# dnsprobe

> Real-time DNS propagation and SSL/TLS health checker probed from 12 global resolvers simultaneously.

dnsprobe fans out `dig` queries to twelve public recursive resolvers (Cloudflare, Google, Quad9, OpenDNS, Yandex, Comodo, Verisign, Hurricane Electric, AdGuard, and others) and runs a parallel TLS handshake against the target host. The result is a single page that shows DNS propagation, certificate validity, TLS protocol support, HTTP/2, HTTP/3, HSTS and OCSP stapling status.

## What it does

- Concurrent DNS lookups (A, AAAA, MX, TXT, NS, CNAME, CAA, SOA) against 12 global resolvers
- Full TLS audit: certificate chain, validity window, key size, signature algorithm, SAN list
- Per-protocol support: TLS 1.0/1.1/1.2/1.3
- HTTP/2 and HTTP/3 detection, HSTS header parsing, OCSP stapling verification
- Shareable, SEO-indexed permalink per checked domain
- Stateless, no login, results cached for 1 hour

## Pages

- [Home / probe form](https://dnsprobe.net/): enter a hostname and receive a full DNS + TLS report in 5-10 seconds
- [About](https://dnsprobe.net/about): what the tool is, what it isn't, caveats
- [Privacy](https://dnsprobe.net/privacy): data handling, third-party services, GDPR rights
- [Terms](https://dnsprobe.net/terms): as-is service, accuracy disclaimer
- [Cookies](https://dnsprobe.net/cookies): cookie policy and consent choices

## Per-domain landing pages

Every probe produces a shareable URL of the form `/check/{domain}`. Examples for popular domains:

- [github.com](https://dnsprobe.net/check/github.com)
- [cloudflare.com](https://dnsprobe.net/check/cloudflare.com)
- [google.com](https://dnsprobe.net/check/google.com)
- [mozilla.org](https://dnsprobe.net/check/mozilla.org)
- [wikipedia.org](https://dnsprobe.net/check/wikipedia.org)
- [letsencrypt.org](https://dnsprobe.net/check/letsencrypt.org)

## Blog

- [Blog index](https://dnsprobe.net/blog)
- [RSS feed](https://dnsprobe.net/blog/feed.xml)

Recent posts:

