DNS resolver comparison
Sends one query for the name and record type to each public resolver Lookproof uses (Cloudflare and Google), each on its own and without cache, and compares response codes and records. Different codes are a warning; different records are information, since CDNs answer differently by design. TTLs are shown, not compared.
Updated 2026-10-27
What this tool checks
One query for the name and record type goes to each resolver, without Lookproof's cache:
- Response codes: NOERROR, NXDOMAIN, SERVFAIL or REFUSED, per resolver.
- Records: compared as sets, without regard to order or case. Records only one resolver returned are listed in
DNS_ANSWERS_DIFFER.
How to read the result
Agreement means both resolvers see the same data now. Different records with the same code are usually harmless; different codes deserve a closer look.
Limitations
- Two resolvers are a small sample: a problem in one region or with one network can stay hidden.
- Use the DNS lookup for several record types at once.
Use it from code
API reference for DNS resolver comparison
curl -i "https://api.lookproof.dev/v1/dns/compare?domain=example.com"A request without payment is answered with 402 Payment Required and the exact price. See the API reference.
Limits
| Input | Domain name, Record type |
|---|---|
| Deadline | 10 seconds |
| Freshness | Up to 5 minutes, never longer than the record TTL |
| Price | $0.01 per check |
Findings this tool can report
DNS (5)
- Info
DNS_ANSWERS_DIFFERThe public resolvers return different records for the same question. - Error
DNS_DOMAIN_NOT_FOUNDThe DNS resolver reported that the domain does not exist. - Warning
DNS_RCODES_DIFFERThe public resolvers give different response codes for the same question. - Warning
DNS_RESOLVER_FAILUREThe DNS resolver returned a server failure. - Warning
DNS_RESOLVER_TIMEOUTThe DNS resolver did not answer in time.
Check (1)
- Warning
CHECK_QUERY_BUDGET_EXCEEDEDThe check stopped after reaching its DNS query limit.
Frequently asked questions
Why would two resolvers disagree?
After a change, one may still hold an old answer until its TTL runs out. CDNs and geographic DNS give different addresses by design. A SERVFAIL from only one side often points to a DNSSEC problem that a validating resolver sees: DNS_RCODES_DIFFER.
Are TTLs compared?
No. Each resolver counts its cached TTL down on its own, so different TTLs are normal. They are shown next to the records.
Which resolvers are asked?
The public resolvers Lookproof uses for every check: Cloudflare (1.1.1.1) and Google (8.8.8.8). Each is asked alone; a failure is not retried with the other, and no authoritative name server is contacted.