds and show exactly which layer is at fault.
The tools at a glance
| Tool | What it does | Best for | Guide |
|---|---|---|---|
| Nslookup | Query DNS records for a domain. | Query A, AAAA, MX, TXT, NS, CNAME and other DNS records for any domain and see what public resolvers return. | Guide |
| DNS Propagation Checker | Compare DNS answers from many public resolvers. | Check whether a DNS change is visible yet: compare A, MX, TXT, NS and other records across dozens of public resolvers, with TTLs (A/AAAA) and response times. | Guide |
| DNS Open Resolver Checker | Find out whether an IP answers DNS queries for anyone on the internet. | Check whether your IP address or DNS server is an open resolver — one that answers recursive DNS queries from anyone on the internet and can be abused for DDoS amplification. | Guide |
| Reverse DNS | Find the hostname mapped to an IP address. | Look up the PTR record of an IPv4 or IPv6 address to find the hostname it maps to. | Guide |
| Whois | Get domain registration details. | Look up registration details for a domain or IP block: registrar, dates, status and name servers, via RDAP and WHOIS. | Guide |
| SSL Checker | Check SSL/TLS certificate validity and details. | Inspect a website’s TLS certificate: validity dates, issuer, subject names and certificate chain. | Guide |
Which tool should I use?
| Problem | Tool | Guide |
|---|---|---|
| A name does not resolve, or resolves to the wrong IP | Nslookup | DNS lookup |
| I changed a record and some users still see the old value | DNS Propagation Checker | DNS propagation |
| I need the MX, TXT (SPF/DMARC) or CAA records of a domain | Nslookup | DNS lookup |
| A mail server rejects my mail for missing reverse DNS | Reverse DNS | Reverse DNS lookup |
| I want to know which host an IP from my logs belongs to | Reverse DNS, then Whois | Reverse DNS lookup |
| When does a domain expire, and who is the registrar? | Whois | Whois lookup |
| Which name servers is the domain really delegated to? | Whois | Whois lookup |
| My provider says my IP is used for DNS amplification | DNS Open Resolver Checker | Open DNS resolver check |
| Users get certificate warnings or apps fail with TLS errors | SSL Checker | SSL certificate checker |
| When does my certificate expire, and does it cover all names? | SSL Checker | SSL certificate checker |
Typical workflows
Moving a website to a new server
- Lower the TTL of the A and AAAA records a day ahead and confirm the new TTL with Nslookup.
- Make sure the new server has a certificate for every hostname: run the SSL Checker against it once DNS points there (or check the SAN list of the certificate you plan to install).
- Change the records, then watch the DNS Propagation Checker with the new IP as the expected value until Different and No records disappear.
- Keep the old server running for at least one full old TTL, then raise the TTL again.
Changing DNS provider
- With Whois, note the current name servers, the registrar and whether DNSSEC is Signed.
- Recreate the zone at the new provider and compare key records (A, MX, TXT, CAA) with Nslookup against what you expect.
- Change the name servers at the registrar, and update or remove the DS record if the delegation is signed.
- Confirm the new name servers in Whois, and check NS and SOA across resolvers with the DNS Propagation Checker. The parent zone's NS TTL can mean a day or two of overlap; keep the old zone correct until then.
Preparing a mail server
- Set the PTR at the IP's provider and confirm it with Reverse DNS.
- Look up the returned hostname with Nslookup to confirm it resolves back to the same IP.
- Check the IMAPS (993) and SMTPS (465) certificates with the SSL Checker.
- Continue in the email category: MX Lookup, SPF, DMARC and the SMTP Test for STARTTLS on port 25 or 587.
Responding to an abuse report about DNS amplification
- Run the DNS Open Resolver Checker against the reported address (or "Check my IP" from that network).
- If it is open, disable DNS relay on the WAN side or restrict recursion, then check again.
- Optionally use Reverse DNS and Whois on the address to confirm it is really yours and which provider it belongs to.
Related guides
Tool guides in this category:
- DNS lookup (Nslookup)
- DNS propagation
- Open DNS resolver check
- Reverse DNS lookup
- Whois lookup
- SSL certificate checker
Neighboring categories:
- Email tools – MX, SPF, DKIM, DMARC, SMTP and blacklist checks that build on DNS.
- Network diagnostics – ping, traceroute, MTR and port checks once a name resolves.
- IP & network tools – IP lookup, geolocation and subnet calculations.
- Security & testing tools – checks for systems you own or are authorized to test.
Frequently asked questions
Which tool should I use when a domain does not resolve?
Start with Nslookup to see whether public resolvers return NXDOMAIN, no records or SERVFAIL. Then use Whois to check that the domain is registered, not on hold and delegated to the name servers you expect.
What is the difference between Nslookup and the DNS Propagation Checker?
Nslookup asks two public resolvers (Cloudflare 1.1.1.1 and Google 8.8.8.8) and shows all records of a type. The DNS Propagation Checker sends the same query to up to 60 resolvers from a curated public list and compares their answers, which is what you need right after a change.
Where are the DNS queries sent from?
All server-side checks in this category run from the NetTools.tech server in Latvia. Anycast resolvers answer from their site nearest to that server, so results show the public view from one location, not from every country.
Do these tools query my internal DNS?
No. Only public domain names and public IP addresses are accepted, and lookups go to public resolvers and registries. Internal names such as .local, .lan or .internal are rejected.
Is WHOIS still used, or only RDAP?
The Whois tool uses RDAP, the structured HTTPS successor, wherever the registry offers it. For top-level domains without RDAP it falls back to the registry's classic WHOIS server on port 43.
Why is the SSL Checker in the DNS & Domains category?
Certificates are issued for domain names, and many certificate problems come from domain and DNS changes: a new subdomain missing from the certificate, a name pointing to the wrong server, or a CAA record blocking issuance. It also appears under the security and email categories.