DNS Compare Tool — Side-by-Side Record Diff

Organizations maintain parallel hostnames for staging, disaster recovery, or regional brands. Before promoting staging to production, operators expect identical MX and TXT for mail authentication, even when A records intentionally differ on private IPs.

Comparing apex versus www catches CNAME flattening differences and missing IPv6 AAAA on one label. Acquisition integrations compare acquired domain DNS against corporate standards.

A and AAAA cover IPv4 and IPv6 hosting targets. MX defines mail exchangers. TXT holds SPF, DKIM, verification tokens, and DMARC when published at the same name. NS shows delegation targets. CNAME reveals alias chains.

SRV, CAA, and PTR are outside this compare scope — use dedicated lookups for those types when needed.

Values for each type are extracted, sorted alphabetically, and compared as JSON-serialized lists. Order in DNS responses does not affect match. Duplicate values appear as separate entries if published multiple times.

Empty versus empty counts as match. One side empty and the other populated counts as different — critical for spotting missing SPF on a clone zone.

Run compare weekly on paired environments to detect configuration drift from manual hotfixes. Automate reminders before release windows so unexpected TXT diffs block deploy until reviewed.

Document intentional differences in runbooks — for example staging MX pointing to a sink server — so future compares do not cry wolf.

After updating DNS at the provider, compare old and new hostnames if both temporarily resolve. Once cutover completes, compare new production against a saved baseline export from this tool.

Remember TTL delays: compare may show match on authoritative data while users still hit old IPs from cache — pair with TTL checker timing.

Mail fails silently when staging lacks DMARC or SPF records present on production. Compare highlights TXT diffs but humans must recognize which TXT strings are authentication-related.

Follow TXT mismatches with DKIM selector checks and deliverability scoring on each domain separately.

NS mismatch means the two names may use entirely different DNS providers even if some records coincide. Delegation changes are heavier than single-record edits — escalate NS diffs before go-live.

Child zones on subdomains can diverge from apex NS while still serving correct A records — context matters when interpreting NS rows.

Only six types are compared. Wildcard expansion and geo-steered responses may differ by resolver location though sorted values match at query time.

Both inputs must be valid domain names — IP addresses and bare hostnames without domains are rejected.

Export compare results into change tickets as evidence of pre/post state. Match all critical types before declaring migration complete.

Combine with DNS record history snapshots to preserve point-in-time baselines when compare is run repeatedly over weeks.