{{ summaryTitle }} {{ summaryValue }} {{ summaryLine }}

Enter one public domain, FQDN, or URL, such as example.com.
A and AAAA fit access checks; CNAME, MX, NS, and TXT cover common routing and verification cases.
{{ resolverPackNote }}
Choose ordinary resolver behavior, request DNSSEC material, or request checking-disabled behavior.
Use zero for the neutral default; add up to three retries only when transient failures hide the comparison.
{{ timeoutDisplay }}
1.5–12 seconds per attempt; 3.5 seconds is the neutral default.
SectionItemDetailCopy
{{ row.section }}{{ row.item }}{{ row.detail }}
ResolverTierStatusAnswerTTLADTimePolicy readCopy
{{ row.resolver }}{{ row.roleLabel }}{{ row.statusLabel }}{{ row.answerPreview }}{{ row.ttlLabel }}{{ row.adLabel }}{{ row.msLabel }}{{ row.stateText }}
ProviderResolverTierPolicy readDetailCopy
{{ row.provider }}{{ row.resolver }}{{ row.tier }}{{ row.policyRead }}{{ row.detail }}
Nameserver Health Check Check a domain’s resolver-visible nameserver set and verify address coverage, SOA presence, and cross-resolver drift before a DNS cutover.
DNS Wildcard Behavior Check Test DNS wildcard behavior with random public resolver probes and distinguish broad matches, branch boundaries, mixed views, and cached negatives.
EDNS Options Inspector Inspect EDNS OPT responses from public DNS-over-HTTPS resolvers, compare requested and returned options, and keep replay evidence.
DNS Delegation Trace Analyzer Trace a public hostname through DNS delegation and aliases, compare resolver views, and inspect DNSSEC or negative-cache clues.

A hostname can resolve normally through one recursive DNS service and return a blocked, rewritten, empty, or failed answer through another. That disagreement may come from security filtering, family controls, DNSSEC validation, cache age, anycast location, or content-delivery steering. The response alone shows a difference; the surrounding comparison determines how confidently it can be attributed to policy.

Open resolvers provide the baseline. Security and family profiles are then compared with that baseline using the same hostname and record type. Agreement between at least two open controls is important because a filtered answer is stronger policy evidence when the ordinary resolvers already agree. If open controls disagree, cache or geographic variation is a more immediate explanation.

  • Status and answer set show the effective DNS outcome.
  • Zero-sink addresses such as 0.0.0.0 or :: can be deliberate blocking evidence.
  • TTL differences can reflect separate cache ages even when record data matches.
  • Authenticated Data changes can point toward DNSSEC handling rather than content categorization.
  • Transport failures reduce the evidence available and should not be treated as blocked DNS answers.

Record type must match the symptom. A and AAAA are the clearest choices for access questions; CNAME, MX, NS, and TXT can reveal routing or verification differences but may not follow the same filtering policy. Repeating the identical question matters because changing the name, type, or DNSSEC request flags changes the experiment.

Resolver comparison is a moment-in-time observation. It cannot prove browser blocking, HTTP filtering, endpoint failure, or a domain’s safety. Important findings should be repeated from the affected network and checked against authoritative DNS before changing published records or reporting a categorization error.

How to Use This Tool:

Keep the DNS question fixed and vary only the resolver profiles being compared.

  1. Enter one public Target name or URL and choose the relevant Record type. The hostname is normalized before the run.
  2. Select a Resolver pack. Use a provider ladder when same-provider open and filtered tiers are the most important evidence.
  3. Choose Validation mode. Start with Resolver default; use DNSSEC-visible or checking-disabled requests only when validation behavior is part of the question.
  4. Set a timeout from 1.5 to 12 seconds and zero to three retries. Add retries only when transient transport failures are hiding otherwise useful rows.
  5. Run the comparison and check completed responses, open-control agreement, filtered divergence, and zero-sink rows before reading the verdict.

Interpreting Results:

A Tiered policy split is the strongest built-in pattern because open controls agree and a provider’s own filtered tier differs from its open tier. Policy divergence detected also requires an aligned open baseline, but lacks the same-provider split. Both are DNS-level evidence, not proof of a wider block.

Cache or CDN drift means open controls already disagree, so filtering cannot be isolated cleanly. Validation-policy drift means effective answers agree while validation-related signals differ. Mostly aligned means the responding profiles shared one outcome in that run, not that every resolver or network will do so.

Treat Limited evidence literally. Fewer than two usable responses or a mixed baseline is not enough for confident attribution. Increase the timeout, narrow the resolver pack, rerun later, or confirm with direct resolver queries from the affected network.

