DNS 記錄查詢
查詢任何網域的 DNS 記錄（從 A 和 MX 到 TXT、CAA 和 SRV），以排查電子郵件、主機託管和強制入口的問題。
查詢網域的 DNS 記錄
Direct authoritative and platform DNS resolution. Read-only queries without data retention.
大多數服務中斷都源自 DNS
DNS 將名稱對應至地址並路由郵件，因此只要一個錯誤的記錄，就可能導致網站或信箱離線。此工具可解析網路團隊最常檢查的記錄類型，方便您即時確認網際網路上該網域的實際解析狀態。
此工具為您提供
- 隨選查詢 A、AAAA、MX、TXT、NS、CNAME、SOA、CAA、SRV 和 PTR 記錄。
- 可掃描 TXT 輸出，以檢查控制電子郵件遞送率的 SPF、DKIM 和 DMARC 政策。
- 唯讀查詢。此工具僅解析記錄，絕不會連線至目標主機。
- Automated SPF, DMARC, and CAA inspection for email deliverability and SSL security.
- Captive portal walled garden compatibility verification for enterprise guest WiFi.
Core DNS record types and their operational functions
Understanding the distinct role of each DNS resource record is essential for maintaining high availability, secure guest WiFi portals, and authenticated email routing:
| Record Type | RFC Standard | Default TTL | Enterprise Use Case |
|---|---|---|---|
| A | RFC 1035 | 300 - 3600s | Maps domain names to 32-bit IPv4 addresses for splash pages and web servers. |
| AAAA | RFC 3596 | 300 - 3600s | Maps domain names to 128-bit IPv6 addresses on dual-stack venue networks. |
| CNAME | RFC 1035 | 3600s | Aliases one domain name to another (e.g. guest.venue.com to custom.purple.ai). |
| MX | RFC 5321 | 3600 - 86400s | Designates mail servers and delivery priority numbers for inbound SMTP email. |
| TXT | RFC 1464 | 3600s | Stores arbitrary text data, including SPF, DKIM, DMARC, and domain ownership tokens. |
| CAA | RFC 8659 | 86400s | Restricts which Certificate Authorities can issue SSL certificates for the domain. |
| NS | RFC 1035 | 86400s | Delegates a DNS zone to authoritative nameservers (e.g. AWS Route53, Cloudflare). |
| SOA | RFC 1035 | 86400s | Defines core zone metadata, serial versioning, refresh timers, and admin contact. |
| SRV | RFC 2782 | 3600s | Specifies hostname and port for specific services (SIP, RADIUS, Microsoft AD). |
Why captive portals fail during DNS lookup
Over 70% of guest WiFi login failures trace back to DNS and walled garden misconfigurations rather than RF issues. When a guest connects to an open or Passpoint SSID, the access point intercepts DNS requests to trigger the splash page onboarding flow:
1. Walled garden FQDN omissions
If the captive portal domain, CDN asset hosts, or social login OAuth endpoints (Google, Apple, Facebook) are missing from the access point walled garden allowlist, the AP drops the DNS requests, causing the splash screen to freeze.
2. DNS-over-HTTPS (DoH) conflicts
Modern mobile operating systems and browsers with encrypted DNS enabled bypass local DHCP DNS servers. If port 443 DoH traffic is blocked without proper captive portal redirect triggers, browsers display timeout errors.
3. Operating system CNA probe failures
Apple iOS sends HTTP probes to captive.apple.com while Android probes connectivitycheck.gstatic.com. If the local DNS server fails to answer these probe hostnames, the device assumes there is no portal and disconnects.
Enterprise wireless DNS best practice checklist
Follow these engineering guidelines when provisioning DNS for Cisco Meraki, HPE Aruba, Ruckus, and Ubiquiti UniFi environments:
Assign high-availability Anycast DNS resolvers via DHCP
Provide at least two independent upstream DNS servers (e.g. 1.1.1.1 and 8.8.8.8) in DHCP Option 6 to ensure rapid failover if an ISP resolver experiences latency.
