Documentation

Use dnsbin, end to end.

Every tool, what it answers, and the practical workflows that string them together — from a single record lookup to automated checks over the API and MCP.

Start here

Resolve a name, diagnose a problem, or automate the check.

dnsbin is a browser-first DNS toolbox. The panels you click and the JSON endpoints scripts call run the exact same cores, so what you see is what you can automate.

Open the toolboxBrowse workflow guides

Choose your path

What are you trying to do?

ResolveLook up a recordGet the current A, MX, TXT, or any record for a host. DiagnoseFix a DNS problemPropagation, DNSSEC, delegation, and mail records. InvestigateTrace ownershipRDAP, reverse PTR, and blocklist reputation. AutomateScript itREST, MCP, and OpenAPI for CI and agents.

Workflow guides

Practical recipes

Each guide is a working recipe — when to reach for it, the steps, and copyable commands.

Run a guided domain reportGet one plain-language health check for a whole domain — apex records, DNSSEC, mail, and delegation — without running each tool by hand.Resolve a single recordLook up one record type for a host, read its TTL and data, and confirm what a public resolver returns right now.Audit every record for a hostFetch the common record-type set in one request, then probe well-known subdomains to map a domain quickly.Verify a change has propagatedRun the same query across several public resolvers and watch the agree/differ verdict and per-resolver latency.Validate a DNSSEC chain of trustConfirm a domain is DNSSEC-signed, that a validating resolver authenticates it (the AD flag), and that the chain of trust is complete from the TLD down to the domain.Diagnose email DNSInspect a domain’s MX, SPF, DMARC, and DKIM records together to find why mail bounces or lands in spam.Investigate a domain or IPPull structured registration data with RDAP and resolve an address back to its hostname with reverse PTR.Trace the delegation pathWalk the delegation chain label by label, from the top-level domain down to a domain’s authoritative nameservers.Check an IP against blocklistsTest an IPv4 address against common DNS blocklists (RBLs) to see whether mailers are rejecting it.Compare browser and server requestsQuery the same public DoH resolver from your browser and Cloudflare’s edge, then compare the answers side by side.Capture and share a snapshotFreeze a lookup result as a read-only, shareable page so a record’s value is preserved for a ticket or handoff.Automate with the API and MCPDrive every dnsbin tool from a script, a CI pipeline, or an AI agent using the JSON REST API or the MCP server.

Reference

The toolbox

Eleven tools, grouped by intent. Every one has a matching JSON endpoint.

GroupToolEndpointWhat it answers
DiagnoseDomain report/api/v1/reportGuided whole-domain check (apex, DNSSEC, mail, trace) with plain-language findings.
ResolveLookup/api/v1/lookupOne record type for a host (A, AAAA, MX, TXT, …).
ResolveAll records/api/v1/lookup-allThe common record-type set in a single request.
DiagnosePropagation/api/v1/propagationThe same query across public resolvers, with latency.
DiagnoseDNSSEC/api/v1/dnssecSigned/validated status and the chain of trust.
DiagnoseTrace/api/v1/traceThe delegation path from the root to the zone.
InvestigateRDAP / WHOIS/api/v1/rdapRegistration and ownership for a domain or IP.
InvestigateReverse PTR/api/v1/reverseThe hostname an IP address claims.
InvestigateBlocklist/api/v1/dnsblWhether an IPv4 is listed on common RBLs.
InvestigateDiscovery/api/v1/discoverCommon subdomains probed for live records.
EmailMail health/api/v1/mailMX, SPF, DMARC, and DKIM in one parsed view.
ShareSnapshots/api/v1/snapshotsRead-only, shareable result pages.

Reference

Record types

Lookup and Propagation accept any of these 18 types:

AAAAAMXTXTNSCNAMESOACAAPTRSRVHTTPSSVCBTLSADSDNSKEYSSHFPNAPTRCDS
A / AAAA
IPv4 and IPv6 addresses for a host.
CNAME
An alias pointing one name at another.
MX
Mail exchangers that accept a domain’s email.
TXT
Free-form text — SPF, verification tokens, and policies.
NS / SOA
Authoritative nameservers and the zone’s start-of-authority.
CAA
Which certificate authorities may issue for the domain.
DS / DNSKEY
DNSSEC delegation-signer and public keys.
HTTPS / SVCB
Service binding hints (ALPN, ports, ECH) for connections.

Reference

Resolvers

Pick which public resolver answers. Most speak JSON DoH; OpenDNS is wire-format and decoded on the server.

ResolverNotesBrowser-direct?
CloudflareJSON DoH (1.1.1.1). Default.yes
GoogleJSON DoH (8.8.8.8).yes
DNS.SBJSON DoH, privacy-focused.yes
AdGuardJSON DoH with filtering.server-side
OpenDNSWire-format DoH, decoded server-side.server-side

Reference

Where a lookup runs

For Lookup, the Run from selector chooses where requests to the selected public DoH resolver originate. It does not query your device’s configured DNS server or private split-horizon DNS. Compare browser and server requests →

ModeRuns fromBest for
ServerThe selected public resolver, queried from Cloudflare’s edge.Checking the resolver’s answer from the server.
Your browserThe selected public resolver, queried from your device via DoH.Checking its answer and DoH reachability from your device.
HybridSingle Lookup: browser-first, with server fallback.Resilient single-record lookups.
BothThe selected public resolver from server and browser, side by side.Comparing answers from two request origins.

Sharing

Snapshots

Any result can be frozen as a public, read-only page — useful for tickets and handoffs. The value won’t change when the record does.

  • Click Save snapshot under any result, or POST /api/v1/snapshots — public and rate-limited, no key required.
  • Read one back at GET /api/v1/snapshots/{id} or its share URL.
  • Retention: anonymous snapshots are kept for 30 days. Save with an account (a dns:create key or a signed-in session) and the snapshot persists until you delete it.
  • Manage your own: list with GET /api/v1/snapshots, delete with DELETE /api/v1/snapshots/{id} (dns:delete), or use the delete controls on your account page.
  • Snapshots are public — don’t capture anything you wouldn’t share.

Snapshot workflow →

Automation

API, MCP, and agents

Read endpoints are public and need no auth. Authenticated writes and MCP tools use API keys from the authority site.

OpenAPI 3.1The full REST contract for every endpoint. MCP serverModel Context Protocol tools at /mcp. llms.txtA machine-readable map for LLMs and agents.

Automation workflow →

Privacy & limits

Good to know

  • Lookups are not logged as user history server-side; recent queries live only in your browser.
  • Snapshots are stored only when you explicitly save one. Anonymous snapshots are deleted after 30 days; account-owned snapshots stay until you delete them.
  • Public resolvers see the names you query — don’t look up secrets.