isitdns hall monitor

hall monitor

Runs on your network and checks your DNS every five minutes. See what it found at http://127.0.0.1:8053/ on that machine.

run

1. run it on a machine on the network to check

docker run -d --name hall-monitor --network host -v hall-monitor:/data isitdns/hall-monitor:0.2.2@sha256:93bf44366b973bab16c61364068f90889635e7e19162b3e2d39cfc9013258ff7

2. open http://127.0.0.1:8053/ on that machine

From another machine on your network: add -e BIND=0.0.0.0.
On Ubuntu and other systemd-resolved hosts: add -v /run/systemd/resolve:/run/systemd/resolve:ro to see the server behind 127.0.0.53.

what it checks

Interception: DNS sent to 192.0.2.1 and 2001:db8::1, where no server exists. Expected: no answer.
Your resolver beside Cloudflare.
Encrypted DNS (DoT) to each public resolver isitdns watches that offers it.
A made-up name. Expected: not found.
dnssec-failed.org, signed wrong on purpose. Expected: it fails.
a.root-servers.net. Expected: 198.41.0.4.
Firefox's DoH switch, use-application-dns.net.
Where your lookups leave from, and any part of your address passed on: o-o.myaddr.l.google.com.
DNS over HTTPS: https://1.1.1.1/dns-query and https://cloudflare-dns.com/dns-query.

example

One real round from one home network, 2026-11-12T03:00:59Z (the first lines and the privacy checks). Its resolver answers NXDOMAIN for Firefox's DoH switch.

sharing: out

isitdns hall monitor   read from this box   2026-11-12T03:00:59Z

  privacy audit, asked of your resolver 127.0.0.53 (found, then what a validating resolver with no filter gives)
    a8ec5c8eac6225e8.com A             NXDOMAIN               expected NXDOMAIN
    dnssec-failed.org A                SERVFAIL               expected SERVFAIL (signed wrong on purpose; NOERROR: not validated)
    dnssec-failed.org A, cd and DO set NOERROR                expected NOERROR
    a.root-servers.net A               198.41.0.4             expected 198.41.0.4
    a.root-servers.net A over TCP      198.41.0.4             expected 198.41.0.4
    use-application-dns.net A          NXDOMAIN               expected an address (NXDOMAIN, or NOERROR with none: the operator turns Firefox DoH off)
    o-o.myaddr.l.google.com TXT        2400:cb00:27:1024::6ca2:eca0 the address your resolver asks from
      client subnet to Google          none                   the part of your address your resolver passed to Google's nameservers
    DoH https://1.1.1.1/dns-query      200                    expected 200
    DoH https://cloudflare-dns.com     200                    expected 200

Test your own path: the same checks by hand
Sources: RFC 5737, RFC 3849 (the no-server addresses), RFC 7858 (DoT), RFC 4035 (DNSSEC), root-servers.org, Mozilla (the DoH switch), RFC 7871 (address passed on), RFC 8484 (DoH)
mullvad.net/en/check, browserleaks.com/webrtc, ipleak.net: what a container cannot see from your browser

other jobs