isitdns

Use for one exactOne questionrecord tofrom one public resolver, not as the first call for a site that is not working. Returns: records, flags, rcode, EDE and, latency;latency. DoH from the edge, or Do53 from a region's probe (from). follow: true walks a CNAME chain.

 ⟨46 unchanged words⟩ ,"both"],"type":"string"},"follow":{"default":false,"description":"Also walk the CNAME chain from this name, hop by hop, to its addresses","type":"boolean"},"from":{"description":"Ask from the probe ⟨111 unchanged words⟩ 

Use when a name fails validation or the person asks whether its DNSSEC chain holds. Returns eachThe signed zone cutcuts from the root to the answer: DS and DNSKEY at each, the first link that breaks, or where it goes insecure. Signature bytes are not verified.

Use when a domain has vanished from DNS and the person asks whether it expired or is on hold. Returns theThe registry's RDAP record: statuses and what each means for resolution, the dates and, itsthe nameservers;nameservers. noNo contacts.

Use afterAfter a zone change, when the person asks whether the authoritative servers agree. Returns: each nameserver's answer to each name and type you list, the disagreements, lame or silent servers, and CAA and ACME readiness.

Use when the person wants to walk theThe delegation for afrom name,the root to authoritativethe authority, like dig +trace. Returns+trace: each referral and glue, lame or unreachable servers, the final answer and a verdict.answer.

The eleven-check DNS auditUse forwhen a domain: parent and child nameservers agree, no open recursion, DNSSEC chain, TTL sanity, mail posture, glue at the parent, a DS that matches a live DNSKEY, and whether a truncated UDP answer can be had over TCP. Every check reports ok, warn, fail or skipped with the reason. No score, no grade. Itwebsite doesis not test HTTP, SMTP delivery, registrar statusworking or arbitrary record types: use trace for the delegation path step by step, sweep_domain to compare thenot authoritativeresolving servers,(is digit forDNS?): one recordcall. fromThe onefirst resolver.line Sixsays ofwhether the eleven belong to a ZONE rather than to a name (the delegation, the DNSSECresolves; chain,then the nameserver'seleven-check recursionaudit policy,of theits gluezone, the DS match and theeach TCProw fallback)ok, so if you ask about a hostname those six are evaluated for the enclosing zone: the answer names it and marks the rows it applies to. Every transaction the audit made is a receipt under its check. Give thewarn, personfail theor api:skipped and ask again: lines as printed.why.

{"properties":{"from":{"description":"Ask from the probe in this region","enum":["north-america","europe"],"type":"string"},"name":{"description":"The domain to audit. Also accepted as \"domain\"; a URL is reducedread toas its host.","type":"string"}}, ⟨4 unchanged words⟩ 

Ask ONE public DNS resolver on the boardUse for one record, live, over DoH from the isitdns edge on Cloudflare. The resolver is a board id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, mullvad-base, dns4eu-protective), an alias such as 8.8.8.8 or quad9 thatexact mapsquestion to one, or "all" for the tier-1 operators side by side (cloudflare, google, quad9, adguard); every other boardpublic resolver is asked by its id; the default is cloudflare. A private (RFC 1918), link-local or LAN address, and any address not on the board, is refused, and the answer says why. To check whether the person's own path intercepts DNS, this tool is the reference only: ask canary.probe.isitdns.net here, and hand the person dig @192.0.2.1 <name>, which should get no answer (a documentation address with no server, RFC 5737; hand it over as written), and dig @1.1.1.1 <name>, both to run on their own machine. Returns the answer, the flags, the rcode, Extended DNS Errors and the latency in the shape dig prints, plus the JSON, and ends with an "ask again" link to the same query on the site (afirst digcall withfor a flag off its default has no page and carries no link). With resolver "all", one TTL line per record set (RRSIG aside) seen on two or more rows with the same data: the lowest and highest TTL and the resolversite that reported each. Over MCP the transport is DoH only: DoT, Do53 over TCP and the probe's Do53 over UDP are on the HTTP surface (https://isitdns.net/api/query, transport=). A resolver with no DoH endpoint on file cannot be asked here and answers so. Off-board address: refused; the answer carries the /api/query URL. With resolver "all": one line per group of rows with the same answer; NO ANSWER (asked, no reply) and NOT MEASURED (not asked) rows by name. The transcript is the primary result: keep the asked-at time, the resolver, transport, vantage, rawworking. DNSReturns sectionsrecords, flags, rcode, EDE, latency, and the api and ask-again links. Givelatency; theDoH personfrom the api: and ask again: lines as printededge, (aor digDo53 withfrom a flag off its default has no page and no askregion's againprobe line(from).

