About DNSLens

Why it decodes DNS itself

Most web DNS tools ask a provider for JSON and print it. DNSLens builds a real DNS query, sends it in the binary wire format of RFC 8484, and parses the response — compression pointers, EDNS options, RRSIG timestamps and all. That is more work, and it is the reason the answers here can be specific.

It is also the reason NXDOMAIN and NODATA are never confused. A resolver returning “this name does not exist” and one returning “this name exists but has no record of that type” are answering completely different questions, and a tool that shows both as an empty box has thrown away the useful half of the answer.

What it refuses to blur

• An HTTPS round trip is called a round trip. It is not an ICMP ping, and it is not a measurement of how fast a resolver is.
• A recursive resolver's answer is never shown as a delegation trace. The trace tool does real iterative resolution from a root server, and where it cannot finish, it says so rather than filling in the gap.
• SPF's ten-lookup limit is counted by following the tree, not by counting the word “include” in the text. Those two numbers are routinely different, and only one of them is the number a receiver computes.
• A DNSSEC verdict comes from asking the resolver twice — once validating, once with checking disabled — rather than from trusting a flag.

The tools

• DNS lookupEight record types at once, decoded from the wire format.
• Reverse DNSPTR, with the forward lookup that makes it mean something.
• MX recordsExchangers resolved, aliases and dead hosts caught.
• Compare resolversOne question, three resolvers, side by side.
• SPFEvery include followed; the lookup limit counted properly.
• DMARCEach tag, and what it actually instructs receivers to do.
• DKIMKeys by selector, with their size and flags.
• DNSSECKeys, DS records, and whether a resolver really accepts them.
• DelegationThe parent's list against the zone's own.
• TraceReal iterative resolution from a root server.
• CAAClimbing to the parents, the way a CA does.
• Zone checkerNine checks on one domain, in a single pass.
• Subnet calculatorIPv4 and IPv6, including /31 and /32.
• IP and URL toolsAddresses, PTR names, URLs, punycode.

What it will not build

No port scanner, no subdomain brute-forcing, no zone-transfer enumeration, no network sweeps, and nothing that will send traffic to a destination you name. The tools here are for examining names that are already public, which is what DNS is for.

Privacy

No accounts, no history, no database. Queries go from your browser to the public resolver you choose. The privacy page sets out exactly where each request goes, including the one endpoint that runs on our server and why it has to.