Names, answered · browser-direct
dig, made humane.
Every question the internet answers starts with a name being resolved — and the tool operators use to watch it happen is a terminal command from 1989. This desk asks the same questions over public DNS wires, browser-direct, and shows what the terminal never could: the delegation chain drawn — root to TLD to zone, each cut’s servers and its DNSSEC state — and the same question put to two great resolvers side by side, disagreement named.
Beside it sits Mailworthy: a domain’s whole mail posture — MX, SPF, DMARC, a DKIM probe — translated into one plain-words verdict: what actually happens to a forged mail claiming to be this domain.
The dig desk
Any name. Any record.
The answer
The quorum — two operators, one question
The walk — the chain of authority, drawn
Mailworthy
Can this domain’s mail be forged?
Three records decide it — SPF says who may send, DKIM signs what was sent, DMARC says what happens to mail that fails both. Most tools print the records; this desk reads them and answers the actual question.
The domain
Method
Two public wires, said plainly.
The wires
Every question travels as DNS-over-HTTPS in JSON to two public
operators — Google (dns.google) and Cloudflare
(cloudflare-dns.com) — keyless, CORS-open, browser-direct. Your
lookups go to those resolvers and nowhere else; nothing is relayed and
nothing is kept beyond the recents strip in your own browser.
Why the quorum is two
Two members is not a choice of laziness but of the open web: the other public JSON resolvers are unusable from a browser — Quad9’s JSON port does not answer, AdGuard’s sends no CORS header. Two independent operators still make a real instrument: when they disagree, you are watching propagation — or trouble — in the act.
What the walk really is
The drawn chain is the delegation as a recursive resolver reports it — the NS set and the DS record at every zone cut between the root and the name. It is a reconstruction from live records, not a packet trace of an iterative resolution, and it is labelled as exactly that under the drawing.
Mailworthy’s honesty
The verdict comes only from the records: SPF’s ending qualifier, DMARC’s policy, the MX set. DKIM selectors cannot be enumerated from outside, so six common ones are probed and the page says that finding none proves nothing. The records are shown verbatim beneath every translation.