{"properties":{"cd":{"default":false,"description":"Checking disabled: askAsk the resolver not to validate","type": ⟨14 unchanged words⟩ ,"ecs":{"description":"EDNS Client Subnet in CIDR form, e.g. 192.0.2.0/24","type":"string"},"family":{"default":"v4","description":"Which addressAddress family to dial the resolver on","enum":["v4","v6","both"],"type":"string"},"namefrom":{"description":"TheAsk namefrom tothe askprobe for,in e.g.this example.comregion","enum":["north-america","europe"],"type":"string"},"name":{"description":"The orname, e.g. 

Walk the DNSSEC chainUse forwhen onea name and type from the root key set to the answer, read through one public resolver with checking disabled (Cloudflare DoH, RFC 4035 section 3.2.2),fails andvalidation nameor the first link thatperson breaksasks withwhether its RFCDNSSEC 4035chain condition.holds. PerReturns each signed zone cut: the DS set at the parent and who signed it,from the DNSKEY set with key tags and roles (KSK, ZSK, revoked), which DS matches which key (SHA-1, SHA-256, SHA-384 digests computed), whether a DS-matched keyroot signsto the DNSKEY set,answer and each signature's window against the read time; then the answer's signerfirst andlink keythat tagbreaks, or the NSEC and NSEC3 records of a negative answer (counted, not checked). An insecure delegation (no DS at the parent) is reported as where the chain ends, not as a break. checked: key tags, signers, windows · signatures: not verified. Every read of the walk is a receipt with its time, rcode, flags, EDE and latency. Give the person the api: and ask again: linesit asgoes printed.insecure.

 ⟨2 unchanged words⟩ "description":"The name, e.g. www.example.com. Also accepted as \"domain\"; a URL is reducedread toas its host.","type":"string"}," ⟨21 unchanged words⟩ 

Is the domainUse itselfwhen ona hold,domain expiredhas orvanished beingfrom deleted?DNS Asksand the registry's RDAP server (foundperson throughasks IANA'swhether RDAPit bootstrapexpired registry,or RFCis 9224)on andhold. returnsReturns the EPPregistry's RDAP statuses withand what each means for resolution (clientHold, serverHold and redemptionPeriod mean the registry says it is not publishing the delegation; resolvers keep a cached copy until its TTL runs out, and trace shows whether the TLD servers still refer), the registration, expiration and last-changed dates, the nameservers the registry holds, and whether the delegation is signed. A hostname is walked up to the registered domain. Every HTTP read is a line with its URL, status, round trip and time. Give the person the api: and ask again: linesnameservers; asno printed.contacts.

