Is it DNS?
no. No issues detected at major recursive providerschecked 2m ago
| name | v4 DoH | v4 DoT | v6 DoH | v6 DoT | worst | state |
|---|---|---|---|---|---|---|
| Cloudflare | 38 ms | 32 ms | 16 ms | 14 ms | 38 ms | OK |
| 22 ms | 15 ms | 16 ms | 20 ms | 22 ms | OK | |
| Quad9 | 14 ms | 43 ms | 14 ms | 14 ms | 43 ms | OK |
| OpenDNS (Cisco Umbrella) | 14 ms | 14 ms | 15 ms | 16 ms | 16 ms | OK |
| AdGuard DNS | 27 ms | 27 ms | 27 ms | 27 ms | 27 ms | OK |
| CleanBrowsing | 27 ms | 30 ms | TIMEOUT | 15 ms | 30 ms | OK |
| Control D | 17 ms | 15 ms | 17 ms | TIMEOUT | 17 ms | OK |
| Quad9 (unfiltered) | 14 ms | 16 ms | 16 ms | OK | ||
| AdGuard Family | 27 ms | 28 ms | 28 ms | OK | ||
| CleanBrowsing Family | 14 ms | 34 ms | 34 ms | OK | ||
| AdGuard (Non-filtering) | 28 ms | 27 ms | 28 ms | 27 ms | 28 ms | OK |
| OpenDNS FamilyShield | 15 ms | 15 ms | 15 ms | OK | ||
| NextDNS | 30 ms | 30 ms | OK | |||
| Cloudflare for Families (Malware) | 39 ms | 40 ms | 20 ms | 17 ms | 40 ms | OK |
| Cloudflare for Families (Family) | 37 ms | 38 ms | 25 ms | 18 ms | 38 ms | OK |
| Mullvad DNS (Base) | 32 ms | 109 ms | 32 ms | 111 ms | 111 ms | OK |
| DNS4EU (Protective) | 252 ms | 111 ms | 255 ms | 110 ms | 255 ms | OK |
| CIRA Canadian Shield | not measured | |||||
| Quad101 (TWNIC) | not measured | |||||
| Comodo Secure DNS | not measured | |||||
| AT&T DNS | not measured |
This project exists as a free resource for other admins facing the dreaded question: Is it DNS? My goal is to develop a set of tools capable of showing that, in fact, it is not always DNS.
New to DNS? Learn more at the wiki.
// diagnose my network
Run a small battery of DNS checks from your own browser. Each one is an independent observation; together they vote and converge on a single picture of your DNS path, then name what it looks like and what to do.
Takes a couple of seconds. Nothing is stored.
Browsers can only test DNS over HTTPS. We cannot see your raw port 53 path directly, so some findings are inferred from DoH behaviour rather than measured. Inferred findings are labelled.
Investigate a domain
Ask every major resolver, audit the delegation chain, check each authoritative nameserver, validate DNSSEC, and return every record we can find.
Try:
dig
Learning examples
Anatomy of a dig answer
Sections of a response
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41037 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; QUESTION SECTION: ;example.com. IN A ;; ANSWER SECTION: example.com. 300 IN A 192.0.2.1
Illustrative, not a live capture: example.com is the
documentation name from RFC 2606 and 192.0.2.1 the documentation address from
RFC 5737, so this block cannot go stale. Run the tool above for a real one.
