CNAME lookup

A CNAME makes a name an alias for another (RFC 1034 §3.6.2); no other records may exist at that name. Some providers publish DKIM keys through a CNAME into their zone (Microsoft 365, for example). MX and NS must not point at an alias (RFC 2181 §10.3).

• NXDOMAIN, NODATA or an error

  NXDOMAIN: the name does not exist. NODATA: the name exists but lacks the type asked (RFC 2308 §2.1, §2.2). Both are definite answers. A timeout or SERVFAIL says nothing about the record, so we show them as "unavailable".

• TTL

  How long the answer may be cached, in seconds; the number shown is what is left in our resolver's cache. Negative answers are cached too, at most for the SOA MINIMUM field (RFC 2308 §4, §5): a newly created record may only appear after it.

• DNSSEC

  "DNSSEC validated" means our resolver checked the signatures and considers the answer authentic (the AD bit, RFC 4035 §3.2.3). "No DNSSEC": the zone is not signed, or the chain of trust does not reach it.

• Aliases (CNAME)

  A CNAME points a name at another, and the resolver follows the chain and answers for its target (RFC 1034 §3.6.2). A name with a CNAME can have no other records, and MX and NS must not point at an alias (RFC 2181 §10.3).

Sources: RFC 1034 · RFC 1035 · RFC 2181 · RFC 2308 · RFC 4035