Instant diagnosis

Is it DNS? Find out in two queries.

No install. No agent. Nothing phones home. Paste two ordinary DNS queries into any terminal you already have. The queries are the diagnosis — you read the answer yourself. Works on a laptop, a server, a container, a router shell: anywhere DNS resolves.

0 installs 0 scripts 0 telemetry 2 queries

Run it right here, over DoH

One click. Your browser mints a fresh nonce and asks over DNS-over-HTTPS (RFC 8484). Nothing is stored; the query goes to a public resolver, same as any page load.

Or paste it into any terminal

macOS / Linux (dig) Windows (PowerShell) nslookup (anywhere)

1 · Is your DNS answer being rewritten?

Ask for the public tripwire name. Its answer is a fixed test address (192.0.2.111, reserved and unroutable). If you get anything else back, something on your path rewrote the answer.

$ dig +short canary.probe.isitdns.net

PS> (Resolve-DnsName canary.probe.isitdns.net -Type A).IPAddress

$ nslookup -type=A canary.probe.isitdns.net

good: 192.0.2.111 · anything else: your DNS answer was rewritten in flight

2 · Did your query reach the genuine authority?

Ask for a name that has never existed and never will — a fresh random label. No cache, forwarder, or interceptor can have an answer ready, so a reply means your query actually reached a real authority. The reply is a signed receipt (verify it with the one-file probe if you want proof, not just a signal).

$ N=$(head -c16 /dev/urandom | base32 | tr 'A-Z' 'a-z' | tr -d '=' | cut -c1-26) dig +short TXT x$N.t.probe.isitdns.net

PS> $N = -join ((97..122) | Get-Random -Count 26 | % {[char]$_}) Resolve-DnsName -Type TXT "x$N.t.probe.isitdns.net" | % Strings

$ nslookup -type=TXT xq7niqzncbdzhjpzstc6viptor.t.probe.isitdns.net

good: a base64url TXT string comes back · empty / SERVFAIL: your path never reached the authority

Why this is trustworthy: a DNS query to a public name is not telemetry — you are reading a public authority's answer, the same way dig always has. Nothing is installed and nothing reports back about you. For cryptographic proof (verify the signature, see the resolver exit the authority saw), run the keyless one-file probe — still no daemon, no inbound ports.

Want proof, not just a signal?

One file, no root, no daemon, deletes clean. It runs the same idea over plain DNS, DoT, and DoH, and verifies the signature for you:

$ curl -fsSL https://isitdns.net/join.sh | sh -s -- my-name

watch how it works DNS for AI the protocol