Compare answers, not guesses
Enter a domain without a URL scheme, path or port. Internationalized domain names are converted to their ASCII DNS form before querying. Select the record type you need. Both resolvers receive the same name and type, and the report shows their answers separately instead of merging away useful differences.
A records hold IPv4 addresses; AAAA records hold IPv6 addresses. MX records describe mail routing, TXT records often contain verification or email-policy text, and NS records identify name servers. SOA records contain zone administration information. CAA concerns certificate-authority authorization. DS and DNSKEY help inspect DNSSEC. PTR queries require a reverse-DNS name such as 1.1.1.1.in-addr.arpa, not a plain IP address.
Understand the status
NOERROR means the DNS query was processed successfully; it does not guarantee that an answer of the requested type exists. A successful empty answer can be normal when a domain has no AAAA record, for example. NXDOMAIN says the queried name does not exist according to that resolver. SERVFAIL can arise from upstream failures or validation problems. A network timeout is displayed as a provider error, not converted into NXDOMAIN.
The authority section is shown when returned. It can help explain negative responses or referrals. The table preserves answer names, numeric record types, TTL values and record data, so the JSON export can be compared with another diagnostic tool.
Why answers can differ
Resolvers cache independently. During a change, one may still hold an older valid answer. CDNs and managed DNS can also intentionally return different address sets based on routing policies. Therefore a difference is a prompt to investigate, not automatic proof of a broken zone.
The comparison ignores record ordering and TTL differences when deciding whether answer sets agree. TTL naturally changes as caches age. Record content and response status still matter. A response time measures the server’s request to the resolver; it is not the browser’s latency to the final website.
What this is not measuring
These are two public resolvers queried from the service’s execution location. They are not probes physically deployed in dozens of countries. The tool does not claim to establish worldwide propagation, test every authoritative server or verify that a website’s HTTP service is healthy. DNSSEC authenticated means the resolver set its AD flag; an unset flag alone does not prove a configuration error.
Export a report before and after a change if you need a comparison. Use IP Check to inspect an address returned by DNS. See the network guide for a practical investigation order. The query formats are documented by Cloudflare and Google.