dnscheck.tools Open in urlscan Pro
2604:a880:800:10::64f:8001  Public Scan

Form analysis
0 forms found in the DOM

Text Content

dnscheck.tools - inspect your dns resolvers
basic advanced more

Hello 217.64.151.10!

Your dns resolvers appear to be: Cloudflare, Google LLC,
IE-GOOGLE-2a00-1450-4000-1

If you're using an anonymizing vpn service, multiple dns resolvers may indicate
a dns leak!

Great! Your dns responses are authenticated, protecting you from certain
attacks!

You:
DE-OVPN-1
 * 217.64.151.10 (217-64-151-10.pool.ovpn.com)

M247-LTD-Frankfurt-Servers
 * 2001:ac8:20:3c00:1011:6bda:3a53:3aff

Your dns security:
DNSSEC (PASS)
 * Valid signature: connected
 * Invalid signature: not connected
 * Expired signature: not connected
 * Missing signature: not connected

Your dns resolvers:
Cloudflare (205)
 * 162.158.85.24
 * 172.70.249.76
 * 172.70.241.65
 * 172.70.241.66
 * 172.70.245.67
 * 162.158.85.25
 * 172.70.249.77
 * 172.70.249.12
 * 2400:cb00:472:1024::ac46:f94d
 * 2400:cb00:71:1024::a29e:5518
 * 2400:cb00:471:1024::ac46:f543
 * 2400:cb00:472:1024::ac46:f94c
 * 2400:cb00:71:1024::a29e:5519
 * 2400:cb00:470:1024::ac46:f141
 * 2400:cb00:470:1024::ac46:f142

Google LLC (108)
 * 74.125.187.129
 * 172.253.10.194
 * 172.253.197.4
 * 172.217.33.196
 * 172.253.10.129
 * 172.253.197.2
 * 172.253.1.197
 * 172.217.33.194
 * 172.217.45.133
 * 172.253.1.195
 * 172.253.197.1
 * 172.253.225.37
 * 172.253.10.193
 * 172.253.195.130
 * 172.217.45.131
 * 74.125.187.130
 * 172.253.10.196
 * 172.217.33.130
 * 172.253.195.129
 * 172.253.225.33
 * 74.125.187.131
 * 172.253.2.129
 * 172.217.33.193
 * 172.253.199.1
 * 172.217.45.194
 * 172.253.225.35
 * 172.253.197.5
 * 172.217.34.3
 * 172.217.45.193
 * 172.217.33.129
 * 172.217.33.195
 * 172.217.45.129
 * 172.253.10.133
 * 172.253.199.2
 * 172.217.45.196
 * 172.253.195.133
 * 172.253.10.131
 * 172.253.199.5
 * 172.253.195.132
 * 172.253.197.3
 * 172.217.44.132
 * 172.217.34.4
 * 172.217.45.195
 * 172.217.44.130
 * 172.253.2.131
 * 172.217.34.1
 * 172.217.34.5
 * 172.253.10.130
 * 172.217.33.197
 * 172.253.225.34
 * 172.217.34.2
 * 172.217.33.131
 * 172.253.1.193
 * 172.253.2.132
 * 74.125.187.132
 * 172.217.33.132

