dnsismagic

Public resolvers. Cloudflare, Google, Quad9, OpenDNS. Cached answers, so they lag. Compare them to see whether a change has landed yet.

Recursed here. Resolved from the root servers by our own validating unbound, no shared cache in between. The only view that checks DNSSEC itself rather than repeating someone else's verdict.

Authoritative. Every nameserver in the delegation, asked directly. One server out of four serving stale data breaks a zone intermittently, and no resolver-based tool will show it. Mismatched SOA serials give it away.

Header analysis

Paste a message and its Received: headers are read bottom-up. Each relay adds its own to the top, so the last line is the first thing that happened.

Every hop's address gets a reverse lookup, forward-confirmed. SPF is re-evaluated against the address that connected. Each DKIM signature's key is fetched from the selector it names.

The message's own Authentication-Results sits alongside. That header was written by whichever machine received the mail, so it only means anything if that machine is yours.

Signatures themselves are not checked; that needs the body, which is discarded. Most DKIM trouble is a selector that stopped resolving or a key someone rotated, and DNS shows both.

Limits

Public names only, and queries go only to public addresses. Anyone can publish a zone whose NS records point at 192.168.1.1 and ask us to look it up; reply timing would map a network they cannot otherwise reach.

Nothing here connects to what it resolves. The MTA-STS check reads the DNS record and stops there.

The DNSBLs forbid queries from behind a public tool, so blocklist checks are left out.

What it keeps

Ordinary web logs: your address and the URL you asked for, kept 14 days. Answers sit in the resolver's cache for up to an hour and in the app's memory for 30 seconds, so a reload does not re-query someone else's nameservers. None of it is sold or handed to anyone.

Pasted messages are cut at the first blank line. Only the request line reaches the log. Headers are read once and never cached.

From a terminal

curl dnsismagic.com/mx/example.com
curl dnsismagic.com/mail/example.com
curl 'dnsismagic.com/lookup?name=example.com&type=NS&f=json'
curl --data-binary @message.eml dnsismagic.com/headers

f=json for JSON, f=html for the page. Types: A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, PTR, DS, DNSKEY, SVCB, HTTPS, TLSA, NAPTR.

No scheme needed: curl defaults to http, and port 80 answers curl, wget and HTTPie there rather than redirecting. Browsers still go to https, and https:// works the same.

The name

DNS is a distributed database older than most of what depends on it, held together by caching and timeouts. It mostly works.