{"properties":{"domain":{"description":"The registered domain or a hostname under it, e.g. example.com.it. Also accepted as \"name\"; a URL is reducedread toas its host.","type":"string"}}, ⟨4 unchanged words⟩ 

Authoritative consistency, not cache propagation: find the zone's nameservers from the root down, then ask one address of each nameserver name per family (IPv4 and IPv6) every name x type you list, with recursion off, over TCP, and widen to every otherUse address:after thea zone apex SOA and the certificate-readiness questions first, then any question the sampled servers disagree on, then any that failed, as far as the per-sweep budget, the rate limit and the deadline allow. Readiness says not measured, naming the addresses, whenever one was held back. The result names the addresses sampledchange, the questions widened,when the addresses neverperson askedasks andwhether the addresses left out as slow or failing. Flags per name and type: disagreeauthoritative (servers differ, grouped by answer; vantages listed if more than one asked) · differs_by_vantage (split exactly by vantage; consistent with anycast or geo-steering, or one region lagging, which this sweep cannot tell apart) · not_authoritative (no aa bit) · lame (answered REFUSED) · no_answer (no response; the error per server) · not_asked (never sent: held back by the sample, paced out, the deadline, or 3 misses in a row) · serial_mismatch (SOA serials differ) · ttl_differs (same data, different TTLs) · same_error (every answering server gave the same error rcode) · private_address (RFC 1918, 6598, 4193, link-local,agree. loopback;Returns each range shown) · unreachable_from_edge (Cloudflare-hosted, the edge cannot dial it; asked from theoracle or thewizard instead, which via names) · relay_failed (asked from that probe, nonameserver's answer) · not_relayed (not sent from it: cap, budget, misses, deadline). A nameserver with no address found is listed as not asked, never dropped; an owner no server answered usably is not measured, never empty. Asked for HTTPS or SVCB (with A and AAAA at the same names to compare hints), the answer also reads them (svcb): each AliasMode target (at most 4, the rest named as not followed) followed one hop after the sweep from a recursive resolver, Cloudflare's DoH with recursion on, not the zone's own servers, for its own HTTPS or SVCB and its Aname and AAAA, reporting what those reads found (a ServiceMode record, address records only, none of the three, AliasMode again ortype TargetNameyou "."list, NXDOMAIN: the alias dangles)disagreements, not read when a read failed,lame or nothing concluded when the reads contradict each other; a target that reads as inside a network is not asked; ipv4hint and ipv6hint against the address records when the target is thesilent ownerservers, and mandatory keys the record does not carry (RFC 9460). It also reports certificate readiness per name: the CAA set that governs issuance and where it was found (RFC 8659 section 3), and what is published at _acme-challenge (RFC 8555 section 8.4). Use this instead of many dig calls when checking a zone after a change. Limits: 16 names, 8 types; the plan samples at most 8 addresses and sends at most 256 sweep queries per sweep, sample and widening together (a zone with more addresses is sampled, never refused for its size); 512 sweep queries a minute per caller (IPv6 per /64), 256 a minute to any one nameserver address, 2048 a minute site-wide (the delegation walk, the zone-cut check of up to 8 queries and the DS read are extra and counted by the per-call limit; the AliasMode follow, at most 12 DoH queries to one public resolver, is extra and counted by neither). One question at a time per server; a server that misses 3 in a row is not asked the rest; the zone-cut check, the grid and the DS read stop 60 s after the sweep starts, the delegation walk before them is not inside that limit, and the AliasMode follow after them has its own 4 s deadline. Give the person the api: and ask again: lines asACME printed.readiness.

 ⟨5 unchanged words⟩  or name to sweep, e.g. example.com. Also accepted as \"name\"; a URL is reducedread toas its host.","type":"string"}," ⟨42 unchanged words⟩ 

Walk the delegationUse fromwhen the root serversperson downwants to thewalk authoritativethe serverdelegation for a name, likeroot digto +trace:authoritative, recursionlike offdig at+trace. everyReturns hop,each referralsreferral and glue followed, lame, refused andor unreachable servers reported, the final authoritative answer as given, plus a healthy-or-not verdict. It reads no DS, DNSKEY or RRSIG (the dnssec_check prompt does) and asks no recursive resolver (dig with resolver all does). Every hop, failed dial and side lookup is a receipt with its time, rcode, flags, EDE and latency. Give the person the api: and ask again: lines as printed.verdict.

