Serve on the jury

Run a juror: a tiny agent that measures the DNS path from your network to our authoritative servers. About a minute to install, and you can read the whole thing first.

$ curl -fsSL https://isitdns.net/join.sh | sh

What you are running

Every cycle it makes up a random name, looks it up through your resolver, and our server signs a receipt recording the IP your resolver actually arrived from. The juror relays that signed receipt back. It holds no key, so it cannot fake a result: we verify our own signature on our end. It is a measuring stick, not a sensor on your network.

It does not read your traffic, log your browsing, listen on any port, run as root, or install anything you cannot see. Outbound DNS queries and one HTTPS POST every five minutes.

Requirements

python3, which is already on macOS and every Linux
outbound DNS and HTTPS
that is the whole list. No pip, no packages, no root.

Read it before you run it

Piping a script to a shell deserves a look first. Ours is short on purpose so you actually can.

$ curl -fsSL https://isitdns.net/join.sh -o join.sh $ less join.sh $ sh join.sh

Which machines

Run it on as many as you like, and name each one:

$ ISITDNS_LABEL=my-house curl -fsSL https://isitdns.net/join.sh | sh

Your house is the valuable one. Datacenter servers mostly see clean, boring DNS. Home connections are where the interesting things show up: ISP resolvers that quietly rewrite answers, hidden forwarders, CGNAT, and "encrypted DNS" that is not actually encrypted. If you only run one, run it at the house.

A Raspberry Pi, an always-on desktop, a NAS, or the box your sites already run on are all fine.

Check it is working

$ ~/.local/bin/isitdns-juror --once

You want verdict PATH REACHED THE GENUINE AUTHORITY. Add --dry-run to measure and send nothing, or --json for raw output.

$ systemctl --user status isitdns-juror.timer

Settings

Setting	Default	What it does
`ISITDNS_LABEL`	hostname	the name your juror shows up as
`ISITDNS_INTERVAL`	300	seconds between measurements
`ISITDNS_NO_TIMER`	unset	set to 1 to install with no timer

Uninstall

$ systemctl --user disable --now isitdns-juror.timer $ rm -f ~/.local/bin/isitdns-juror ~/.config/systemd/user/isitdns-juror.* $ rm -rf ~/.config/isitdns-juror

That is everything it ever touched.

Trouble

The measurement fails or times out. That is itself a finding: your resolver could not reach our authoritative servers. Run --once --json and send us the output.

systemctl --user complains on a VPS. Some minimal images have no user session. Run sudo loginctl enable-linger $USER, or let the installer fall back to cron, which it does automatically.

Behind CGNAT with no public IP. Completely fine. The juror only makes outbound connections and never needs to be reachable.

Notaries and jurors

Two roles, and the difference is the whole security model.

	Notary	Juror (this)
Holds a signing key	yes	no
Can create a proof	yes	no, cannot forge
Who runs it	operators	anyone

A juror weighs evidence, it never manufactures it. Three is quorum: with one you have no truth, with two you cannot tell which is lying, with three you can. Adding a juror can only add breadth. It can never weaken a verdict.

What we store, and what you get

Aggregates and the signed receipt. We record which country a report came from so your juror can appear on the map. We do not store your IP. No browsing history, no query log, no personal data, nothing sold or shared.

your own domains monitored from every vantage, so you hear it from us and not from a customer
a named node on the map
an honest answer to "what is my ISP actually doing to my DNS", which is usually a surprise