Domain to IP lookup: find the IP address of any domain
Single lookups or thousands at once. Free, fast, and privacy-first -- your domains never touch a third-party API.
More free tools for DNS, email and networks
Check mail servers, test SPF, DKIM and DMARC, find the host behind an IP, or work out a subnet. Live results, no sign-up.
IPv4 + IPv6
Address families
Zero
External APIs used
None
Signup required
Built for real DNS work
Everything a lookup tool needs, nothing it doesn't.
Dual-stack resolution
Every lookup resolves IPv4 and IPv6 independently, so you always know a domain's full public footprint.
Bulk lookups at scale
Paste thousands of domains at once. Controlled concurrency keeps large batches fast without flooding DNS.
Automatic retry
Transient DNS failures are retried with exponential backoff -- permanent failures like NXDOMAIN fail fast instead.
SSRF-hardened by design
Every resolved address is checked against private, loopback, and cloud-metadata ranges before it's ever returned.
CSV & JSON export
Download full results for any lookup job, streamed directly -- no waiting on a giant in-memory export.
Rate-limited & abuse-protected
Per-visitor rate limits and bulk job caps keep the service fast and available for everyone.
How it works
Enter a domain, or paste a list
A single domain, or a pasted list of thousands -- one field handles both.
Node.js resolves it directly
dns.Resolver queries public DNS servers in real time -- no third-party lookup API sits in between.
Get results, export, done
See IPv4/IPv6 addresses and status immediately, or download the full batch as CSV or JSON.
Understanding domain-to-IP resolution
What's actually happening behind each lookup.
What a domain lookup actually does
A domain name like example.com is just a human-readable alias. Nothing on the internet actually routes traffic by name -- every connection is made to a numeric IP address. DNS (the Domain Name System) is the directory that maps the alias to the address, and a “lookup” is one query against that directory: ask for the A record (the IPv4 address) and the AAAA record (the IPv6 address), and get back whatever the domain's authoritative DNS server has published. This tool runs that exact query for you, directly, using Node.js's own resolver against public DNS servers -- the same mechanism your browser and operating system use every time you visit a site.
Why one domain can return several IP addresses
It's normal, not an error, for a lookup to return more than one address. Large sites spread traffic across many servers for redundancy and load balancing, and content delivery networks (CDNs) publish different edge-server addresses depending on DNS round-robin rotation or the resolver's location. Seeing three, five, or a dozen IPs for one domain usually just means that domain is served by infrastructure designed to route visitors to the nearest or least-loaded server.
Making sense of a failed lookup
Not every domain resolves, and the reason matters. NXDOMAIN means the domain simply isn't registered, or its DNS records were removed -- retrying won't help. SERVFAIL or REFUSED point to a problem on the authoritative DNS server's side, often temporary. A timeout means no answer came back in time, which can be transient network congestion rather than anything wrong with the domain itself. That's why this tool automatically retries timeouts, SERVFAIL, and REFUSED with backoff, but never retries an NXDOMAIN -- a permanent failure retried forever just wastes time and DNS query budget.
Why the same domain can resolve differently over time
DNS records carry a TTL (time to live) that controls how long a result should be cached before it's looked up again. A site migrating hosts, rotating a CDN, or failing over to backup infrastructure will show a different IP once its TTL expires and the change propagates. Re-running a lookup periodically -- or scheduling a recurring job -- is the practical way to catch exactly when a DNS change takes effect, rather than guessing.
Where this is actually useful
Confirming a DNS change has propagated after updating a record. Checking whether a domain is still pointed at a CDN or WAF before debugging further downstream. Verifying a mail domain's infrastructure as part of setting up SPF. Investigating a suspicious domain's hosting footprint without needing to trust a third-party lookup service with what you're investigating. And at scale, watching a whole portfolio of domains on a schedule to catch an unexpected DNS change the moment it happens.
Who uses this
Infrastructure monitoring
Track which IPs your domains actually resolve to, and catch unexpected DNS changes early.
Developer tooling
A fast, scriptable-by-hand alternative to reaching for dig or nslookup for one-off checks.
Security research
Resolve large domain lists safely, with SSRF protections that keep internal infrastructure off-limits.
Privacy-conscious teams
No account, no third-party API call -- domains you look up never leave this server's own DNS resolver.
Security is not an afterthought
Every resolved address is filtered against private, loopback, link-local, and cloud-metadata ranges -- including DNS-rebinding attempts -- before it's ever returned. This tool performs public DNS resolution only; it will never be used for port scanning, subnet scanning, or internal network probing.