 ⟨2 unchanged words⟩ {"description":"The name to walk. Also accepted as \"domain\"; a URL is reducedread toas its host.","type":"string"}," ⟨16 unchanged words⟩ 

 ⟨12 unchanged words⟩ , tier-1 first: one label each, each seat'sprobe's timestamped reading (the question, the resolver address, the seatprobe, family and transport, the answer or failure ⟨47 unchanged words⟩ 

 ⟨83 unchanged words⟩  addresses, whenever one was held back. The result's holdback fieldresult saysnames whichthe addresses were sampled, whichthe questions were widened, whichthe addresses were never asked and which the widening passaddresses pacedleft out as slow or failing. Flags per name ⟨119 unchanged words⟩ via names) · relay_failed (asked from that seatprobe, no answer) · not_relayed (not sent  ⟨388 unchanged words⟩ 

 ⟨47 unchanged words⟩  warn, fail or skipped with the reason. THERE IS NO SCORE AND NO LETTER GRADE: the checks state what they found and the caller decidesNo whatscore, itno means.grade. It does not test HTTP, SMTP delivery, ⟨77 unchanged words⟩  it and marks the rows it applies to. Every transaction the audit made is a receipt under its check. Give the person the api: and ask again: lines as printed.

 ⟨275 unchanged words⟩ file cannot be asked here and answers so. EachOff-board rowaddress: ofrefused; the answer carries the /api/query URL. With resolver "all": namesone theline transportper thatgroup answered.of Anrows arbitrarywith addressthe (ansame authoritativeanswer; server,NO anANSWER ISP(asked, resolverno reply) isand NOT MEASURED (not reachableasked) overrows MCP:by DoHname. toThe atranscript guessedis httpsthe primary result://<ip>/dns-query iskeep notthe aasked-at measurementtime, ofthe it;resolver, transport, vantage, raw DNS sections, flags, rcode, EDE, latency, and the answerapi namesand ask-again links. Give the HTTPperson surfacethe thatapi: dialsand itask overagain: Do53lines oras DoT.printed (a dig with a flag off its default has no page and no ask again line).

 ⟨20 unchanged words⟩  were affected at the peak, and which. This isGive the toolperson forthe "wasapi: thereand aask DNSagain: outagelines recently".as printed.

 ⟨127 unchanged words⟩  the chain ends, not as a break. Keychecked: key tags, signersigners, nameswindows and· windowssignatures: arenot checked;verified. Every read of the signatureswalk themselvesis area notreceipt verifiedwith its time, sorcode, aflags, cleanEDE walkand islatency. notGive athe validation.person the api: and ask again: lines as printed.

 ⟨16 unchanged words⟩  and the root DNSKEY set as read now. Give the person the api: and ask again: lines as printed.

 ⟨85 unchanged words⟩ hostname is walked up to the registered domain. ContactsEvery areHTTP neverread returned.is Nota DNS:line usewith itits whenURL, everystatus, nameserverround answerstrip and thetime. nameGive stillthe doesperson notthe resolve,api: orand toask seeagain: anlines expiryas date.printed.

 ⟨34 unchanged words⟩ seat's path, and the answer says how many. Give the person the api: and ask again: lines as printed.

The live health board, not a list to choose from: isIs public DNS OKhaving trouble right now? Every public resolver isitdns watches, its verdicttier-1 fromfirst: everyone isitdnslabel seateach, thateach votedseat's thistimestamped roundreading (ok, slow,the partialquestion, bad,the noresolver data)address, its latency from one seat (the board's first seat, namedfamily inand thetransport, medianthe line,answer or another networkfailure, named on the rowflags, when that seat did notrcode, vote)EDE, DNSSEClatency), and the time it was read. The text is the 30 sa boardfresh textread andfrom the JSON is /api/statusedge. (60When s)answering, sogive the two canreadings bebehind fromthe readingslabel; upnever to'DNS ais minutefine' apart;or in'resolver thatX JSONis eachdown' resolverwithout rowthem. hasGive a statusresolver fieldfor thatone iscard. stillGive the board round's reading, andperson the votes are in its global field, each vote under its seat's name. Giveapi: aand resolverask toagain: getlines oneas card.printed.

