For agents
isitdns answers programs the same way it answers people: live DNS, asked from our own seat, stamped with the time it was read. No key, no account, no paywall. The one difference is the shape. A person gets the page; a program gets JSON, dig-style text, or a tool call.
// MCP
One endpoint, Streamable HTTP, stateless, no auth. Add it to Claude, ChatGPT, Cursor, Codex or any client that speaks the Model Context Protocol.
| tool | what it answers |
|---|---|
| dig | One record from one public resolver, from all 17 side by side, or from any public address. Answer, flags, rcode, Extended DNS Errors, latency. DoH, DoT or Do53 over TCP, DNSSEC on by default, ECS, NSID and RD=0 as knobs. |
| check_domain | The five-check audit for a domain: parent and child nameservers agree, no open recursion, the DNSSEC chain, TTL sanity, mail posture. A score, a grade, each check explained. |
| trace | The delegation walk from the root servers down to the authority, like dig +trace, with a verdict on whether the delegation is healthy. |
| resolver_status | The live board: every public resolver isitdns watches and its latest reading, taken every 3 minutes over DoT. One resolver, or all of them. |
| resolver_history | The outage log for those resolvers, one line per event: when it began, how long it ran, warn or bad. One resolver or all. |
| top_domains | The DNS health of the top 100 domains as of the last daily snapshot, one probe per day at 11:11:11 UTC: rcode, addresses, DNSSEC and rank movement. One domain, or the whole board. |
| dns_events | Days when several resolvers were unhealthy at once, as episodes with start, duration and how many were affected at the peak. The tool for "was there a DNS outage recently". |
| ksk_board | The RFC 8509 root key sentinel across the same resolvers, and the root DNSKEY set as read now. |
Each tool returns text a model can read as it stands, plus the same JSON as
structuredContent. A client that opens the endpoint with GET gets 405; there
is no server-initiated stream and nothing to resume.
// HTTP
The same tools as URLs. JSON by default; a curl user agent, or Accept: text/plain, gets text.
The full list, with every parameter and response shape, is the OpenAPI document at
/api/openapi.json. The knobs on /api/query:
transport=doh|dot|tcp53, dnssec=0, cd=1,
ecs=192.0.2.0/24, norec=1, nsid=1,
family=v4|v6|both, ip= for up to six custom targets.
You can also ask DNS itself. The verdict is written into the zone every 3 minutes, using the
isitdns protocol: a status verdict served as TXT and as an address ladder, designed by Neal
Shelton, first published 2026-09-03, written up as draft-shelton-isitdns-00.
What it specifies.
// what every answer carries
- The time it was read. A board reading older than five minutes says "can't say" rather than repeating the last number.
- The seat it was read from. Queries run from the isitdns seat, never from your network. A resolver that is fine from here can be broken behind your router, and the answer says which seat asked.
- No mocks. When there is no data the answer says so. A resolver we do not probe is marked unmonitored, not guessed.
- The transport. Which resolver was asked, over which protocol, on which address, and what it could not be asked over and why.
- A rate limit. 100 a minute per address: every MCP tool call, and over HTTP every route that asks a real server. Reading the board over HTTP is not counted.
// reading the site
/llms.txt is the map. The home page carries the board's verdict in its HTML, so a fetch without JavaScript reads a true answer. /sitemap.xml lists every page. The content signal in /robots.txt says search and AI answers may read and link; training is refused.