The isitdns protocol

• When something breaks, the first question is "is it DNS?". This protocol answers it with one dig, from any network, with no account.
• It is a simple way to verify that a query from where you sit reached isitdns's own authoritative name servers: the report channel answers with what arrived there (whoami: the address of the resolver that asked; who: the kind of network it came from), and the canary's exact answer tells a substituted or rewritten answer from the real one.
• The read surface carries the same verdict the site shows, signed with DNSSEC, so a script or an AI agent can check it without trusting a web page.

The read surface is eight names directly under isitdns.net, and a version record at _isitdns, whose TXT records (and the A records of help and isit) carry the verdict the site shows, stamped with the time of its newest reading.

• helpthe verdict sentence, the menu of names, the receipt line, the tokens; A: the word as a code
• isitthe tokens, then the word; A: the word as a code
• whyeach resolver that is not ok, or "all measured resolvers answering"
• kskthe root key roll board: which public resolvers trust which root key
• cloudflarethat resolver's line: status, latency, DNSSEC, then one string per address family and transport
• googlethe same, for Google Public DNS
• quad9the same, for Quad9
• adguardthe same, for AdGuard DNS
• _isitdnsthe version record: v=isit1 surface=8 round=180 spec=https://isitdns.net/wiki/dig/ask-dns

Every name is <name>.isitdns.net, one TXT each, TTL 60 s; the version record caches longer. The zone is DNSSEC-signed. Every line describes isitdns's own probes, never your network; the help record's receipt line says so: "probe: ours not yours".

A record is one or more strings; the fields below are what isit and the last string of help carry.

• stateok, degraded, failing or stale: the word as a token
• badresolvers failing from every probe that read them
• measuredresolvers with a verdict
• probesprobes the verdict was read from; 0 when nothing was measured
• seatsthe same count under its old name, served beside probes at surface 8
• asofthe newest reading behind the line, UTC, to the second; not the time the record was written

The word, and its code in the A record of help and isit:

• 127.0.0.2no (state=ok): no measured resolver is struggling
• 127.0.0.3mostly (state=degraded): some resolvers are struggling
• 127.0.0.4maybe (state=failing): half or more are down
• 127.0.0.5no data (state=stale): no verdict

127.0.0.1 is never one of these codes. The addresses are loopback so a code is never a host to connect to (RFC 5782 section 2.1).

The worked example is one question to isit.isitdns.net, asked over DoH, read field by field.

"state=ok bad=0 measured=16 probes=3 seats=3 asof=2026-10-30T16:21:01Z" "no"

127.0.0.2

"v=isit1 surface=8 round=180 spec=https://isitdns.net/wiki/dig/ask-dns"

label:live at capture, no

The same question from any machine, through its own resolver: dig +short isit.isitdns.net TXT.

A client is any program that turns these records into a verdict; these are the rules it follows.

1. A client MUST join the strings of one record with nothing between them (as RFC 7208 section 3.3 does for multi-string TXT). In help each part is found by its prefix: is it DNS? , ask: , receipt: , state=.
2. A stamp is live when -180 <= age < 600 seconds, age being the client's UTC clock minus the stamp; 1200 in place of 600 for ksk. A stamp that is not live is no data, whatever the word beside it says.
3. The TXT wins. An A answer beside a TXT that is not live, or beside no TXT, is no data. A client MUST NOT connect to a code address, and MUST treat 127.0.0.1 or an address outside the four codes as not this protocol.
4. A token line without state or asof, or with a key twice, is not usable. Unknown keys MUST be ignored. A word and a state that disagree are no reading.
5. SERVFAIL, a timeout, REFUSED, NXDOMAIN, or NOERROR with no record for one of these names is no reading, never a verdict. More than one TXT, or more than one A, at one name is no reading.
6. A surface the client does not implement, or a version record that does not open with v=isit1, MUST NOT be turned into a verdict, and MUST NOT be reported as a DNS outage.
7. A client SHOULD validate the answer itself, or accept the AD bit only from a validating resolver it trusts over a secure channel (RFC 4035 section 4.9.3). A bogus answer MUST NOT be read as a verdict.

The grammar of every record, and a reader that uses exactly these bounds: asking DNS about isitdns.

The report channel is three names under probe.isitdns.net whose answer is made from the query that reached isitdns's own name servers.

• canaryA 192.0.2.111, exactly; any other answer came from something answering in its place, or the zone was changed
• whoA 192.0.2.1: the query came from Cloudflare's network; 192.0.2.8: from Google Public DNS's; 192.0.2.99: from a network with no published list. TXT src=<address> via=<cloudflare, google or none>
• whoamiTXT: the address the query came from

Each is <name>.probe.isitdns.net, DNSSEC-signed; who and whoami answer with TTL 0, so every query is read fresh. The addresses are documentation addresses (RFC 5737). A match says the query reached us from that network; it does not say the path was clean.

192.0.2.1

"src=172.71.29.237 via=cloudflare"

192.0.2.111

Not running today: the beacon, sessions, and a per-query read-back of the transport and flags a query arrived with.

What a query to these names or a request to the site leaves with isitdns, every field and for how long, is on one page: /privacy.

This page is version 2.1 of the isitdns protocol, read surface 8, published from spec 2.1-draft at the commit below.

• published2026-10-30, first
• surface8, as _isitdns.isitdns.net serves it
• spec commit32ad1fb7931aa5f344cbe7a25bf8fa979128ea1b
• byNeal Shelton