DNS checker
See every DNS record on a domain — where it points, who runs its nameservers, and whether anyone else can send email pretending to be it. Any domain, not just .pk.
Asking the public internet…
What do these records do?
Open any of them for what it is for, what usually goes wrong, and how to put it right.
A change you made has not appeared yet? That is TTL — the number of seconds the rest of the internet is allowed to remember the old answer. Nothing can hurry it.
Points a name at an IPv4 address, which is what a browser needs to fetch your site. If the A record is wrong or missing, the domain does not load at all. Changing it is how you move a site to a new server.
The same job as an A record, for IPv6. Having none is not a fault — most of Pakistan still reaches sites over IPv4 — but adding one costs nothing and helps mobile networks that are IPv6-first.
Makes one name an alias of another, so it follows wherever that name points. The rule people trip over: a name with a CNAME cannot have any other record, which is why you cannot put one on the bare domain alongside MX records.
Names the servers that accept email for the domain, lowest priority number first. If you move email to a new provider and forget these, mail keeps going to the old mailbox — often for days before anyone notices.
Says which servers are authoritative for the domain. These are set at your registrar, not in the zone, and changing them is how you move DNS from one provider to another.
Arbitrary text, used for almost everything that needs to prove you control a domain: Google and Microsoft verification, and the SPF and DMARC rules that protect your email.
One per zone. It names the primary nameserver and carries the serial number that tells secondary servers the zone has changed. You rarely touch it by hand.
Lists which certificate authorities are allowed to issue certificates for the domain. With no CAA record any authority may issue one, so adding it narrows who can mint a certificate in your name.
A TXT record listing which servers may send email as your domain. Ending it in -all rejects everything else; ~all only marks it suspicious. Without SPF, anyone can send email that appears to come from you.
A public key published under a selector, used to sign outgoing mail so the recipient can prove it was not altered. Selectors cannot be listed, so a checker can only try the common ones your provider is likely to use.
Tells receiving servers what to do when mail fails SPF and DKIM — nothing (p=none), spam (p=quarantine), or reject it (p=reject) — and where to send reports. Start at p=none, read the reports, then tighten.
How many seconds the rest of the internet may cache an answer. A record with a TTL of 3600 can take an hour to update everywhere, and nothing you do will hurry it. Lower the TTL a day before a planned move.