Pre-configure wildcard walled garden FQDNs
Include *.purple.ai and your venue custom branding domains in the controller allowlist so DNS responses pass without captive portal redirection.
Maintain a low TTL (300s) on portal custom hostnames
Short TTLs allow seamless server IP cutovers and DNS failover without waiting 24-48 hours for global cache flushes.
Frequently asked questions
What is a DNS lookup and why is it important for WiFi networks?
A DNS lookup queries Domain Name System nameservers to translate human-readable domain names (such as portal.purple.ai) into machine-routable IP addresses (such as 34.49.161.148). In WiFi networks, reliable DNS resolution is critical for captive portal splash page redirection, guest authentication, cloud access point management, and external API integrations.
Why does captive portal guest WiFi fail when DNS is misconfigured?
Captive portals intercept guest browser HTTP and DNS requests prior to authentication. If the DNS server assigned via DHCP fails to resolve the captive portal domain, or if the domain is blocked by a walled garden firewall rule, client devices experience connection timeouts, SSL certificate warnings, or fail the operating system captive network assistant probe.
How do TXT records configure SPF, DKIM, and DMARC for email deliverability?
Domain administrators publish TXT records containing SPF policies (v=spf1 include:...) and DMARC policies (v=DMARC1; p=reject) to specify which mail servers can send email on their domain's behalf. Receiving mail transfer agents check these DNS records to reject spoofed phishing emails and protect brand reputation.
What is a CAA record and how does it protect SSL certificate issuance?
A Certification Authority Authorization (CAA) DNS record specifies which Certificate Authorities (such as Let's Encrypt, DigiCert, or Sectigo) are permitted to issue SSL/TLS certificates for a domain. This prevents rogue or compromised certificate authorities from generating fraudulent certificates for your captive portal or web domains.
What is the difference between an authoritative nameserver and a recursive resolver?
An authoritative nameserver holds the actual DNS zone files and master records for a domain. A recursive resolver (such as Google 8.8.8.8 or Cloudflare 1.1.1.1) queries authoritative nameservers on behalf of client devices and caches the answers according to each record's Time-to-Live (TTL).
Why do DNS record changes not update immediately across the internet?
DNS records include a Time-to-Live (TTL) value in seconds. Intermediate recursive resolvers cache records until their TTL expires before querying authoritative nameservers for updated data. Lowering your TTL to 300 seconds prior to a migration ensures rapid cutover.
Enterprise WiFi performance guides and network tools
Explore technical blueprints and interactive calculators for optimizing venue wireless networks:
Captive portal guide
Learn how enterprise captive portals handle DNS interception, splash pages, and guest data capture.
Enterprise WiFi security guide
Deploy 802.1X, WPA3-Enterprise, and dynamic VLAN segmentation across multi-vendor AP estates.
Guest WiFi guide
Master guest onboarding, bandwidth throttling, and legal compliance across public venues.
DNS propagation checker
Compare DNS records across Google, Cloudflare, NextDNS, and AdGuard global resolvers.
DNS speed test
Benchmark DNS query response times across Cloudflare, Google, and NextDNS resolvers.
Walled garden generator
Generate pre-tested walled garden allowlists for Meraki, Aruba, Ruckus, and UniFi controllers.
MAC address lookup
Identify device manufacturer from OUI prefixes and detect private randomized MAC addresses.
iPSK subnet designer
Design individual pre-shared key subnets and dynamic VLAN scopes for multi-tenant housing.
Related WiFi tools
Captive portal not loading on guest WiFi?
DNS and walled garden misconfiguration is the leading cause of guest WiFi login failures. Purple provides cloud-managed captive portal software with pre-configured FQDN allowlists for Cisco Meraki, HPE Aruba, Ruckus, and Ubiquiti UniFi.
Book a 20-min demoNetforge Network Multi-Tool
Run offline network health checks, path analysis, and latency diagnostic scans directly from your desktop.
Download Multi-Tool