dnssec.sh
dnssec.sh help
name
dnssec.sh: a self-hosted check of the DNS resolvers you actually use.
description
when you open the site, your browser looks up random names under
test.dnssec.sh. those lookups travel through your own resolvers,
and this server (the authoritative name server for the subzone) sees which
IPs asked. the page shows those resolvers, their reverse DNS and network,
and how they behave.
what is measured
resolvers: the IPs that queried for your random names, with PTR and ASN when known.
dnssec validation: the browser also looks up a name with a deliberately broken signature. a validating resolver refuses it (SERVFAIL); a non-validating one answers. an answer turns the verdict and the DNSSEC lamp red immediately.
dnssec matrix: each column states what a validating resolver should do: answer the good signature, refuse the three broken ones. the word in each cell says what your resolver did (answered or refused); the check or cross and the color say whether that was right.
verdict: the one-line answer under the title. it appears as soon as probes settle and firms up when all 16 cells finish (up to about 30 seconds).
ip paths: whether queries arrived over IPv4, IPv6, or both; shown as the IPv6 lamp in the status line.
ecs: the EDNS client subnet your resolver forwarded, if any. empty means it sent none.
tc: the resolver retried a truncated UDP answer over TCP.
0x20: the resolver passed through mixed-case letters in the query name.
avg: average time of the browser lookups the page made, in milliseconds.
tls handshake: the protocol and cipher your connection negotiated, plus which TLS versions your client accepts.
sharing
every check gets a random label plus a random view key. the share link,
/watch/<label>#<key>, replays the last 10 minutes of that
label's events for anyone holding the full link, including the dnssec
matrix verdicts as they settled on the original run (the replay never
re-probes). the key rides in the url fragment and never appears in dns
query names, so a resolver operator who sees your label cannot open the
replay without the key. the share section has a copy link button; the
visible short text identifies the report, and the copied link carries
the view key. anyone opening a replay sees a replay banner and the
shared capture only: opening a replay runs no dns probes under the
shared label, so the viewer's resolvers stay private and the report
stays the creator's.
privacy
no cookies, no accounts, no third-party scripts. query events live in memory for 10 minutes after their last query and then are gone. enrichment (reverse dns, network, geo) runs against a local offline copy of db-ip.com data; asn lookups the local data cannot answer fall back to the Team Cymru whois service. those fallback lookups, and nothing else, leave this server. the ip check also queries ipv4.dnssec.sh and ipv6.dnssec.sh, helper names that force each protocol family; they exist only for that.