isitdns?

Domain check: is it DNS, for any domain

domain check

Is this domain's DNS working: does it resolve at the public resolvers, do its nameservers agree, does its DNSSEC chain hold, and what do the eleven audit rows read?

Investigate a domain

resolvers · delegation · each nameserver · DNSSEC · records

1. a domain, then check

Try:
read

These lines read the audit's last line (the reading below, /check/<domain>, check_domain over MCP). The page above shows the same rows with the resolvers and each nameserver beside them.

  • GO resolves and 0 fail: the name answers at the public resolvers and no audit row failed. A warn row is a setting the row names, not a failure (the reading below: the zone is not signed).
  • NO GO a fail row, or the first line does not read resolves -> zone operator: the row names the record, the server asked and what came back.
  • NOT RUN a skip row: that check did not apply or could not be asked, and the row says why (the reading below: no DS at the parent, so no digest to match). Not a GO for that row.
example

Saved example. google.com, the audit as curl -sL isitdns.net/check/google.com printed it, read 2026-10-29 07:43 UTC:

  google.com resolves: A 142.250.9.139, A 142.250.9.100, A 142.250.9.138, A 142.250.9.101, A 142.250.9.113, A 142.250.9.102 · NOERROR from 216.239.34.10, a server for google.com

  isitdns · domain audit · google.com

  we walked the delegation to google.com's own nameservers and asked them directly.

  1. Parent/child NS consistency      ok    Parent and child agree on all 4 nameservers. None of the 4 nameserver names is an alias or `NXDOMAIN` (in-domain names answered by the zone's server at `216.239.34.10` over TCP with RD=0).
  2. Open recursion check             ok    Answered `REFUSED` with no records to a recursive query for `dns.google`
  3. DNSSEC presence + validation     warn  No `DS` at the parent and no `DNSKEY` at the apex: the zone is not signed
  4. TTL sanity                       ok    Apex `A` TTL is `300s`, inside 30 and 604800, and the `SOA` minimum is `60s`, inside 86400
  5. SPF (email anti-spoof)           ok    The `SPF` record carries `~all`: unlisted senders get a softfail result (1 DNS-querying term written; the lookups inside included records are not followed here, so the total against the limit of 10 is not measured)
  6. DMARC (email policy)             ok    The `DMARC` record carries `p=reject`
  7. CAA (cert issuance lock)         ok    1 `CAA` record at `google.com`, naming pki.goog
  8. Wildcard subdomain check         ok    A made-up subdomain returned `NXDOMAIN`: no wildcard
  9. Glue at the parent               ok    All 4 nameservers named under `google.com` carry glue in the parent's referral: `ns2.google.com` (216.239.34.10), `ns1.google.com` (216.239.32.10), +2 more. The glue of 4 nameservers matches the `A` and `AAAA` answers from the zone's server at `216.239.34.10` over TCP with RD=0.
  10. DS matches a live DNSKEY         skip  The parent publishes no `DS` record for `google.com`, so there is no digest to match against a key.
  11. UDP truncation and TCP fallback  skip  216.239.34.10 answered the apex `DNSKEY` set `NOERROR` with an empty answer section over UDP and over `TCP`, so there is no answer here to truncate. Measured from our theoracle (Phoenix, North America) probe, off Cloudflare's network.

  resolves · 8 ok · 1 warn · 0 fail · 2 skipped · read 2026-10-29 07:43 UTC

  full report: https://isitdns.net/#check?d=google.com

This reading earns the GO line: resolves, 8 ok, 1 warn (DNSSEC: the zone is not signed), 0 fail, 2 skipped.

from your own machine
curl -sL isitdns.net/check/example.com

The same audit as text. Add -H 'accept: application/json' for JSON.

the manual
other jobs