isitdns

Dig one record

dig

Read-onlyIdempotent

Dig one name and type at one board resolver, or at Cloudflare, Google, Quad9 and AdGuard side by side (resolver all): records, flags, rcode, EDE, latency. Not for a whole domain: check_domain. Asked over DoH from the isitdns edge. from moves the question to that region's probe as Do53 over UDP, and follow: true adds the CNAME chain as separate reads with DNSSEC off. A resolver given as an address must be on the board.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`cd`	No	Ask the resolver not to validate
`ecs`	No	EDNS Client Subnet, e.g. 192.0.2.0/24
`from`	No	Ask over Do53/UDP from the probe in this region (no other transport)
`name`	Yes	The name, e.g. _dmarc.example.com. Also as "domain"; a URL is read as its host.
`nsid`	No	Request NSID (RFC 5001)
`type`	No	Record type, e.g. A, MX, TXT, DS, HTTPS, or TYPE<n>	A
`norec`	No	Clear RD, like dig +norec
`dnssec`	No	Set the DO bit and read AD
`family`	No	Address family for Do53 dials; a DoH request does not choose it	v4
`follow`	No	Also walk the CNAME chain from this name, hop by hop, to its addresses
`resolver`	No	A board resolver id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, mullvad-base, dns4eu-protective), its address or host name (8.8.8.8, dns.google), or all for cloudflare, google, quad9, adguard side by side.	cloudflare

Output Schema

TableJSON Schema

Name	Required	Description
`api`	Yes	The /api GET that asks it again, as a new reading
`query`	No	The question as asked: name, type, flags, transport
`follow`	No	follow: the CNAME hops, how the chain ends, its reads
`results`	No	One row per resolver: id, response (rcode, flags, records, EDE), latencyMs, at, vantage, or error
`askAgain`	No	The isitdns.net page that asks it again, when one does
`receipts`	No	One per DNS read: what, of whom, from where, when, rcode, flags, EDE, ms, answer
`agreement`	No	resolver all: rows grouped by answer, and the ones with none

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedOct 13, 2026

changedInput schema / properties / family / description

Previous value: -"Address family to dial"New value: +"Address family for Do53 dials; a DoH request does not choose it"

changedInput schema / properties / from / description

Previous value: -"Ask from the probe in this region"New value: +"Ask over Do53/UDP from the probe in this region (no other transport)"

changedInput schema / properties / resolver / description

Previous value: -"A board resolver id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, mullvad-base, dns4eu-protective), an alias such as 8.8.8.8, or all for cloudflare, google, quad9, adguard side by side."New value: +"A board resolver id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, mullvad-base, dns4eu-protective), its address or host name (8.8.8.8, dns.google), or all for cloudflare, google, quad9, adguard side by side."

Changed1 schema field changedOct 9, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "agreement": {
+      "description": "resolver all: rows grouped by answer, and the ones with none",
+      "type": "object"
+    },
+    "api": {
+      "description": "The /api GET that asks it again, as a new reading",
+      "type": "string"
+    },
+    "askAgain": {
+      "description": "The isitdns.net page that asks it again, when one does",
+      "type": "string"
+    },
+    "follow": {
+      "description": "follow: the CNAME hops, how the chain ends, its reads",
+      "type": "object"
+    },
+    "query": {
+      "description": "The question as asked: name, type, flags, transport",
+      "type": "object"
+    },
+    "receipts": {
+      "description": "One per DNS read: what, of whom, from where, when, rcode, flags, EDE, ms, answer",
+      "type": "array"
+    },
+    "results": {
+      "description": "One row per resolver: id, response (rcode, flags, records, EDE), latencyMs, at, vantage, or error",
+      "type": "array"
+    }
+  },
+  "required": [
+    "api"
+  ],
+  "type": "object"
+}

Changed1 schema field changedOct 6, 2026

addedInput schema / properties / follow

Added value: +{
+  "default": false,
+  "description": "Also walk the CNAME chain from this name, hop by hop, to its addresses",
+  "type": "boolean"
+}

Changed1 schema field changedOct 4, 2026

changedInput schema / properties / resolver / description

Previous value: -"A board resolver id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, mullvad-base, dns4eu-protective), an alias such as 8.8.8.8, or all for the tier-1 operators side by side."New value: +"A board resolver id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, mullvad-base, dns4eu-protective), an alias such as 8.8.8.8, or all for cloudflare, google, quad9, adguard side by side."