| HEADER | opcode, status (RCODE), random 16-bit transaction id. |
|---|---|
| QUESTION | What you asked. Echoed back so you know the server understood. |
| ANSWER | The actual records. Each row is name TTL class type value. |
| AUTHORITY | Who's authoritative for this zone (NS records, usually). |
| ADDITIONAL | Helpful extras: glue A/AAAA for the auth servers, or the OPT pseudo-record (EDNS0 data: DNSSEC, ECS, NSID). |
Header flags
qr | Query / Response. Set on a response, off on a query. | ;; flags: qr rd ra |
|---|---|---|
rd | Recursion Desired: the client asked the server to resolve end-to-end. | ;; flags: qr rd ra |
ra | Recursion Available: the server is willing to recurse for you. | ;; flags: qr rd ra |
ad | Authenticated Data: DNSSEC validated successfully. | ;; flags: qr rd ra ad |
cd | Checking Disabled: the client asked the server to skip DNSSEC validation. | ;; flags: qr rd ra cd |
aa | Authoritative Answer: only set by authoritative nameservers, never by recursives. | ;; flags: qr aa rd |
tc | TrunCated: answer was too big for UDP. Client should retry over TCP. | ;; flags: qr tc rd |
do | DNSSEC OK: EDNS0 bit in the OPT record. Client says "I want DNSSEC." | ;; OPT … flags: do |
Response codes (status)
NOERROR | Query worked. ANSWER section may still be empty (the name exists, but not for that record type). |
|---|---|
NXDOMAIN | Name doesn't exist at any type. AUTHORITY usually has a SOA with negative-cache TTL. |
SERVFAIL | Server tried and gave up. Often: DNSSEC validation failure, upstream timeout, or misconfigured zone. |
REFUSED | Server refuses. Asking an auth for a zone it doesn't host, or a recursive without permission. |
FORMERR | Server thinks your query is malformed (rare; usually a buggy client). |
NOTIMP | Server doesn't implement this query type / operation. |
Record types you'll meet
A | IPv4 address | example.com. 300 IN A 192.0.2.1 |
|---|---|---|
AAAA | IPv6 address | example.com. 300 IN AAAA 2001:db8::1 |
CNAME | Canonical name: alias pointing to another name | www.example.com. 300 IN CNAME example.com. |
MX | Mail exchange: priority + hostname | example.com. 300 IN MX 10 mail.example.com. |
NS | Authoritative nameserver for the zone | example.com. 300 IN NS ns1.example.com. |
TXT | Arbitrary text: SPF, DKIM, DMARC, ownership verification | example.com. 300 IN TXT "v=spf1 -all" |
SOA | Start of Authority: zone metadata (serial, refresh, retry, expire, neg-cache TTL) | example.com. 300 IN SOA ns.example.com. hostmaster.example.com. 2026052501 7200 3600 1209600 3600 |
PTR | Pointer: reverse DNS, name lookup for an IP | 1.1.1.1.in-addr.arpa. 1800 IN PTR one.one.one.one. |
CAA | Certification Authority Authorization: which CAs may issue certs for this domain | example.com. 300 IN CAA 0 issue "letsencrypt.org" |
SRV | Service location: priority, weight, port, target | _xmpp._tcp.example.com. 300 IN SRV 10 5 5222 chat.example.com. |
HINFO | Host info: repurposed by RFC 8482 to refuse ANY queries | cloudflare.com. 3789 IN HINFO "RFC8482" "" |
RRSIG | DNSSEC signature over an RRset | example.com. 3600 IN RRSIG A 13 2 3600 20260601000000 20260501000000 12345 example.com. <sig…> |
DNSKEY | DNSSEC public key for the zone (KSK or ZSK) | example.com. 3600 IN DNSKEY 257 3 13 <pubkey…> |
DS | Delegation Signer: fingerprint of child zone's KSK, lives in the parent | example.com. 86400 IN DS 12345 13 2 <sha256 digest…> |
OPT | EDNS0 pseudo-record: container for DO bit, ECS, NSID, etc. Lives in ADDITIONAL. | ;; OPT PSEUDOSECTION: EDNS: version 0; flags: do; udp: 4096 |
Anatomy of one record line
example.com. 300 IN A 192.0.2.1
example.com. | Owner name. Trailing dot = fully qualified. |
|---|---|
300 | TTL in seconds: how long any cache should remember this. |
IN | Class. Effectively always IN (Internet). CH / HS are historical. |
A | Record type. |
192.0.2.1 | Record data: format depends on type (IP, hostname, text, etc.). |
admin@ -- when it was actually DNS windows where ≥2 resolvers went bad together · last 7 days
admin@ -- resolver score combined health 0-100 · latency + uptime + DNSSEC + operator status
admin@ -- notable incidents last 30 days · sub-10-min flaps hidden by default
admin@ -- Resolvers we monitor
probe: transport: DoT # RFC 7858, port 853 (dig +tls) fallback: none # a resolver with no DoT endpoint is not probed interval: 180s timeout: 4s cache: off query: name: cloudflare.com # one pinned canary, the same for every resolver type: A flags: [RD, DO] # recursion desired + DNSSEC requested record: - answered # RCODE 0; the answer section is not inspected - latency_ms - ad_flag # DNSSEC validated (AD), signed canaries only verdict: ok: latency < 400ms warn: 400ms to 1500ms bad: latency 1500ms or more OR no answer OR any rcode but NOERROR
admin@ -- operator status what each provider's own status page says
admin@ -- resolvers current status · last 24h timeline · addresses · docs
ISP & legacy resolvers unmonitored, listed for reference
admin@ -- cat readme
This project exists as a free resource for other admins facing the dreaded question: Is it DNS? My goal is to develop a set of tools capable of showing that, in fact, it is not always DNS.
New to DNS? Learn more at the wiki.
What's up with the colors on this site? Easy, my favorite color is NEON.