isitdns? wiki/Reference/What a Cloudflare zone should look like
Reference

What a Cloudflare zone should look like

Run 2026-09-29, thewizard. Times UTC.

NS#

dig -4 @a.gtld-servers.net isitdns.net NS +norecurse +noall +authority
isitdns.net.		172800	IN	NS	hera.ns.cloudflare.com.
isitdns.net.		172800	IN	NS	coleman.ns.cloudflare.com.
dig -4 @coleman.ns.cloudflare.com isitdns.net NS +short
coleman.ns.cloudflare.com.
hera.ns.cloudflare.com.

13:50Z. Parent and child agree (RFC 1034 section 4.2.1).

A and AAAA at the apex#

dig +short isitdns.net A
188.114.97.0
188.114.96.0
dig +short isitdns.net AAAA
2a06:98c1:3120::
2a06:98c1:3121::

13:50Z. Addresses in Cloudflare's published ranges.

www#

dig -4 @coleman.ns.cloudflare.com www.isitdns.net A +noall +answer
www.isitdns.net.	300	IN	A	188.114.96.0
www.isitdns.net.	300	IN	A	188.114.97.0

13:50Z. Reads as A from the authority; no CNAME in the answer.

DS and DNSKEY#

dig -4 @a.gtld-servers.net isitdns.net DS +norecurse +short
2371 13 2 2DF8E1D4E0855DF60F2A8B51C914F2F2866ED1E3344F74F9682DAC4D 42D18802

The zone's keys, validated.

 dig @1.1.1.1 isitdns.net DNSKEY +multiline
; <<>> DiG 9.18.39-0ubuntu0.24.04.7-Ubuntu <<>> @1.1.1.1 isitdns.net DNSKEY +multiline
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status:
NOERRORThe server had no complaint about the question.
, id: 15593
;; flags:
qrThis message is the answer coming back, not the question going out.
rdYou asked this server to go and find the answer for you.
raThis server says it is willing to go and find answers for you.
adThis server says it checked the signatures, and they held up.
; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;isitdns.net. IN
DNSKEYYou asked for the public keys this zone signs with.
;; ANSWER SECTION:
isitdns.net.
3600How many seconds this answer can be reused before asking again. From a cache it is the time left, so it counts down.
IN DNSKEY 256 3 13 (
oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeq
CYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x8fGAa2XhSA==
) ; ZSK; alg = ECDSAP256SHA256 ; key id = 34505
isitdns.net. 3600 IN DNSKEY 257 3 13 (
mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+Gq
JxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==
) ; KSK; alg = ECDSAP256SHA256 ; key id = 2371
;;
Query timeHow long this one lookup took, start to finish.
: 8 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Tue Sep 29 13:50:36 UTC 2026
;; MSG SIZE rcvd: 200

GO ad set, and a KSK whose key id is the DS key tag, 2371

NO GO no ad, or no key id 2371

run this query in the dig tool →

13:50Z. DS 2371, algorithm 13, digest 2 at the parent, matching the live KSK; ad set (RFC 4035 section 5). id, Query time, WHEN: move each run. TTLs: count down.

CAA#

dig +short isitdns.net CAA
0 issue "comodoca.com"
0 issuewild "ssl.com"
0 issuewild "letsencrypt.org"
0 issue "sectigo.com"
0 issue "pki.goog; cansignhttpexchanges=yes"
0 issue "ssl.com"
0 issuewild "digicert.com; cansignhttpexchanges=yes"
0 issuewild "sectigo.com"
0 issuewild "pki.goog; cansignhttpexchanges=yes"
0 issuewild "comodoca.com"
0 issue "letsencrypt.org"
0 issue "digicert.com; cansignhttpexchanges=yes"

13:50Z. Six CAs, each named for issue and issuewild. No other CA is authorized to issue (RFC 8659 section 3).

