Run a probe

A probe measures the DNS path from your network to our authoritative servers, and tells you what your ISP is actually doing to your DNS. About a minute to install, and you can read the whole thing first.

$ curl -fsSL https://isitdns.net/join.sh | sh

The four levels

Only one thing separates them: whether the node holds a signing key. You are level 2.

	Level	Signs	What it gives us	Who runs it
1	Check	no	is it DNS for me, right now	anyone, in a browser
2	Probe	no	breadth: real homes, real ISPs, real geography	you
3	Authority	yes	proof, and which hop broke	operators
4	Federation	yes	proof a third party can verify	enterprises

Everything below level 3 is safe to hand to a stranger, because it can add evidence but never manufacture it. That asymmetry is the whole reason we can publish this.

A probe at your house is worth more to us than a datacenter server. Cloud servers mostly see clean, boring DNS. Home connections are where the interesting things live: ISP resolvers that quietly rewrite answers, hidden forwarders you never configured, CGNAT, and "encrypted DNS" that turns out not to be encrypted. If you run exactly one, run it at the house.

What you are running

Every cycle it makes up a random name, looks it up through your resolver, and our server signs a receipt recording the IP your resolver actually arrived from. The probe relays that signed receipt back. It holds no key, so it cannot fake a result: we verify our own signature on our end. It is a measuring stick, not a sensor on your network.

It does not read your traffic, log your browsing, listen on any port, run as root, or install anything you cannot see. Outbound DNS queries and one HTTPS POST every five minutes.

Requirements

python3, which is already on macOS and every Linux
outbound DNS and HTTPS
that is the whole list. No pip, no packages, no root.

Read it before you run it

Piping a script to a shell deserves a look first. Ours is short on purpose so you actually can.

$ curl -fsSL https://isitdns.net/join.sh -o join.sh $ less join.sh $ sh join.sh

Which machines

Run it on as many as you like, and name each one:

$ ISITDNS_LABEL=my-house curl -fsSL https://isitdns.net/join.sh | sh

A Raspberry Pi, an always-on desktop, a NAS, or the box your sites already run on are all fine. It needs to stay powered on to be useful, but nothing breaks if it sleeps.

Check it is working

$ ~/.local/bin/isitdns-probe --once

You want verdict PATH REACHED THE GENUINE AUTHORITY. Add --dry-run to measure and send nothing, or --json for raw output.

$ systemctl --user status isitdns-probe.timer

Settings

Setting	Default	What it does
`ISITDNS_LABEL`	hostname	the name your probe shows up as
`ISITDNS_INTERVAL`	300	seconds between measurements
`ISITDNS_NO_TIMER`	unset	set to 1 to install with no timer

Uninstall

$ systemctl --user disable --now isitdns-probe.timer $ rm -f ~/.local/bin/isitdns-probe ~/.config/systemd/user/isitdns-probe.* $ rm -rf ~/.config/isitdns-probe

That is everything it ever touched.

Trouble

The measurement fails or times out. That is itself a finding: your resolver could not reach our authoritative servers. Run --once --json and send us the output.

systemctl --user complains on a server. Some minimal images have no user session. Run sudo loginctl enable-linger $USER, or let the installer fall back to cron, which it does automatically.

Behind CGNAT with no public IP. Completely fine. The probe only makes outbound connections and never needs to be reachable.

Why three

One source gives you no truth. Two disagree and you cannot tell which one is lying. Three is quorum: you can name the liar. It is the same rule NTP has always used, applied to DNS paths. Below three you get detection without attribution.

So adding your probe can only add breadth. It can never weaken a verdict.

What we store, and what you get

Aggregates and the signed receipt. We record which country a report came from so your probe can appear on the map. We do not store your IP. No browsing history, no query log, no personal data, nothing sold or shared.

your own domains monitored from every vantage, so you hear it from us and not from a customer
a named node on the map
an honest answer to "what is my ISP actually doing to my DNS", which is usually a surprise