is it DNS?

Online dig: run dig from your browser

Type a name, pick a record type and a resolver, press run. The query is real and the answer is dig's, printed the way dig prints it. Nothing to install, no account, no ads.

The full tool adds transports, flags, a custom resolver address and the terminal command for every query.

// examples

// what it runs

  • One real query per run, sent from a Cloudflare edge location to the resolver you picked, or one per resolver when you pick the compare option. It is not sent from your network, so it says what that resolver answers, not what your laptop is getting.
  • The wire format is DNS over HTTPS, RFC 8484 binary, POSTed as application/dns-message. The answer is decoded from those bytes, so the sections, the flags and the rcode are the server's own.
  • DNSSEC is requested (+dnssec) and checking is left on, so the ad flag in the output means that resolver validated the answer.
  • The list above is the 16 public resolvers that publish a DoH endpoint. The last option asks all 17 on the board side by side, and a resolver with no DoH endpoint answers that one over Do53 instead, which the output says on its own line.
  • The full tool takes any public resolver address, and DoT, Do53 over TCP and Do53 over UDP. UDP leaves from a probe off Cloudflare, because the Workers runtime cannot open a UDP socket (Cloudflare, TCP sockets).
  • Rate limit: 100 requests a minute per address. No key, no account.

// flags

The form sends +dnssec. The rest are on the URL form of the same query, /api/query, and in the full tool:

  • dnssec=0 clears the DO bit. On by default here.
  • cd=1 is +cdflag: return the answer without validating it.
  • norec=1 is +norec, RD=0, which is how you ask an authoritative server rather than a recursive one.
  • nsid=1 is +nsid, RFC 5001: the node that answered names itself.
  • ecs=192.0.2.0/24 is +subnet, RFC 7871, for geo-split answers.
  • transport=doh|dot|tcp53|udp53 and family=v4|v6|both.
  • A type the list does not carry goes through as a number or as TYPE65, decoded as generic rdata per RFC 3597.
  • Extended DNS Errors (RFC 8914) are printed when the server sends one, which is how a blocked name says it was blocked rather than missing.

From a terminal, the same thing: curl -sL isitdns.net/dig/example.com/MX.

// the manual