 ⟨110 unchanged words⟩ widening pass paced out as slow or failing. PerFlags per name and type it says whether the servers agree: disagree (and which servers differ, every answered server grouped by answer, with theanswer; vantages listed whenif more than one asked), · differs_by_vantage (the answers split exactly by vantage: the same nameserver names and families, at least two servers per vantage, agree from each vantage and the vantages got different answers;vantage; consistent with an anycast or geo-steered answergeo-steering, and also withor one region of an anycast authority lagging a change, which this sweep cannot tell apart; SOA serials, CAA readiness and the ACME names keep their own checks; anything short of that evidence stays disagree, with the vantages listedapart), · not_authoritative (no aa bit), · lame (answered REFUSED), · no_answer (no response from this vantage, withresponse; the error per server), · not_asked (never sent: held back by the sample, paced out as slow or failing, the deadline, or 3 misses in a row from that server; never counted as agreement), · serial_mismatch (SOA), ttl_differs (serversserials thatdiffer) agree· onttl_differs the(same data and answered with the aa bit hand out one answer line with, different TTLs: the line and each server's TTL, one flag per line that differs), · same_error (every server that answered this questionanswering answeredserver withgave the same error rcode, such as SERVFAIL; the servers asked, not every server of the zone), · private_address (an A or AAAA answer in inside address space: RFC 1918, RFC 6598 shared space, RFC 4193 unique local, link-local or, loopback; each line with its range; it may be deliberate, and it is also what a split-horizon leak looks like fromrange outsideshown), or· unreachable_from_edge (a Cloudflare-hosted server, the Cloudflare edge cannot dial, which is our reach and not their health). Those servers areit; asked from one of two sinks instead, on the theoracle or thewizard seatinstead, over TCP with recursion off,which eachvia sinknames) with· itsrelay_failed own(asked capfrom andthat budgetseat, and eachno answer names its vantage in via (edge, sink:theoracle or sink:thewizard); relay_failed says the sink was asked and did not answer;· not_relayed says the relay did (not sendsent itfrom (itsit: cap, the sink budget, repeated misses, or the deadline). A nameserver with no address found  ⟨6 unchanged words⟩ dropped; an owner no server answered usably is reported as not measured, never as empty. Asked for HTTPS or SVCB (with A ⟨331 unchanged words⟩  after them has its own 4 s deadline. Give the person the api: and ask again: lines as printed.

 ⟨85 unchanged words⟩ rather than as of the snapshot, use check_domain. Give the person the api: and ask again: lines as printed.

 ⟨32 unchanged words⟩ reported, the final authoritative answer as given, andplus a plain verdict on whether the delegation ishealthy-or-not healthy.verdict. It reads no DS, DNSKEY or RRSIG  ⟨7 unchanged words⟩ recursive resolver (dig with resolver all does). Every hop, failed dial and side lookup is a receipt with its time, rcode, flags, EDE and latency. Give the person the api: and ask again: lines as printed.

 ⟨398 unchanged words⟩  asked from one of two sinks instead, pns2on (Phoenix)the theoracle or p3a1thewizard (Amsterdam)seat, over TCP with recursion off, each sink ⟨9 unchanged words⟩ names its vantage in via (edge, sink:pns2theoracle or sink:p3a1thewizard); relay_failed says the sink was asked and ⟨395 unchanged words⟩ 