MX, SPF, DMARC#

dig +short isitdns.net MX
10 mx01.mail.icloud.com.
10 mx02.mail.icloud.com.
dig +short isitdns.net TXT | grep spf1
"v=spf1 include:icloud.com ~all"
dig +short _dmarc.isitdns.net TXT
"v=DMARC1; p=reject;"

13:50Z. Mail is iCloud. SPF ends ~all (RFC 7208 section 5.1); DMARC is p=reject (RFC 7489 section 6.3).

Verification TXT at the apex#

dig +short isitdns.net TXT | grep -v spf1
"google-site-verification=v9f56K9…"
"apple-domain=eMnc…"
"v=MCPv1; k=ed25519; p=x58sm…"

13:50Z. Three ownership proofs: Google, Apple, the MCP registry key. Tokens cut with ….

A Pages preview host#

The preview host's address.

 dig @1.1.1.1 stage.isitdns.net A
; <<>> DiG 9.18.39-0ubuntu0.24.04.7-Ubuntu <<>> @1.1.1.1 stage.isitdns.net A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status:
NOERRORThe server had no complaint about the question.
, id: 52566
;; flags:
qrThis message is the answer coming back, not the question going out.
rdYou asked this server to go and find the answer for you.
raThis server says it is willing to go and find answers for you.
adThis server says it checked the signatures, and they held up.
; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;stage.isitdns.net. IN
AYou asked for the IPv4 address this name points at.
;; AUTHORITY SECTION:
isitdns.net. 1800 IN SOA coleman.ns.cloudflare.com. dns.cloudflare.com. 2416175437 10000 2400 604800 1800
;;
Query timeHow long this one lookup took, start to finish.
: 16 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Tue Sep 29 13:50:36 UTC 2026
;; MSG SIZE rcvd: 111

GO NOERROR, ANSWER: 0, the zone's SOA in authority

NO GO an address

run this query in the dig tool →

13:50Z. NOERROR, no data (RFC 2308 section 2.2). No public address, by design.

A delegated child: probe.isitdns.net#

dig -4 @coleman.ns.cloudflare.com probe.isitdns.net NS +norecurse +noall +authority
probe.isitdns.net.	300	IN	NS	pns2.isitdns.net.
probe.isitdns.net.	300	IN	NS	pns3.isitdns.net.
dig -4 @coleman.ns.cloudflare.com probe.isitdns.net DS +norecurse +short
51770 13 2 4C3D85FE215D049C89D5776FD49116B5915460ED0A920405006C8509 9B6C81B5

The child zone's canary, validated.

 dig @1.1.1.1 canary.probe.isitdns.net A
; <<>> DiG 9.18.39-0ubuntu0.24.04.7-Ubuntu <<>> @1.1.1.1 canary.probe.isitdns.net A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status:
NOERRORThe server had no complaint about the question.
, id: 53852
;; flags:
qrThis message is the answer coming back, not the question going out.
rdYou asked this server to go and find the answer for you.
raThis server says it is willing to go and find answers for you.
adThis server says it checked the signatures, and they held up.
; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;canary.probe.isitdns.net. IN
AYou asked for the IPv4 address this name points at.
;; ANSWER SECTION:
canary.probe.isitdns.net.
5How many seconds this answer can be reused before asking again. From a cache it is the time left, so it counts down.
IN A 192.0.2.111
;;
Query timeHow long this one lookup took, start to finish.
: 17 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Tue Sep 29 13:50:37 UTC 2026
;; MSG SIZE rcvd: 69

GO NOERROR, ad set, 192.0.2.111

NO GO SERVFAIL, or no ad

run this query in the dig tool →

13:50Z. A child zone we run ourselves: NS pns2 and pns3, DS 51770 at the parent, canary 192.0.2.111 with ad set.

If your Pages host resolves and the site says 522: DNS is done; attach the host on the Cloudflare side.

If your DS is not at the registrar: the zone is signed and nobody can tell.

See also#