Tools

One page per job. Each takes a name, reads it live, and says where and when.

• The isitdns protocol

  DNS names under isitdns.net that answer "is it DNS?" with records anyone can read with dig.

  dig +short isit.isitdns.net TXT · whoami.probe.isitdns.net TXT · who.probe.isitdns.net A · canary.probe.isitdns.net A · ksk.isitdns.net TXT · _isitdns.isitdns.net TXT

• Domain check

  Check a domain end to end: resolvers, nameservers, delegation, DNSSEC and the audit.

• Registration

  See whether a domain is on hold or expired, and which nameservers its registry lists.

• DNSSEC chain check

  Find where a domain's DNSSEC chain breaks, without verifying signatures.

• SERVFAIL diagnosis

  Find out whether DNSSEC is why a name returns SERVFAIL.

• Delegation trace

  Follow a domain from the root to the server that answers for it.

• Nameserver consistency

  Check that every nameserver for a zone gives the same answer.

• dig

  Look up one record at one public resolver.

• Resolver comparison

  Choose two public resolvers and compare their answers.

• DNS change check

  See whether a record change has reached the public resolvers.

• Dig reader

  Paste a dig, nslookup or Resolve-DnsName you ran and read what it says.

• Does your block survive DNSSEC?

  Three digs behind your forwarder, read as held (denied or sinkholed), held as a failure, bypassed, not a block, or not read.

• Test your own path

  Run DNS checks from this browser, and dig a fresh name from your machine to see what reached our nameservers.

• Hall monitor

  A container that reads your network every five minutes, with a privacy audit; nothing goes to isitdns by default.

• A month in DNS

  One issue a month: the board, what broke and for how long, and the anomalies.

• CAA check

  See which certificate authorities can issue for a domain.

• _acme-challenge check

  Check the record a CA reads before it issues a certificate.

• agents

  Use these tools from an AI assistant.