dnscheck.tools

ABOUT

dnscheck.tools is a tool to test for DNS leaks, DNSSEC validation, and more.

USAGE

Load dnscheck.tools in any web browser to identify your current DNS resolvers and check DNSSEC validation.

DNS TEST QUERIES

At its core, dnscheck.tools is a custom DNS test server. Make test queries like:

$ dig txt [OPTIONS.]ZONE.dnscheck.tools

  • ZONE sets the DNSSEC signing algorithm and network availability:
    • test same as test-alg13 (default may change)
    • test-alg13 sign the zone using ECDSA P-256 with SHA-256
    • test-alg14 sign the zone using ECDSA P-384 with SHA-384
    • test-alg15 sign the zone using Ed25519
    • test-alg18 sign the zone using ML-DSA-44
    • test[-...]-ipv{4,6} as above but with only IPv4 or IPv6 authoritative nameservers

OPTIONS is a hyphen-separated list containing:

  • any of:
    • random a random number, up to 8 hex digits, useful for cache busting, identifies requests to /watch
    • compress force the use of DNS message compression in the response
    • [no]truncate force or disable message truncation for responses over UDP
  • up to one of:
    • badsig provide an invalid DNSSEC signature in the response
    • expiredsig[t] provide an expired DNSSEC signature in the response, t seconds in the past (default 1 day)
    • nosig do not provide any DNSSEC signature in the response
  • up to one of:
    • nullip provide only the all-zero IP in A and AAAA responses
    • nxdomain respond as if the domain does not exist
    • refused refuse the query
    • txtfilln add n bytes, up to 4096, of data to TXT responses

EXAMPLES

$ dig txt test.dnscheck.tools

$ open https://dnscheck.tools/watch/123

$ dig txt 123.test.dnscheck.tools

$ dig txt 123-truncate.test.dnscheck.tools

$ dig txt 123-badsig.test-alg15.dnscheck.tools

SEE ALSO

addr.tools

SOURCE

See GitHub. Bug reports and pull requests welcome.

THIRD-PARTY DATA

IP addresses are grouped by their network registrants as discovered by the Registration Data Access Protocol.

Hostnames (pointer records) and authoritative nameservers are discovered by reverse DNS resolution.

Geolocation uses GeoLite Data created by MaxMind.

PRIVACY POLICY

No personal data is collected. This site doesn't use cookies. Cheers!