Live · From the root · No cache
DNS Lookup
NOC Operator Toolkit
Trace a name from the root servers down and see every nameserver that gets asked, and why. Or check a whole domain: delegation, nameservers, SOA, mail and DNSSEC.
Notes
How this works
What the two tools do, and what they deliberately leave out.
How is the trace different from dig +trace?
It walks the same path: a root server, then the nameservers each answer refers it to, until one
of them holds the answer. Where
dig +trace quietly asks your local resolver for the
address of a nameserver that came without glue, this tool resolves it from the root as well and
shows you that side lookup. It follows CNAMEs by starting again at the root, and at every step it
says why that server was the one asked.
Is anything cached?
No. There is no cache between lookups, between requests or even within one trace: every lookup
starts at the root servers. What you see is what a resolver with an empty cache would do.
What does the domain check look at?
The delegation at the parent zone and its glue; each nameserver address, IPv4 and IPv6, asked directly over UDP and TCP,
for authority, consistency, open recursion and EDNS; how the nameservers are spread over networks;
the SOA timers; the MX records, their addresses and reverse DNS, SPF and DMARC; the web addresses
and CAA; and whether the DNSSEC chain from the parent holds. Every finding says why it matters.
Is there an API?
No. Both tools send a lot of queries to other people's nameservers, so they are only available
from this page.