DNS Examiner
See what the internet sees for any domain
Look up live records through Google or Cloudflare's public resolvers, with quick checks for SPF, DMARC, CAA and nameservers. For zones you host on Edge, the Examiner in your dashboard diagnoses the rest.
Free. Queries go from your browser straight to the resolver.
DNS lookup
Pick a record type, or All for the common set plus health checks. The address bar updates so you can share the result.
Enter a domain to see what the world's resolvers see.
Queries go straight from your browser to the resolver over HTTPS. Edge never sees them.
In your dashboard
Compare what you configured with what the world sees
The public lookup shows answers. The Examiner inside Edge DNS goes further: it compares the records you've configured with live lookups, scores the zone out of 100 and hands you the exact records to add or change.
- AI analysis in under 30 seconds
- Issues ranked critical, warning and info
- Results saved; re-run whenever you like
- Included free with every Edge account
What it checks
Six audits, every run
The mistakes that quietly cost you: mail landing in spam, a registrar pointing somewhere else, a certificate anyone could issue.
Email deliverability
SPF, DKIM and DMARC present and valid; MX records sane and prioritised.Security
CAA restricting certificate authorities, and wildcards that are wider than you meant.Nameserver delegation
Live NS answers match your Edge pair, so a registrar mismatch is caught before it takes you offline.Web reachability
A and AAAA resolve, no CNAME at the apex, www set up the way visitors expect.Best practice
TTLs, duplicate or conflicting records, MX priority spread, orphaned entries.Live verification
Real lookups run alongside your configuration, so propagation gaps show up.
How it works
One click, then fixes
- 01
Open the Examiner tab
On any zone in Edge DNS, choose Examiner and run an examination. - 02
Live analysis
We look up your domain publicly and compare it with your configured records. - 03
Apply the fixes
Each issue comes with the record to add or change. Fix it in the Records tab.
Reading the health score
| Score | Rating | Meaning |
|---|---|---|
| 80–100 | Good health | No critical issues. Minor improvements may be suggested. |
| 60–79 | Needs attention | Warnings worth fixing soon. |
| 0–59 | Issues found | Problems likely to affect email, security or availability. |
Edge CLI
edge dns examine <zone-id>
edge dns examine-last <zone-id> --output jsonFAQ
About the lookup tool
Does Edge see or log my lookups?
No. Your browser sends each query directly to Google (dns.google) or Cloudflare (cloudflare-dns.com) over DNS-over-HTTPS. Nothing passes through Edge.
Why do Google and Cloudflare sometimes disagree?
Resolvers cache answers for the record's TTL, so after a change one may still hold the old value. Geo-routed records can also answer differently depending on where the resolver sits.
What does “DNSSEC validated” mean?
The resolver set the AD flag: it checked the signatures on the answer. If you don't see it, the zone isn't signed or the chain of trust is broken.
How is this different from the Examiner?
This page reads public DNS for any domain. The Examiner runs on zones you host on Edge, compares what you configured with what's live and uses AI to explain and prioritise fixes.
Can I link to a result?
Yes. The address bar updates with the domain, type and resolver, so you can share the exact lookup with a colleague.
Found something to fix? Fix it on Edge.
Host the zone on Edge DNS and the Examiner watches it for you. Free for up to 50 zones.
Free for everyone with a verified email. No card required.