Phishing URL & domain

DNS over HTTPS Lookup

Network: DoH

Use DNS over HTTPS Lookup

What it does

Look up a domain's DNS records with DNS over HTTPS (DoH). Your browser sends the query to PhishDestroy's relay, which asks Cloudflare or Google and lists each answer with its TTL.

DNS names you look up are sent to the PhishDestroy DNS relay (/api/dns-resolve.php), which asks Cloudflare or Google DNS over HTTPS.

Example

A records of example.com

Input
example.com
Output (captured 2026-10-20)
example.com

Shows the response status (NOERROR) and every A record of example.com with its TTL and a Copy button. Switch the type to MX or TXT to see mail servers and SPF or verification strings.

FAQ

Which records can I look up?

A, AAAA, CNAME, MX, TXT, NS, CAA and SOA, one type per query. Enter a bare host name such as mail.example.com, not a full URL with https:// or a path.

What does ERROR STATUS 3 mean, and can the answer differ elsewhere?

Status 3 is NXDOMAIN: the name does not exist in DNS, which is also what a phishing domain suspended by its registrar (clientHold) returns. Answers come from one public resolver at one moment, so geo-DNS and fast-flux hosts can return other addresses to other people.

Is my query sent anywhere?

Yes. The name and record type go to PhishDestroy's relay (/api/dns-resolve.php), which asks Cloudflare or Google DNS over HTTPS and returns the answer. A lookup runs only when you press Resolve DNS or Load example, or send a domain here from another tool, and the relay allows about 60 lookups per minute per IP address.