is it DNS?

Run a probe

Measures the DNS path from your network. One file, no root, no daemon, no key.

$ curl -fsSL https://isitdns.net/join.sh | sh

The fleet, live

watching the ledger

How to read the map

The glowing dots

  1. Each color is one resolver operator. One color means one thing on this map, everywhere.
  2. Those IPs are anycast: 1.1.1.1 is announced from every orange city at once, and the internet routes you to the nearest one.
  3. These are major PoPs, not a complete list, and the site that answers you can differ from the nearest dot.

Ask a resolver which site answered you:

$ dig @1.1.1.1 CH TXT id.server +short

The lime dots

  1. Each lime dot is a real volunteer machine running the probe.
  2. We only ever store the country a report came from. Never an address, never an IP.
  3. So the dot is placed inside its country with a fixed random nudge. The position is approximate on purpose.

The lime pulses

  1. Every 60 seconds each probe runs its battery: 1.1.1.1 over DoH, 8.8.8.8 over DoH, 9.9.9.9 over DoT.
  2. The pulse flies to the nearest PoP of that operator. That is a model of anycast, not a trace; the real answering site can differ.
  3. The animation is sped up about 24x so you can see it. The real cadence is once a minute.

The pink pulses

  1. Every 5 minutes each probe rolls its measurements into one signed report. Its TPS report.
  2. The report flies home to a hive sink.
  3. The sink verifies the signature. A report that fails verification is the strongest tamper evidence a probe can produce. Sped up here too.
  4. The big flash with the ring is different: it is real. We check the ledger once a minute, and the burst fires only when a probe's report count actually went up.

The white diamonds

  1. pns1 New York, pns2 Phoenix, pns3 Frankfurt.
  2. Three of them so a report always has a home, and no single outage blinds the hive.

The hover cards

  1. The card shows that probe's real numbers from the same API the roster reads. Nothing modeled.
  2. The sink counters count only reports that landed while this page was open, so they start from zero on purpose.
  3. Positions stay country-approximate, and a card never claims more precision than the dot under it.

The admin's own line

  1. probe-prime is the operator's home connection.
  2. The tile above shows its current unbroken streak straight from the same API every other probe uses. No special treatment.
  3. If it goes quiet, the streak resets to zero and says so.

Why add yours

  1. One file, no root, no daemon. The command at the top of this page.
  2. Your network gets a named seat on this map and an honest answer about what your ISP does to your DNS.
  3. Three or more independent vantages can name a liar. Two can suspect. One can only wonder.

Prefer a heads-up before running anything? Leave an email on the front page and you get a note when probe slots open.

Probes running right now

Monitor skynet first.

reading the roster…

Failover witness

When a network's own resolver stops answering, the probe falls back to a public one and says so in its report. Two seats on the same network losing it at the same moment is the network. One seat on its own is just that seat, and stays labelled that way.

reading the timeline…

What it actually runs

QueryWhat the answer tells you
dig +short canary.probe.isitdns.net 192.0.2.111 means nothing rewrote it. Anything else means something on your path changed the answer. why
dig TXT x<nonce>.t.probe.isitdns.net A signed receipt for a name that never existed. It records the resolver address we actually saw, so you learn which resolver really served you.
same query over DoT and DoH Answers on :53 but not :853 or :443 means your network is breaking encrypted DNS.

It holds no key, so it cannot fake a result. It does not read your traffic, log browsing, listen on any port, or run as root.

Requirements

Which machines

Run it on as many as you like. The name is optional and it is public: it appears on the probes roster next to your network's ASN. Skip it and your probe gets a stable anonymous codename instead.

$ curl -fsSL https://isitdns.net/join.sh | sh -s -- my-house

Already running and want a different name? Run the same command again with the new name. The roster picks it up on the next report.

A Raspberry Pi, an always-on desktop, a NAS, or the box your sites already run on are all fine. It needs to stay powered on to be useful, but nothing breaks if it sleeps.

Check it is working

$ ~/.local/bin/isitdns-probe --once

You want verdict PATH REACHED THE GENUINE AUTHORITY. Add --dry-run to measure and send nothing, or --json for raw output.

$ systemctl --user status isitdns-probe.timer

Watch your own domains

Point it at names you care about. It checks them every cycle from your seat and tells you when one stops resolving or slows down.

$ ISITDNS_TARGETS=cloudflare.com,yourdomain.com ~/.local/bin/isitdns-probe --once

Compare resolvers while you are at it:

$ ISITDNS_RESOLVERS=1.1.1.1,8.8.8.8,9.9.9.9 ~/.local/bin/isitdns-probe --once

Make it stick by putting the same lines in ~/.config/isitdns/probe.conf.

Settings

SettingDefaultWhat it does
ISITDNS_LABELa random codenamethe PUBLIC name your probe shows on the roster. Unset, you get a stable anonymous codename like swift-heron-42. Never your hostname.
ISITDNS_INTERVAL300seconds between measurements
ISITDNS_NO_TIMERunsetset to 1 to install with no timer

Uninstall

$ systemctl --user disable --now isitdns-probe.timer $ rm -f ~/.local/bin/isitdns-probe ~/.config/systemd/user/isitdns-probe.* $ rm -rf ~/.config/isitdns-probe

That is everything it ever touched.

Trouble

The measurement fails or times out. That is itself a finding: your resolver could not reach our authoritative servers. Run --once --json and send us the output.

systemctl --user complains on a server. Some minimal images have no user session. Run sudo loginctl enable-linger $USER, or let the installer fall back to cron, which it does automatically.

Behind CGNAT with no public IP. Completely fine. The probe only makes outbound connections and never needs to be reachable.

Why three

One source gives you no truth. Two disagree and you cannot tell which one is lying. Three is quorum: you can name the liar. It is the same rule NTP has always used, applied to DNS paths. Below three you get detection without attribution.

So adding your probe can only add breadth. It can never weaken a verdict.

What we store, and what you get

Aggregates and the signed receipt. We record which country a report came from so your probe can appear on the map. We do not store your IP. No browsing history, no query log, no personal data, nothing sold or shared.