DNS lookup

How this check works — honestly

We query 11 independent public DNS resolvers (Google, Cloudflare, Quad9, OpenDNS, AdGuard, NextDNS, DNS.SB, AliDNS, Mullvad, Wikimedia, CIRA) from our server and compare their answers. Unlike tools that show a world map, we don't pretend to measure from dozens of countries: public resolvers are anycast networks, so the answering location is usually near our server no matter what a map suggests. What the matrix genuinely shows: whether independent resolver operators already see your latest DNS data (propagation), whether answers validate under DNSSEC, and whether security filters block the name. Differing TTLs are cache age, not an inconsistency.

Separately from those caches, we also ask the zone itself: the name servers the domain's delegation points at, queried directly on port 53 with recursion switched off, so their answers come from the zone and not from a cache. That is what makes it possible to see name servers that have drifted apart, a server that answers without being authoritative (a lame delegation), and one that does not answer at all. Each is also asked for the zone's serial number, because two servers can serve the same record while sitting on different versions of the zone. We ask over UDP first and fall back to TCP when the reply does not fit in one packet or UDP stays silent, and the table names the transport that worked. Where a reply is truncated and cannot be completed, that server is kept out of the comparison instead of being counted as a difference.

The blocklist panel additionally asks 7 filtering resolvers (Quad9, Cloudflare Security/Family, AdGuard, AdGuard Family, DNS4EU Protective, CleanBrowsing). A block there is a reputation signal about the domain — not a DNS configuration error. We only ask those seven if the name has an address of its own: without a reference answer the check could not reach a verdict, so we do not ask at all.