# isitdns

> Free DNS diagnostics. No ads, no login. Check a domain, dig a record, walk a delegation, check a DNSSEC chain, compare a zone's servers, read a registration. Over MCP and HTTP; the status also over DNS TXT. No key. By Neal Shelton, isitdns dude.

## Docs

- [For agents](https://isitdns.net/agents): connecting a client, reading an answer
- [Readme](https://isitdns.net/readme): what the board measures
- [Protocol](https://isitdns.net/protocol): the isitdns protocol, version 2.1
- [Terms](https://isitdns.net/terms)
- [Wiki](https://isitdns.net/wiki/)

## Tools

All thirteen on one page: https://isitdns.net/tools/

- [Domain check](https://isitdns.net/tools/domain-check): one domain end to end: public resolvers, nameservers, delegation, DNSSEC and the eleven-check audit
- [Registration](https://isitdns.net/tools/registration): a domain's registry record: holds, expiry, the nameservers it lists
- [DNSSEC chain check](https://isitdns.net/tools/dnssec-chain-check): the chain from the root to one answer, and the first link that breaks
- [Delegation trace](https://isitdns.net/tools/delegation-trace): root to the authoritative server, each referral and its glue
- [Resolver comparison](https://isitdns.net/tools/resolver-comparison): pick two public resolvers by what they block, with live readings and encrypted settings; then one name at Cloudflare, Google, Quad9, AdGuard
- [Nameserver consistency](https://isitdns.net/tools/nameserver-consistency): the SOA serial at every server of a zone, the other records at a sample
- [CAA check](https://isitdns.net/tools/caa-check): which certificate authorities can issue for a name
- [_acme-challenge check](https://isitdns.net/tools/acme-challenge-check): the TXT a CA validates for DNS-01
- [DNS change check](https://isitdns.net/tools/dns-change-check): what each resolver still caches after a change, and for how long
- [SERVFAIL diagnosis](https://isitdns.net/tools/servfail-diagnosis): the Extended DNS Error, the same question with CD set, then the chain
- [Dig reader](https://isitdns.net/tools/dig-reader): paste a dig, nslookup or Resolve-DnsName output to read it; the paste stays in the browser
- [Test your own path](https://isitdns.net/tools/test-your-own-path): browser DoH and your resolver
- [Hall monitor](https://isitdns.net/tools/hall-monitor): a container on your network

## MCP

- [Endpoint](https://isitdns.net/mcp): dig is DoH from the edge, or Do53 from a region's probe (from).
- [check_domain](https://isitdns.net/agents): Check a domain that is not working.
- [dig](https://isitdns.net/agents): Dig one name and type at one board resolver, or at Cloudflare, Google, Quad9 and AdGuard side by side (resolver all).
- [trace](https://isitdns.net/agents): Trace a delegation from the root to the authority, like dig +trace.
- [dnssec_chain](https://isitdns.net/agents): Walk the DNSSEC chain from the root to one answer.
- [sweep_domain](https://isitdns.net/agents): Sweep a zone's nameservers.
- [registration](https://isitdns.net/agents): Read a domain's registration from its registry's RDAP server.
- [Prompts](https://isitdns.net/agents): is_it_dns, after_change_check, mail_check, dnssec_servfail

## HTTP

- [curl -sL isitdns.net](https://isitdns.net/): the board as text
- [isitdns.net/check/<domain>](https://isitdns.net/check/example.com): the domain check
- [isitdns.net/dig/<name>/<type>/<resolver>](https://isitdns.net/dig/example.com/A/cloudflare): one record
- [OpenAPI](https://isitdns.net/api/openapi.json): every /api route

## Status

- [isitdns.net](https://isitdns.net/): the board (16 public resolvers, read from 4 probes)
- [isit.isitdns.net TXT](https://isitdns.net/readme): the board as TXT
- [help.isitdns.net TXT](https://isitdns.net/readme): the TXT names