 ⟨301 unchanged words⟩ , one flag per line that differs), same_error (every server that answered this question answered with the same error rcode, such as SERVFAIL; the servers asked, not every server of the zone), private_address (an A or AAAA answer in inside address space: RFC 1918, RFC 6598 shared space, RFC 4193 unique local, link-local or loopback; each line with its range; it may be deliberate, and it is also what a split-horizon leak looks like from outside), or unreachable_from_edge (a Cloudflare-hosted server the Cloudflare edge cannot ⟨102 unchanged words⟩  reported as not measured, never as empty. Asked for HTTPS or SVCB (with A and AAAA at the same names to compare hints), the answer also reads them (svcb): each AliasMode target (at most 4, the rest named as not followed) followed one hop after the sweep from a recursive resolver, Cloudflare's DoH with recursion on, not the zone's own servers, for its own HTTPS or SVCB and its A and AAAA, reporting what those reads found (a ServiceMode record, address records only, none of the three, AliasMode again or TargetName ".", NXDOMAIN: the alias dangles), not read when a read failed, or nothing concluded when the reads contradict each other; a target that reads as inside a network is not asked; ipv4hint and ipv6hint against the address records when the target is the owner, and mandatory keys the record does not carry (RFC 9460). It also reports certificate readiness per name: the ⟨113 unchanged words⟩ read are extra and counted by the per-call limitlimit; the AliasMode follow, at most 12 DoH queries to one public resolver, is extra and counted by neither). One question at a time per server; ⟨22 unchanged words⟩  stop 60 s after the sweep starts, and the delegation walk before them is not inside that limit.limit, and the AliasMode follow after them has its own 4 s deadline.

 ⟨3 unchanged words⟩ "The zone or name to sweep, e.g. example.comexample.com. Also accepted as \"name\"; a URL is reduced to its host.","type":"string"},"names":{ ⟨41 unchanged words⟩ 

{"properties":{"name":{"description":"The name to walkwalk. Also accepted as \"domain\"; a URL is reduced to its host.","type":"string"},"type":{ ⟨15 unchanged words⟩ 

The live health board, not a list to choose from: is public DNS OK right now? Every  ⟨102 unchanged words⟩ 

FindAuthoritative consistency, not cache propagation: find the zone's nameservers from the root down, then ⟨253 unchanged words⟩ server; never counted as agreement), serial_mismatch (SOA), ttl_differs (servers that agree on the data and answered with the aa bit hand out one answer line with different TTLs: the line and each server's TTL, one flag per line that differs), or unreachable_from_edge (a Cloudflare-hosted server the  ⟨290 unchanged words⟩ 

 ⟨10 unchanged words⟩ authoritative server for a name, like dig +trace: recursion off at every hop, referrals and sayglue infollowed, lame, refused and unreachable servers reported, the final authoritative answer as given, and a plain stepsverdict on whether the delegation is healthy. It reads no DS, DNSKEY or RRSIG (the dnssec_check prompt does) and asks no recursive resolver (dig with resolver all does).

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Root KSK board"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Incident history"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Resolver board"}

 ⟨121 unchanged words⟩  servers agree: disagree (and which servers differ, every answered server grouped by answer, with the vantages listed when more than one asked), differs_by_vantage (the answers split exactly by vantage: the same nameserver names and families, at least two servers per vantage, agree from each vantage and the vantages got different answers; consistent with an anycast or geo-steered answer, and also with one region of an anycast authority lagging a change, which this sweep cannot tell apart; SOA serials, CAA readiness and the ACME names keep their own checks; anything short of that evidence stays disagree, with the vantages listed), not_authoritative (no aa bit), lame  ⟨340 unchanged words⟩ 

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Sweep a domain across its authoritative servers"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Monitored domains board"}

{"destructiveHint":false,"idempotentHint":true,"openWorldHint":true,"readOnlyHint":true,"title":"Delegation walk"}

 ⟨193 unchanged words⟩ their health). Those servers are asked from theone pns2of sinktwo sinks instead, pns2 (Phoenix) or p3a1 (Amsterdam), over TCP with recursion off, each sink with its own cap and budget, and each answer names its vantage in via (edge, sink:pns2 or sink:pns2p3a1); relay_failed says the sink was asked and ⟨227 unchanged words⟩