Google Public DNS API
Free Google DNS-over-HTTPS API with no key: resolve any DNS record type as JSON, with DNSSEC validation. Query DNS from the browser. Tested example.
Endpoint tested and returned HTTP 200 on 20 Aug 2026
What is the Google Public DNS API?
Google Public DNS provides a free, key-free DNS-over-HTTPS resolver that answers DNS queries as JSON. It supports every record type, performs DNSSEC validation, and is callable from browser JavaScript.
Browsers cannot perform DNS lookups directly, which makes DNS-over-HTTPS APIs genuinely enabling: you can build domain diagnostic tools that run entirely client-side.
The `AD` flag in the response is the piece people miss — it indicates the answer was DNSSEC-validated. That is what separates a resolver you can trust from one that merely returned an answer, and Google's resolver validates by default.
Quick facts
- Base URL
https://dns.google/resolve- Authentication
- No API key required.
- Rate limit
- No published hard limit; intended for reasonable client use.
- Pricing
- Free.
- CORS
- Enabled — callable directly from browser JavaScript
- Official docs
- Read the docs
How to use the Google Public DNS API
Every request below was executed against the live API on 20 Aug 2026, and the response shown is the real body it returned — not an illustration.
1. Resolve a DNS record as JSON
GET https://dns.google/resolve?name=example.com&type=A
curl 'https://dns.google/resolve?name=example.com&type=A'const res = await fetch("https://dns.google/resolve?name=example.com&type=A");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);import requests
res = requests.get("https://dns.google/resolve?name=example.com&type=A", timeout=20)
res.raise_for_status()
print(res.json()){
"Status": 0,
"TC": false,
"RD": true,
"RA": true,
"AD": true,
"CD": false,
"Question": [
{
"name": "example.com.",
"type": 1
}
],
"Answer": [
{
"name": "example.com.",
"type": 1,
"TTL": 300,
"data": "104.20.23.154"
},
{
"name": "example.com.",
"type": 1,
"TTL": 300,
"data": "172.66.147.243"
}
],
"Comment": "Response from 172.64.32.162."
}Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
name | string | Required | Domain name to resolve. example.com |
type | string | Optional | Record type: A, AAAA, MX, TXT, NS, CNAME, SOA. A |
cd | boolean | Optional | Set to disable DNSSEC checking. false |
do | boolean | Optional | Include DNSSEC records in the answer. true |
Response fields
Statusinteger- DNS response code — 0 means NOERROR.
ADboolean- True when the answer was DNSSEC-validated.
Questionarray- Echo of the query.
Answerarray- Resource records, each with name, type, TTL and data.
Answer[].datastring- The record value — an IP for A records, a hostname for MX.
Answer[].TTLinteger- Time to live in seconds.
What you can build with the Google Public DNS API
- Build DNS lookup and diagnostic tools that run in the browser
- Verify domain configuration such as MX and SPF records
- Check DNSSEC validation status for a domain
- Monitor DNS records for unexpected changes
Common errors and how to fix them
Status: 3 (NXDOMAIN)
The domain does not exist.
Fix: Check Status before reading Answer; a non-zero status means no valid answer.
Missing Answer array
The record type does not exist for that name.
Fix: A domain with no MX records returns success with no Answer — handle it as an empty result.
AD is false
The answer was not DNSSEC-validated.
Fix: Most domains still do not sign their zones; false is common and not necessarily suspicious.
Google Public DNS API — frequently asked questions
What is DNS-over-HTTPS?
DNS queries sent over HTTPS rather than plain UDP. It encrypts lookups and, importantly for developers, makes DNS queryable from browser JavaScript, which cannot otherwise resolve DNS.
Is Google's DNS API free?
Yes, free with no API key.
What does the AD flag mean?
The answer was validated with DNSSEC. It is the signal that the response is cryptographically verified rather than merely returned — though many domains still do not sign their zones.
What does Status: 3 mean?
NXDOMAIN — the domain does not exist. Always check Status before reading the Answer array.
Tools that pair with this API
Alternatives to Google Public DNS API
If Google Public DNS does not fit, these security & auth apis cover similar ground. Every one was called before publishing, and each links to its own reference page with a working curl command and the response it returned.
| API | What it does | Auth | CORS | Last verified |
|---|---|---|---|---|
| Pwned Passwords | Free Have I Been Pwned password API with no key. Check if a password appears in known breaches using k-anonymity — the password never leaves your server. Tested. | No key | Yes | 19 Aug 2026 |
| Have I Been Pwned Breaches | Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example. | No key | Yes | 19 Aug 2026 |
| NVD CVE | Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example. | No key | Yes | 19 Aug 2026 |
| CIRCL CVE Search | Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example. | No key | Yes | 19 Aug 2026 |
| Hashify | Free hashing API with no key: generate MD5, SHA-1, SHA-256 and other digests over HTTP in hex or base64. Tested curl example and security guidance. | No key | No | 19 Aug 2026 |
| SANS Internet Storm Center | Free SANS Internet Storm Center DShield API with no key: most-targeted ports, attacking source counts, IP reputation and daily internet threat data from a global sensor network. | No key | Yes | 21 Aug 2026 |
Google Public DNS is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 20 Aug 2026; always check the official documentation before relying on this API in production, as terms and limits can change.