isitdns? it's always dns  until it isn't

wiki/Reference/What a Cloudflare zone should look like

Reference

What a Cloudflare zone should look like

Run 2026-09-29, thewizard. Times UTC.

NS#

dig -4 @a.gtld-servers.net isitdns.net NS +norecurse +noall +authority
isitdns.net.		172800	IN	NS	hera.ns.cloudflare.com.
isitdns.net.		172800	IN	NS	coleman.ns.cloudflare.com.
dig -4 @coleman.ns.cloudflare.com isitdns.net NS +short
coleman.ns.cloudflare.com.
hera.ns.cloudflare.com.

13:50Z. Parent and child agree (RFC 1034 section 4.2.1).

A and AAAA at the apex#

dig +short isitdns.net A
188.114.97.0
188.114.96.0
dig +short isitdns.net AAAA
2a06:98c1:3120::
2a06:98c1:3121::

13:50Z. Addresses in Cloudflare's published ranges.

www#

dig -4 @coleman.ns.cloudflare.com www.isitdns.net A +noall +answer
www.isitdns.net.	300	IN	A	188.114.96.0
www.isitdns.net.	300	IN	A	188.114.97.0

13:50Z. Reads as A from the authority; no CNAME in the answer.

DS and DNSKEY#

dig -4 @a.gtld-servers.net isitdns.net DS +norecurse +short
2371 13 2 2DF8E1D4E0855DF60F2A8B51C914F2F2866ED1E3344F74F9682DAC4D 42D18802

The zone's keys, validated.

 dig @1.1.1.1 isitdns.net DNSKEY +multiline
; <<>> DiG 9.18.39-0ubuntu0.24.04.7-Ubuntu <<>> @1.1.1.1 isitdns.net DNSKEY +multiline
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15593
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;isitdns.net. IN DNSKEY
;; ANSWER SECTION:
isitdns.net. 3600 IN DNSKEY 256 3 13 (
oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeq
CYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x8fGAa2XhSA==
) ; ZSK; alg = ECDSAP256SHA256 ; key id = 34505
isitdns.net. 3600 IN DNSKEY 257 3 13 (
mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+Gq
JxpVXckHAeF+KkxLbxILfDLUT0rAK9iUzy1L53eKGQ==
) ; KSK; alg = ECDSAP256SHA256 ; key id = 2371
;; Query time: 8 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Tue Sep 29 13:50:36 UTC 2026
;; MSG SIZE rcvd: 200

GO ad set, and a KSK whose key id is the DS key tag, 2371

NO GO no ad, or no key id 2371

run this query in the dig tool →

what each part of this output means →

13:50Z. DS 2371, algorithm 13, digest type 2 at the parent. 2371 is the live KSK's key tag; the digest match is what check_domain's DS row computes. ad set (RFC 4035 section 5). id, Query time, WHEN: move each run. TTLs: count down.

CAA#

dig +short isitdns.net CAA
0 issue "comodoca.com"
0 issuewild "ssl.com"
0 issuewild "letsencrypt.org"
0 issue "sectigo.com"
0 issue "pki.goog; cansignhttpexchanges=yes"
0 issue "ssl.com"
0 issuewild "digicert.com; cansignhttpexchanges=yes"
0 issuewild "sectigo.com"
0 issuewild "pki.goog; cansignhttpexchanges=yes"
0 issuewild "comodoca.com"
0 issue "letsencrypt.org"
0 issue "digicert.com; cansignhttpexchanges=yes"

13:50Z. Six CAs, each named for issue and issuewild. No other CA is authorized to issue (RFC 8659 section 3).

MX, SPF, DMARC#

dig +short isitdns.net MX
10 mx01.mail.icloud.com.
10 mx02.mail.icloud.com.
dig +short isitdns.net TXT | grep spf1
"v=spf1 include:icloud.com ~all"
dig +short _dmarc.isitdns.net TXT
"v=DMARC1; p=reject;"

13:50Z. Mail is iCloud. SPF ends ~all (RFC 7208 section 5.1); DMARC is p=reject (RFC 7489 section 6.3).

Verification TXT at the apex#

dig +short isitdns.net TXT | grep -v spf1
"google-site-verification=v9f56K9…"
"apple-domain=eMnc…"
"v=MCPv1; k=ed25519; p=x58sm…"

13:50Z. Three ownership proofs: Google, Apple, the MCP registry key. Tokens cut with ….

A Pages preview host#

The preview host's address.

 dig @1.1.1.1 stage.isitdns.net A
; <<>> DiG 9.18.39-0ubuntu0.24.04.7-Ubuntu <<>> @1.1.1.1 stage.isitdns.net A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52566
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;stage.isitdns.net. IN A
;; AUTHORITY SECTION:
isitdns.net. 1800 IN SOA coleman.ns.cloudflare.com. dns.cloudflare.com. 2416175437 10000 2400 604800 1800
;; Query time: 16 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Tue Sep 29 13:50:36 UTC 2026
;; MSG SIZE rcvd: 111

GO NOERROR, ANSWER: 0, the zone's SOA in authority

NO GO an address

run this query in the dig tool →

what each part of this output means →

13:50Z. NOERROR, no data (RFC 2308 section 2.2). No public address, by design.

A delegated child: probe.isitdns.net#

dig -4 @coleman.ns.cloudflare.com probe.isitdns.net NS +norecurse +noall +authority
probe.isitdns.net.	300	IN	NS	pns2.isitdns.net.
probe.isitdns.net.	300	IN	NS	pns3.isitdns.net.
dig -4 @coleman.ns.cloudflare.com probe.isitdns.net DS +norecurse +short
51770 13 2 4C3D85FE215D049C89D5776FD49116B5915460ED0A920405006C8509 9B6C81B5

The child zone's canary, validated.

 dig @1.1.1.1 canary.probe.isitdns.net A
; <<>> DiG 9.18.39-0ubuntu0.24.04.7-Ubuntu <<>> @1.1.1.1 canary.probe.isitdns.net A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53852
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;canary.probe.isitdns.net. IN A
;; ANSWER SECTION:
canary.probe.isitdns.net. 5 IN A 192.0.2.111
;; Query time: 17 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Tue Sep 29 13:50:37 UTC 2026
;; MSG SIZE rcvd: 69

GO NOERROR, ad set, 192.0.2.111

NO GO SERVFAIL, or no ad

run this query in the dig tool →

what each part of this output means →

13:50Z. A child zone we run ourselves: NS pns2 and pns3, DS 51770 at the parent, canary 192.0.2.111 with ad set.

If your Pages host resolves and the site says 522: DNS is done; attach the host on the Cloudflare side.

If your DS is not at the registrar: the zone is signed and no chain of trust reaches it (RFC 4035 section 4.3).

See also#