RESOLVER COMPARISON
Waiting for a lookup
◎
Run your first DNS check
Results from Google Public DNS and Cloudflare 1.1.1.1 will appear here with TTL, latency, response flags, and DNSSEC state.
LIVE DNS OPERATIONS
DNS Checker
Compare trusted public resolvers, inspect DNSSEC, verify expected values, and understand why DNS answers differ.
Advanced options Expected values and matching
Presets only fill comparison guidance locally. Normalized matching ignores surrounding whitespace, quotes, case, and a final DNS dot. Safe Regex is bounded and rejects lookarounds, backreferences, and nested quantifiers.
Runs sequentially within the existing resolver rate limit. Each result is saved server-side.
Ready. Results include exact resolver provenance.
● LIVE
MEMBERSHIP
Keep the lookup free. Upgrade the workspace.
DnsCheckr uses only the named public resolver sources shown in each result. Membership pays for private workspace features, not DNS data or a claimed worldwide probe network.
Loading membership options…
One workspace. Every DNS question.
DNSSEC evidence
Compare validated answers with Checking Disabled to distinguish insecure, valid, and failing chains.
Email DNS
Inspect MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and CAA without hiding raw records.
Change history
Save checks locally, compare evidence, and export portable JSON reports with schema metadata.
Supported DNS record guide
CNAME and DNAME
Returned alias data is shown as resolver evidence. DnsCheckr does not rewrite names or make an authoritative-transport claim.
SSHFP and SMIMEA
Fingerprint and association records are displayed as returned DNS data only. No SSH host key, email identity, or certificate is contacted or verified.
ZONEMD and DNSSEC
Zone digest and DNSSEC records retain their structured resolver-returned values. DnsCheckr does not calculate a zone digest or assert a chain is authoritative proof.
Full DNS record catalogue
Show supported record types and evidence limits
IPv4 address
Returned address only; no hosting, routing, or geolocation claim.
IPv6 address
Returned address only; no hosting, routing, or geolocation claim.
Canonical alias
No automatic target lookup.
Delegation alias
No automatic name rewriting.
Mail exchange
No SMTP-delivery test.
Nameserver host
Recursive observation, not direct delegation proof.
Reverse pointer
Forward confirmation is separate evidence.
Service location
No service connection test.
Zone authority data
Not zone-transfer evidence.
Text policy
No mail-policy syntax or delivery validation.
Naming authority pointer
No URI or service action is executed.
URI locator
Returned URI text is not fetched or linked.
CA authorization
No certificate-issuance test.
Delegation signer
Named-resolver DNSSEC context only.
DNSSEC key
Named-resolver DNSSEC context only.
SSH fingerprint
No SSH server key was contacted.
S/MIME association
No certificate or identity was verified.
TLS association
No TLS endpoint or certificate was tested.
DNSSEC signature
Named-resolver DNSSEC context only.
Authenticated denial
Named-resolver DNSSEC context only.
Hashed authenticated denial
Named-resolver DNSSEC context only.
Child DS signal
No parent-zone action is asserted.
Child DNSKEY signal
No parent-zone action is asserted.
Child-to-parent synchronization
No synchronization action is performed.
Zone digest
No zone digest is calculated or validated.
Service binding
No service connection test.
HTTPS service binding
No HTTPS connection test.
Delegation synchronization endpoint
No endpoint is contacted.
OpenPGP public key
No key import or cryptographic verification.
DNSSEC RELATIONSHIPS
Follow the chain deliberately
DS in a parent zone references a child zone’s DNSKEY. RRSIG signs an RRset; NSEC/NSEC3 can support authenticated denial. The AD flag is a named resolver’s validation signal, not direct authoritative proof.
DATA-SOURCE TRANSPARENCY
Two named resolver observations
Queries use Google Public DNS and Cloudflare 1.1.1.1 through fixed HTTPS endpoints. Results show timestamp, TTL, RCODE, AD/CD/TC flags, latency, and raw answers. No paid API or location-based probe is used.