Technical Details:

DNS-over-HTTPS maps a DNS question and response onto an HTTPS exchange. The comparison retains ordinary DNS evidence: response status, normalized answers, time-to-live (TTL) values, the Authenticated Data flag when available, and transport success. Provider comments remain supplemental because not every response format exposes them.

Mechanism Core:

StageMechanismWhy it matters
AskSend the same normalized name, record type, and validation flags to every selected profile.Only resolver behavior should vary inside one run.
Normalize answersClean record data, remove appropriate trailing dots, join TXT chunks, sort by record type, and remove duplicates.Order-only response differences do not create separate outcomes.
FingerprintCombine response status with the normalized answer set.Matching fingerprints form outcome groups.
Build baselineRequire at least two successful open controls with one identical fingerprint for a strong open consensus.Filtered divergence can then be attributed more confidently.
ClassifyCompare filtered rows, same-provider tiers, zero-sinks, validation flags, and open-control groups in a fixed order.Rows and the overall verdict follow one deterministic rule set.

Lookup Core:

Resolver packs select from six profiles and assign each one an open, threat-filter, or family-filter role. A pack changes the available comparison topology, not the hostname or record data.

PackIncluded profilesBest use
Policy ladderCloudflare open, Google, OpenDNS Standard, Cloudflare Security, Quad9 Secure, and Cloudflare FamilyBroad open, threat, and family comparison.
Threat-filter ladderThe same open controls plus Cloudflare Security and Quad9 SecureThreat blocking without the family tier.
Family-filter splitCloudflare open, Google, OpenDNS Standard, and Cloudflare FamilyFamily-policy evidence with open controls.
Provider laddersCloudflare open/security/family plus OpenDNS Standard and GoogleSame-provider Cloudflare tiers with independent open controls.

Rule Core:

VerdictRequired patternSeverity
Limited evidenceFewer than two profiles respond successfully.1
Tiered policy splitA filtered row differs from a strong open baseline and at least one provider’s open and filtered tiers differ.3
Policy divergence detectedA filtered row differs from a strong open baseline without a same-provider split.3
Validation-policy driftAll successful status-and-answer fingerprints match, but Authenticated Data values differ.2
Cache or CDN driftSuccessful open controls form more than one status-and-answer group.2
Mostly alignedMore than one successful profile shares a single status-and-answer group.0
Mixed resolver driftNo earlier rule produces a clean classification.1

Formula Core:

The radar is diagnostic telemetry rather than the verdict engine. TTL drift uses the absolute difference from a baseline, divided by at least 60 seconds, rounded, and limited to a 0–100 score.

STTL=clamp(round(|Tcandidate-Tbaseline|max(60,Tbaseline)×100),0,100)

For open controls, response-split and status-shift axes rise with the number of distinct groups relative to completed open rows. Validation drift is 65 when open Authenticated Data values differ. For threat and family roles, a baseline response or status mismatch scores 100, an Authenticated Data mismatch scores 70, and filter confidence is 100 for a zero-sink, 78 for another classified divergence, or 18 otherwise. Multiple rows in one role are averaged.

The supported query types are A, AAAA, CNAME, MX, NS, and TXT. The default mode sends no DNSSEC request flags; DNSSEC-visible sets the DO flag, while bypass validation sets both DO and Checking Disabled.

Privacy and Accuracy Notes:

The selected public resolver providers receive the hostname, record type, and validation flags needed for each lookup. One provider path may also pass those lookup details through a server-assisted relay when direct browser access is unavailable. Do not enter private internal names unless sending them to those public services is acceptable.

  • DNS-over-HTTPS encrypts transport to the resolver path but does not hide the query from the resolver provider.
  • Cache age, anycast location, authoritative changes, provider policy updates, and temporary network failures can change a later run.
  • A zero-sink is strong filter evidence only when open controls still return a normal outcome.
  • An Authenticated Data bit is supporting evidence and does not by itself prove end-user DNSSEC validation.

Worked Examples:

Filtered zero-sink with aligned controls

Three open profiles return the same A record, while a filtered profile returns 0.0.0.0. The open baseline is strong and the filtered row is marked sinkholed. A same-provider open/filter split raises the verdict to Tiered policy split; without it, the result is Policy divergence detected.

Open controls disagree

If open profiles return different status-and-answer fingerprints, the verdict becomes Cache or CDN drift before filtered rows are used for policy attribution. Repeat the identical query later or compare against authoritative DNS rather than declaring a category block.

References: