DNS over HTTPS lookup

Type a name and a record type. A QIP component encodes the question as an RFC 1035 DNS message, your browser sends it to a public resolver over RFC 8484 DNS over HTTPS (DoH), and a second component decodes the reply into the text layout that dig prints.

Network tool: When you press Look up, your browser sends the name, record type, and DNSSEC setting as a DNS query in the displayed request URL to the selected resolver, Cloudflare or Google. The resolver receives the query and the request's source IP address. Editing the form and using Decode a message do not send your input to a resolver.

Decode a message #

Paste a DNS message as hex or as base64url, such as the dns parameter of a DoH GET URL. Nothing is sent.

How it works #

• dns-query-to-dns-message.wasm turns cloudflare.com HTTPS into a query message. The message ID is 0, as RFC 8484 recommends, so identical queries share one HTTP cache entry. DNSSEC records sets the EDNS DO flag.
• The page sends the query with an RFC 8484 GET, putting the message in the dns parameter as base64url. Both resolvers allow cross-origin GET requests. Google rejects the CORS preflight that a POST with content-type: application/dns-message needs, so the page doesn't use POST.
• dns-message-to-text.wasm decodes the reply, including EDNS options such as Extended DNS Errors. It rejects a malformed message with the byte offset of the problem.

The same components work in a terminal:

printf 'cloudflare.com HTTPS' |
  qip run application/dns-message/dns-query-to-dns-message.wasm -u dnssec_ok=1 |
  curl -s --header 'content-type: application/dns-message' --data-binary @- https://cloudflare-dns.com/dns-query |
  qip run application/dns-message/dns-message-to-text.wasm

Cloudflare and Google each publish their own privacy policy for their public resolvers.