IE-GOOGLE-2a00-1450-4000-1 (81)
 * 2a00:1450:4001:c02::103
 * 2a00:1450:4001:c13::103
 * 2a00:1450:4001:c02::105
 * 2a00:1450:4001:c17::101
 * 2a00:1450:4001:c15::102
 * 2a00:1450:4001:c00::105
 * 2a00:1450:4001:c04::105
 * 2a00:1450:4001:c00::103
 * 2a00:1450:4001:c0f::102
 * 2a00:1450:4001:c07::101
 * 2a00:1450:4001:c19::102
 * 2a00:1450:4001:c05::104
 * 2a00:1450:4001:c1b::101
 * 2a00:1450:4001:c03::105
 * 2a00:1450:4001:c15::104
 * 2a00:1450:4001:c19::101
 * 2a00:1450:4001:c1f::104
 * 2a00:1450:4001:c05::101
 * 2a00:1450:4001:c03::104
 * 2a00:1450:4001:c1f::101
 * 2a00:1450:4001:c05::102
 * 2a00:1450:4001:c01::101
 * 2a00:1450:4001:c11::101
 * 2a00:1450:4001:c15::105
 * 2a00:1450:4001:c02::101
 * 2a00:1450:4001:c07::104
 * 2a00:1450:4001:c19::104
 * 2a00:1450:4001:c1b::102
 * 2a00:1450:4001:c02::104
 * 2a00:1450:4001:c1b::103
 * 2a00:1450:4001:c11::103
 * 2a00:1450:4001:c0f::105
 * 2a00:1450:4001:c0f::104
 * 2a00:1450:4001:c0f::101
 * 2a00:1450:4001:c07::102
 * 2a00:1450:4001:c00::102
 * 2a00:1450:4001:c05::105
 * 2a00:1450:4001:c1f::105
 * 2a00:1450:4001:c17::103
 * 2a00:1450:4001:c05::103
 * 2a00:1450:4001:c07::105
 * 2a00:1450:4001:c03::102
 * 2a00:1450:4001:c04::102
 * 2a00:1450:4001:c07::103
 * 2a00:1450:4001:c15::101
 * 2a00:1450:4001:c00::101
 * 2a00:1450:4001:c03::103
 * 2a00:1450:4001:c01::105
 * 2a00:1450:4001:c01::103

ABOUT

DNS resolvers are the servers on the Internet that translate domain names into
IP addresses. You may wish to identify these servers to verify your network
configuration or to check for dns leaks while using an anonymizing vpn service.

This web tool identifies your dns resolvers by attempting connections to
randomly generated subdomains of our domain name in your browser. Our custom dns
server receives the requests from your dns resolvers and uses the randomly
generated part to link the requests to you.

DNSSEC is a mechanism by which dns responses can be authenticated. You may wish
to verify proper DNSSEC usage to protect yourself against dns cache poisoning
and similar attacks. This web tool attempts connections to domains which are
purposely set up to fail DNSSEC authentication and warns you if one of those
connections is successful.

ADVANCED USAGE
DNS

Form a command string by joining options with a hyphen character. Use the
command string as a subdomain of "go.dnscheck.tools." Responses are provided for
all valid A, AAAA, and TXT queries. Invalid queries are refused. By default, all
responses are signed via DNSSEC algorithms 13, 14, and 15.

Options may include:

 * one of:
   * noreply - do not respond at all (the request will time out)
   * ipv4 - respond only to requests received over IPv4
   * ipv6 - respond only to requests received over IPv6

 * one of:
   * nosig - do not provide any DNSSEC signature in the response
   * badsig - provide an invalid DNSSEC signature in the response
   * expiredsig[s] - provide an expired DNSSEC signature in the response
     * where s is the number of seconds in the past the signature has expired
       (default is 86400)

 * one of:
   * alg13 - only use algorithm 13 (ECDSA Curve P-256 with SHA-256) when signing
     the response
   * alg14 - only use algorithm 14 (ECDSA Curve P-384 with SHA-384) when signing
     the response
   * alg15 - only use algorithm 15 (Ed25519) when signing the response

 * any of:
   * compress - force the use of dns message compression in the response
   * truncate - set the message truncation flag in the response (force tcp)
   * watch - used in conjunction with the watch http service (see below)
   * xxxxxx - a 6 to 8 alphanumeric character random string
     * the first 6 characters are used as the client id for the watch http
       service (see below)
     * can be used for cache busting

Examples:

 * `dig expiredsig3600.go.dnscheck.tools txt`
 * `dig truncate-zyxw11.go.dnscheck.tools txt`
 * `dig watch-badsig-ipv6-klx872.go.dnscheck.tools a`

HTTP
 * /watch/xxxxxx - watch incoming dns requests (live!)
   * where xxxxxx is the client id used in the dns requests (see above)
   * the "watch" option must be used in the dns requests (see above)

SEE ALSO

Some other, unaffiliated websites we find useful:

 * dnssec-analyzer.verisignlabs.com - analyze the DNSSEC setup of a domain
 * dnsviz.net - another DNSSEC domain analyzer
 * routersecurity.org - a site focused on the security of routers
 * r/dns, r/HomeNetworking - relevant subreddits

CONTACT

On reddit, u/dnschecktool

PRIVACY POLICY

We don't track or care who you are. This site doesn't use cookies. Cheers!

dns requests received: 394