Dig

The isitdns dig tool

Run dig from your browser at isitdns.net/dig: pick a name, a record type and a resolver, then read the answer. Every answer also prints the dig command, so you can paste the same query into your own terminal.

When an answer leaves something open, it also prints up to two next: lines: the next reading, as a command. A clean answer prints none. A next: line can offer: +cdflag at the same resolver, the DNSSEC chain walk, a trace from the root, the other address type, or the same question over TCP. On /dig, a next: line can be a link: a rerun, a trace, or the DNSSEC walk.

run it right here; the dig tool has every option

open in the dig tool →

Asks a resolver to name the node that answered.

$ dig @8.8.8.8 example.isitdns.net A +nsid

; <<>> DiG 9.20.11-0ubuntu0.2-Ubuntu <<>> @8.8.8.8 example.isitdns.net A +nsid

; (1 server found)

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4595

;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 512

; NSID: 67 70 64 6e 73 2d 61 74 6c ("gpdns-atl")

;; QUESTION SECTION:

;example.isitdns.net. IN A

;; ANSWER SECTION:

example.isitdns.net. 300 IN A 192.0.2.1

;; Query time: 46 msec

;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)

;; WHEN: Mon Sep 14 17:42:31 CDT 2026

;; MSG SIZE rcvd: 77

GO NOERROR and an NSID line in the pseudosection

NO GO no NSID line

what each part of this output means →

The controls#

isitdns.net/dig#

Control	What it does
Name	the name to look up; `.` alone is the root
Type	the record type: the common ones and the DNSSEC ones (every type)
Resolver	one public resolver, or Cloudflare, Google, Quad9, AdGuard, side by side to ask those four together
Run	sends the query

isitdns.net/#dig, the home page's dig tab#

Control	What it does
Transport	DoH (RFC 8484), DoT (RFC 7858), or Do53 over TCP or UDP (RFC 1035 section 4.2)
Connect via	IPv4, IPv6 or both, for DoT and Do53
Flags	`+dnssec`, `+cd`, `+subnet`, `+norec`, `+nsid` change the query; `+short` changes only the display (dig-flags)
Custom resolver	your own resolver's IP, or several side by side
Trace from root	walk the delegation from the root, no IP to enter

From a terminal#

Three paths answer curl in text. For JSON, ask the /api route beside each one with -H 'accept: application/json'; /check/<domain> and /dig/<name>/... answer that header with the same JSON themselves, and / answers it with the page.

curl -sL isitdns.net
curl -sL isitdns.net/check/example.com
curl -sL isitdns.net/dig/example.com/A/cloudflare

Excerpts, captured 2026-10-14 at 13:23Z from a Mac over HTTPS:

$ curl -sL isitdns.net
is it DNS?

  no.
  ...
  Cloudflare   ok       25 ms

$ curl -sL isitdns.net/api/status -H 'accept: application/json'
{"updatedAt":"2026-10-14T13:21:01.000Z", ... "board":{"word":"no","verdict":"no.","measured":17,"up":17,"bad":0, ...}}

$ curl -sL isitdns.net/check/example.com
  example.com resolves: A 104.20.23.154, A 172.66.147.243 · NOERROR from 1.1.1.1 over DoH; every address in Cloudflare's published ranges
  ...
  resolves · 9 ok · 1 warn · 0 fail · 1 skipped · read 2026-10-14 13:23 UTC

$ curl -sL 'isitdns.net/api/check?name=example.com' -H 'accept: application/json'
{ ... "domain":"example.com","generatedAt":"2026-10-14T13:23:51.551Z","summary":{"ok":9,"warn":1,"fail":0,"skip":1,"resolves":"resolves"}, ...}

$ curl -sL isitdns.net/dig/example.com/A/cloudflare

  isitdns · dig · example.com A
  ;; asked 2026-10-14T13:23:52.055Z over DoH (dnssec on) from the Cloudflare edge, not your network

  ;; @cloudflare (cloudflare-dns.com) over DoH · 4 ms · 179 bytes · NOERROR · flags: qr rd ra ad
  ;; asked 2026-10-14T13:23:52.055Z from the Cloudflare edge (ATL), remote address unavailable from this vantage
  ;; ANSWER (3)
  example.com.                     142  IN  A      104.20.23.154
  example.com.                     142  IN  A      172.66.147.243
  example.com.                     142  IN  RRSIG  A 13 2 300 20261015142113 20261013122113 34505 example.com. e579Km5S70z0XLhb29NHNJtgFjb5mKpAIcFUZYRZRp80S/LrscrxSEUj3xC3UmEWPekiPdx2ze8K/4LHPgIhpg==  ; key tag 34505, inside its window, expires 24 h after this read (the signature itself is not checked here)
  ;; EDE: none received

  ;; the same question from your own machine: dig +https @cloudflare-dns.com example.com A +dnssec

  browser: https://isitdns.net/dig?name=example.com&type=A&resolver=cloudflare

$ curl -sL 'isitdns.net/api/query?name=example.com&type=A&resolver=cloudflare' -H 'accept: application/json'
{"askedAt":"2026-10-14T13:23:52.289Z", ... "results":[{"resolver":{"id":"cloudflare", ...},"latencyMs":2,"response":{ ... "rcodeName":"NOERROR", ... "answer":[{"name":"example.com.","type":1,"typeName":"A","class":1,"ttl":142,"data":"104.20.23.154"}, ...]}, ...}]}

A reading with something open prints a next: line, same capture:

$ curl -sL isitdns.net/dig/usps.com/AAAA/cloudflare

  isitdns · dig · usps.com AAAA
  ;; asked 2026-10-14T13:22:11.954Z over DoH (dnssec on) from the Cloudflare edge, not your network

  ;; @cloudflare (cloudflare-dns.com) over DoH · 5 ms · 105 bytes · NOERROR · flags: qr rd ra
  ;; asked 2026-10-14T13:22:11.954Z from the Cloudflare edge (ATL), remote address unavailable from this vantage
  ;; ANSWER (0): the name exists and has no AAAA record
  ;; AUTHORITY (1)
  usps.com.                       3600  IN  SOA    a1-56.akam.net. hostmaster.akamai.com. 711474031 1200 180 1209600 3600
  ;; EDE: none received

  ;; the same question from your own machine: dig +https @cloudflare-dns.com usps.com AAAA +dnssec

  next: dig +https @cloudflare-dns.com usps.com A +dnssec
  browser: https://isitdns.net/dig?name=usps.com&type=AAAA&resolver=cloudflare

Where the query runs from#

Not from your machine. DoH, DoT and TCP queries leave from Cloudflare's edge; UDP queries leave from the isitdns sink. Your own dig goes through your local path, where many routers and firewalls answer port 53 themselves. Run the same query both ways. Where the two differ: compare resolver, transport, time and the authoritative answer (when-its-dns).

What it cannot do#

Cloudflare's resolvers over DoT or TCP. A Cloudflare Worker cannot open a TCP socket to a Cloudflare address: "Outbound TCP sockets to Cloudflare IP ranges are blocked" (Cloudflare TCP sockets docs). 1.1.1.1 works over DoH and UDP.
See your path. It shows what a clean path sees, not what your machine sees.
Retry. One query per run: 8 s for DoH, 3.5 s for DoT and TCP, 4 s for UDP, then the error shows.