List of test queries
Tests are selected by the name you ask for. Some must be aimed at @dnsp.co directly, others are meant to travel through your own resolver. A few need TCP or an alternate port.
Interference
Is anything between you and us changing the answer?
Any name resolved through @dnsp.co returns the same fixed address. If it doesn't, someone altered the answer.
Returns the address you embed in the name, useful when you suspect one specific IP is being rewritten in transit.
The same resolver also listens on UDP/10053, so you can compare a non-standard port against port 53.
Always answers NXDOMAIN. Use it to catch ISPs that replace failed lookups with an advertising landing page.
fail.dnsp.co is not a nameserver at all. Any response from it was manufactured by something in the path.
Reconnaissance
What does your query look like by the time it reaches us, and who sent it?
Returns the address that asked. Directly, that is you; through a resolver, it is the resolver's egress address.
Pins whether your query reaches us over IPv4 or IPv6. Aim at ipv4.dnsp.co or ipv6.dnsp.co instead of dnsp.co, and pair it with reflect to see which address we saw.
The server's own list of every option it answers, straight from the running server rather than from this site.
A TXT query returns the raw bytes of your request, in hex, exactly as they arrived.
Privacy
What your resolver tells us about you without being asked.
Lists every address that has looked up the same label before. Logging always happens, whatever transport you used. Results only come back over TCP, or from the web based log lookup.
Runs the lookup from your browser against a name that exists only for you, then reports which resolver actually asked, whether it disclosed part of your address, whether it minimised the name, and what it claims to support.
Caching
Are you reading a live answer or a stored one?
Rises on every request until it wraps at 255.255.255.255. If it stops rising, something is serving you a cached copy.
Returns a time-based CNAME that resolves to your loopback address, 127.0.0.1 or ::1, so plain ping can tell you whether DNS results are fresh.
The server's clock encoded as an address, 24-hour, 12-hour, or yy.mm.dd.hh.
A different random address for every request. Back-to-back matches prove something in between is caching.
Resolver behaviour
What your resolver does on your behalf, privacy, validation, limits.
Returns as many addresses as you ask for, up to 255, a blunt way to find size limits in the path.
Reports the EDNS(0) parameters that arrived, payload size, DNSSEC request, cookies. These describe the last hop, not you.
Tells you whether your resolver disclosed part of your address to us. If it did, every nameserver you query sees that prefix.
Reports whether your resolver randomises the capitalisation it sends, a cheap defence against cache poisoning.
Tells you whether your query arrived encrypted. Over port 853 it reports the TLS version, cipher and certificate.
Shows whether your resolver practises QNAME minimisation, sending each server only the labels it needs.
You choose the lifetime in seconds and a token of your own. The address changes whenever we are actually asked, so an answer that outlives the lifetime you set came from a cache.
Answers an A query with a TXT record on purpose, to see whether anything in the path filters mismatched types.
Carries its message in a CNAME target. Unlike a mismatched type, every resolver follows an alias, a useful control.
Three signed names, correct, corrupted, expired, that reveal whether your resolver validates DNSSEC or just forwards it.
The one test that performs a real lookup: we strip the suffix, ask an ordinary resolver, and return what it said.
No test matches that filter.