# Global DNS Explorer

> Ask every authoritative name server and public resolvers: records, propagation, DNSSEC, mistakes. Queries each authoritative name server of a domain directly and compares the answers with Google and Cloudflare DNS-over-HTTPS and the local resolver. Shows SOA serial drift (propagation in progress), DNSSEC validation, lame delegation, CNAME at the apex, glue hints, TTLs, and what changed since the previous check.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://globaldnsexplorer.usefulweb.site/ (interactive tool at https://globaldnsexplorer.usefulweb.site/tool)
- JSON API: POST https://globaldnsexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://globaldnsexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://globaldnsexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://globaldnsexplorer.usefulweb.site/mcp - tool `global_dns_explorer`

## Inputs
- mode (select): Mode
- domain (text): Domain - Live mode: the domain or host name to check.
- pasted (textarea): Resolver answers (JSON) - Pasted mode: {domain, zone?, dsPresent?, nameservers:[{name,addresses}], resolvers:[{id,label,kind:"authoritative"|"public-doh"|"local",status,ad?,records:{A:{values,ttl}}}]} — the "result" of a live check also works.
- trackChanges (boolean): Remember this check and show changes since the last one

## Method
- Finds the zone (walking up from the host name until NS records exist) and resolves every name server to its addresses with the server's resolver.
- Queries SOA, NS, A, AAAA, CNAME, MX, TXT and CAA directly at each authoritative name server (first public IPv4 address; private addresses are never contacted), at Google and Cloudflare DNS-over-HTTPS and at the local resolver.
- Propagation: different SOA serials between authoritative servers mean secondaries have not yet transferred the latest zone; public resolvers answering differently hold cached data until the TTL expires (or serve location-dependent answers).
- Lame delegation: a listed name server that refuses, fails (SERVFAIL/NXDOMAIN) or returns no SOA for the zone. Glue: in-zone name servers need A/AAAA glue at the parent; a name server name that does not resolve is flagged.
- DNSSEC: DS record at the parent (Google DoH) plus the AD (authenticated data) flag from Google and Cloudflare; DS present but SERVFAIL everywhere = bogus.
- History: each live check stores a snapshot of the authoritative records under sha256(domain); the next check lists added/removed values per record type (up to 20 snapshots kept).