Documentation

Use dnsbin, end to end.

Every tool, what it answers, and the practical workflows that string them together — from a single record lookup to automated checks over the API and MCP.

Start here

Resolve a name, diagnose a problem, or automate the check.

dnsbin is a browser-first DNS toolbox. The panels you click and the JSON endpoints scripts call run the exact same cores, so what you see is what you can automate.

Open the toolboxBrowse workflow guides

Choose your path

What are you trying to do?

ResolveLook up a recordGet the current A, MX, TXT, or any record for a host. DiagnoseFix a DNS problemPropagation, DNSSEC, delegation, and mail records. InvestigateTrace ownershipRDAP, reverse PTR, and blocklist reputation. AutomateScript itREST, MCP, and OpenAPI for CI and agents.

Workflow guides

Practical recipes

Each guide is a working recipe — when to reach for it, the steps, and copyable commands.

Resolve a single recordLook up one record type for a host, read its TTL and data, and confirm what a public resolver returns right now.Audit every record for a hostFetch the common record-type set in one request, then probe well-known subdomains to map a domain quickly.Verify a change has propagatedRun the same query across several public resolvers and watch the agree/differ verdict and per-resolver latency.Validate a DNSSEC chain of trustConfirm a domain is DNSSEC-signed, that a validating resolver authenticates it (the AD flag), and that the chain of trust is complete from the TLD down to the domain.Diagnose email DNSInspect a domain’s MX, SPF, DMARC, and DKIM records together to find why mail bounces or lands in spam.Investigate a domain or IPPull structured registration data with RDAP and resolve an address back to its hostname with reverse PTR.Trace the delegation pathWalk the delegation chain label by label, from the top-level domain down to a domain’s authoritative nameservers.Check an IP against blocklistsTest an IPv4 address against common DNS blocklists (RBLs) to see whether mailers are rejecting it.Compare internal and external viewsChoose where a lookup runs — the server’s edge vantage, your own browser, or both side by side — to expose split-horizon differences.Capture and share a snapshotFreeze a lookup result as a read-only, shareable page so a record’s value is preserved for a ticket or handoff.Automate with the API and MCPDrive every dnsbin tool from a script, a CI pipeline, or an AI agent using the JSON REST API or the MCP server.

Reference

The toolbox

Eleven tools, grouped by intent. Every one has a matching JSON endpoint.

GroupToolEndpointWhat it answers
ResolveLookup/api/v1/lookupOne record type for a host (A, AAAA, MX, TXT, …).
ResolveAll records/api/v1/lookup-allThe common record-type set in a single request.
DiagnosePropagation/api/v1/propagationThe same query across public resolvers, with latency.
DiagnoseDNSSEC/api/v1/dnssecSigned/validated status and the chain of trust.
DiagnoseTrace/api/v1/traceThe delegation path from the root to the zone.
InvestigateRDAP / WHOIS/api/v1/rdapRegistration and ownership for a domain or IP.
InvestigateReverse PTR/api/v1/reverseThe hostname an IP address claims.
InvestigateBlocklist/api/v1/dnsblWhether an IPv4 is listed on common RBLs.
InvestigateDiscovery/api/v1/discoverCommon subdomains probed for live records.
EmailMail health/api/v1/mailMX, SPF, DMARC, and DKIM in one parsed view.
ShareSnapshots/api/v1/snapshotsRead-only, shareable result pages.

Reference

Record types

Lookup and Propagation accept any of these 18 types:

AAAAAMXTXTNSCNAMESOACAAPTRSRVHTTPSSVCBTLSADSDNSKEYSSHFPNAPTRCDS
A / AAAA
IPv4 and IPv6 addresses for a host.
CNAME
An alias pointing one name at another.
MX
Mail exchangers that accept a domain’s email.
TXT
Free-form text — SPF, verification tokens, and policies.
NS / SOA
Authoritative nameservers and the zone’s start-of-authority.
CAA
Which certificate authorities may issue for the domain.
DS / DNSKEY
DNSSEC delegation-signer and public keys.
HTTPS / SVCB
Service binding hints (ALPN, ports, ECH) for connections.

Reference

Resolvers

Pick which public resolver answers. Most speak JSON DoH; OpenDNS is wire-format and decoded on the server.

ResolverNotesBrowser-direct?
CloudflareJSON DoH (1.1.1.1). Default.yes
GoogleJSON DoH (8.8.8.8).yes
DNS.SBJSON DoH, privacy-focused.yes
AdGuardJSON DoH with filtering.server-side
OpenDNSWire-format DoH, decoded server-side.server-side

Reference

Where a lookup runs

The Run from selector controls the vantage point for record lookups. Compare internal and external views →

ModeRuns fromBest for
ServerCloudflare’s edge vantage point.A neutral, outside-your-network view.
Your browserDirectly from your device via DoH.Confirming what your own network resolves.
HybridBrowser when possible, else the server.The sensible default — fast and resilient.
BothServer and browser, side by side.Spotting split-horizon differences at a glance.

Sharing

Snapshots

Any result can be frozen as a public, read-only page — useful for tickets and handoffs. The value won’t change when the record does.

  • Click Save snapshot under any result, or POST /api/v1/snapshots — public and rate-limited, no key required.
  • Read one back at GET /api/v1/snapshots/{id} or its share URL.
  • Snapshots are public — don’t capture anything you wouldn’t share.

Snapshot workflow →

Automation

API, MCP, and agents

Read endpoints are public and need no auth. Authenticated writes and MCP tools use API keys from the authority site.

OpenAPI 3.1The full REST contract for every endpoint. MCP serverModel Context Protocol tools at /mcp. llms.txtA machine-readable map for LLMs and agents.

Automation workflow →

Privacy & limits

Good to know

  • Lookups are not logged as user history server-side; recent queries live only in your browser.
  • Snapshots are stored only when you explicitly save one.
  • Public resolvers see the names you query — don’t look up secrets.