- [DNS record types explained: A, AAAA, CNAME, MX, TXT and when to use each](https://dnsprobe.net/blog/dns-record-types-explained) — A domain is just a name until DNS records tell the internet what to do with it. Here is a plain-English guide to the record types you'll actually touch, what each does, and the common mistakes that break sites and email.
- [How to check DNS propagation (and why it can take up to 48 hours)](https://dnsprobe.net/blog/how-to-check-dns-propagation) — Changed a DNS record and it works for you but not for everyone? That is propagation. Here is how to check it across global resolvers, what TTL really controls, and how to make future changes apply faster.
- [Reverse DNS (PTR) and why mail servers care](https://dnsprobe.net/blog/reverse-dns-ptr-and-why-mail-servers-care) — PTR records map an IP back to a name. They look like trivia until your outbound email starts hitting spam folders. Here is what PTR proves, what it does not, and how to set it.
- [DoH (DNS-over-HTTPS) vs DoT — privacy and tradeoffs](https://dnsprobe.net/blog/doh-vs-dot-privacy-and-tradeoffs) — Both encrypt DNS between you and the resolver. One is indistinguishable from web traffic on port 443; the other has its own port. Why your operations team probably has an opinion.
- [Diagnosing intermittent DNS failures](https://dnsprobe.net/blog/diagnosing-intermittent-dns-failures) — The hardest DNS failures are the ones that work most of the time. Here is a debugging flow that catches the seven causes of intermittent resolution errors.
- [Setting up split-horizon DNS for internal services](https://dnsprobe.net/blog/split-horizon-dns-for-internal-services) — Internal users get an internal IP for the same hostname; external users get the external one. Useful for keeping URLs portable across networks, and a great way to break a network if done wrong.
- [Wildcard vs SAN certs: when each makes sense](https://dnsprobe.net/blog/wildcard-vs-san-certs-when-each-makes-sense) — A wildcard covers any subdomain at one level. A SAN cert covers an explicit list. The choice is operational, not cryptographic — here are the tradeoffs that matter.
- [DNS poisoning, cache poisoning, and DNSSEC](https://dnsprobe.net/blog/dns-poisoning-cache-poisoning-and-dnssec) — Cache poisoning has been a known DNS attack for two decades. DNSSEC is the official answer. Why adoption is so uneven, and what protection you actually get.
- [Let's Encrypt + ACME: the 60-second mental model](https://dnsprobe.net/blog/lets-encrypt-acme-60-second-mental-model) — ACME is a four-message protocol that automates everything a CA used to require humans for. Here is the mental model that lets you debug any ACME failure in five minutes.
- [HTTP/2 vs HTTP/3 — when each helps (and when neither does)](https://dnsprobe.net/blog/http2-vs-http3-when-each-helps) — HTTP/3 swaps TCP for QUIC. The handshake is faster, head-of-line blocking is gone, and your CDN is probably already speaking it. But for plenty of workloads, HTTP/2 is still the right call.
- [HSTS, the preload list, and the irreversible commitment](https://dnsprobe.net/blog/hsts-preload-list-irreversible-commitment) — HSTS is a one-line response header that locks browsers into HTTPS for your domain. The preload list takes that commitment further — and the only way out is a year-long opt-out process.
- [OCSP stapling explained](https://dnsprobe.net/blog/ocsp-stapling-explained) — OCSP lets clients check whether a cert has been revoked. Stapling moves that check from the client to the server. Why this matters, how it works, and what breaks when it fails.
- [Common SSL errors (NET::ERR_CERT_DATE_INVALID, etc.) and how to debug them](https://dnsprobe.net/blog/common-ssl-errors-and-how-to-debug-them) — A catalogue of the SSL errors browsers actually show users, the most likely cause for each, and the openssl one-liner that confirms or rejects each hypothesis.
- [Reading an SSL certificate chain](https://dnsprobe.net/blog/reading-an-ssl-certificate-chain) — A leaf, one or more intermediates, and a root in your trust store. Where the chain comes from, how the validator walks it, and the three common ways it breaks.
- [TLS 1.2 vs 1.3 — protocol upgrade cheat sheet](https://dnsprobe.net/blog/tls-12-vs-13-protocol-upgrade-cheat-sheet) — TLS 1.3 is shorter, faster, safer and incompatible with a lot of things. A pragmatic cheat sheet for engineers deciding what to support, what to drop, and what to log.
- [MX record priorities decoded](https://dnsprobe.net/blog/mx-record-priorities-decoded) — The MX preference field is one number that everyone gets wrong at least once. Lower wins, ties round-robin, and there is no "fallback after timeout" guarantee.
- [The CAA record and why your cert keeps failing](https://dnsprobe.net/blog/the-caa-record-and-why-your-cert-keeps-failing) — A wrong or missing CAA record will silently break certificate issuance, even though browsers never look at it. Here is what CAA does, and how to debug a failed Let's Encrypt challenge.
- [SPF, DKIM, DMARC: a postman's guide to email authentication](https://dnsprobe.net/blog/spf-dkim-dmarc-a-postmans-guide-to-email-auth) — Three TXT records do all the work of preventing mail spoofing. Here is what each one asserts, how receivers combine them, and the policy you actually want.
- [Reading a dig +trace output, line by line](https://dnsprobe.net/blog/reading-a-dig-trace-output-line-by-line) — dig +trace is the closest thing DNS has to a debugger. Here is how to read every section of its output, with a worked example against a popular domain.
- [What an A record really is (vs. AAAA, CNAME, ANAME, ALIAS)](https://dnsprobe.net/blog/what-an-a-record-really-is) — The A record is the simplest DNS record, but the moment you start mixing in CNAMEs, AAAAs and the vendor-specific ANAME/ALIAS, things get subtle. Here is the difference.
- [The 12 global DNS resolvers we probe — and why each matters](https://dnsprobe.net/blog/the-12-global-dns-resolvers-we-probe) — A short tour of the resolver fleet dnscheck queries: Cloudflare, Google, Quad9, OpenDNS, Yandex, Comodo, Verisign, Hurricane Electric, AdGuard, and the rest. Why this exact list.
- [How DNS propagation actually works (and why your change is not live yet)](https://dnsprobe.net/blog/how-dns-propagation-actually-works) — The phrase "DNS propagation" is misleading. Authoritative changes happen instantly; what you are waiting for is recursive resolver caches to expire. Here is the actual mechanism.

## Contact

- Email: support@info-media.it