Changed6 schema fields changedSep 29, 2026

changedInput schema / properties / cd / description

Previous value: -"Checking disabled: ask the resolver not to validate"New value: +"Ask the resolver not to validate"

changedInput schema / properties / ecs / description

Previous value: -"EDNS Client Subnet in CIDR form, e.g. 192.0.2.0/24"New value: +"EDNS Client Subnet, e.g. 192.0.2.0/24"

changedInput schema / properties / family / description

Previous value: -"Which address family to dial the resolver on"New value: +"Address family to dial"

addedInput schema / properties / from

Added value: +{
+  "description": "Ask from the probe in this region",
+  "enum": [
+    "north-america",
+    "europe"
+  ],
+  "type": "string"
+}

changedInput schema / properties / name / description

Previous value: -"The name to ask for, e.g. example.com or _dmarc.example.com. Also accepted as \"domain\"; a URL is reduced to its host."New value: +"The name, e.g. _dmarc.example.com. Also as \"domain\"; a URL is read as its host."

changedInput schema / properties / type / description

Previous value: -"Record type: A, AAAA, MX, TXT, NS, SOA, CNAME, DS, DNSKEY, CAA, SRV, HTTPS, SVCB, PTR, or TYPE<n>"New value: +"Record type, e.g. A, MX, TXT, DS, HTTPS, or TYPE<n>"

Changed1 schema field changedSep 29, 2026

changedInput schema / properties / resolver / description

Previous value: -"A board resolver id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, mullvad-base, dns4eu-protective), a registry alias such as 8.8.8.8 or dns.google, or \"all\" for the tier-1 operators side by side (cloudflare, google, quad9, adguard). An address that is not on the board is refused here with the HTTP URL that can dial it."New value: +"A board resolver id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, mullvad-base, dns4eu-protective), an alias such as 8.8.8.8, or all for the tier-1 operators side by side."

Changed1 schema field changedSep 28, 2026

changedInput schema / properties / name / description

Previous value: -"The name to ask for, e.g. example.com or _dmarc.example.com"New value: +"The name to ask for, e.g. example.com or _dmarc.example.com. Also accepted as \"domain\"; a URL is reduced to its host."

Changed1 schema field changedSep 27, 2026

changedInput schema / properties / resolver / description

Previous value: -"A board resolver id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, mullvad-base, dns4eu-protective), a registry alias such as 8.8.8.8 or dns.google, or \"all\" for every public resolver side by side. An address that is not on the board is refused here with the HTTP URL that can dial it."New value: +"A board resolver id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, mullvad-base, dns4eu-protective), a registry alias such as 8.8.8.8 or dns.google, or \"all\" for the tier-1 operators side by side (cloudflare, google, quad9, adguard). An address that is not on the board is refused here with the HTTP URL that can dial it."

Changed3 schema fields changedSep 27, 2026

changedInput schema / properties / norec / description

Previous value: -"Clear RD, like dig +norec, when asking an authoritative server directly"New value: +"Clear RD, like dig +norec"

changedInput schema / properties / resolver / description

Previous value: -"A board resolver id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, mullvad-base, dns4eu-protective), a registry alias such as 8.8.8.8 or dns.google, \"all\" for every public resolver side by side, or any public IP address"New value: +"A board resolver id (cloudflare, google, quad9, opendns, adguard, cleanbrowsing, controld, quad9-unfiltered, adguard-family, cleanbrowsing-family, adguard-unfiltered, opendns-familyshield, nextdns, cloudflare-malware, cloudflare-family, mullvad-base, dns4eu-protective), a registry alias such as 8.8.8.8 or dns.google, or \"all\" for every public resolver side by side. An address that is not on the board is refused here with the HTTP URL that can dial it."

removedInput schema / properties / transport

Removed value: -{
-  "default": "doh",
-  "description": "DoH (RFC 8484 wire format), DoT on 853, Do53 over TCP, or Do53 over UDP. udp53 is the transport the Cloudflare edge cannot run, so it is measured from our own probe off Cloudflare (each result says which seat measured it in vantage) and it carries RD and DNSSEC only: +cd, ECS and NSID are refused rather than dropped.",
-  "enum": [
-    "doh",
-    "dot",
-    "tcp53",
-    "udp53"
-  ],
-  "type": "string"
-}

Changed2 schema fields changedSep 12, 2026

changedInput schema / properties / transport / description

Previous value: -"DoH (RFC 8484 wire format), DoT on 853, or Do53 over TCP"New value: +"DoH (RFC 8484 wire format), DoT on 853, Do53 over TCP, or Do53 over UDP. udp53 is the transport the Cloudflare edge cannot run, so it is measured from our own probe off Cloudflare (each result says which seat measured it in vantage) and it carries RD and DNSSEC only: +cd, ECS and NSID are refused rather than dropped."

changedInput schema / properties / transport / enum

Previous value: -[
-  "doh",
-  "dot",
-  "tcp53"
-]New value: +[
+  "doh",
+  "dot",
+  "tcp53",
+  "udp53"
+]

First observedSep 10, 2026

TDQS

A4.9/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, idempotent, open-world safety, and the description adds meaningful behavior: DoH from the isitdns edge, from switching to Do53/UDP, follow adding separate CNAME reads with DNSSEC off, and the constraint that address resolvers must be on the board.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense, front-loaded single paragraph with no filler; purpose, exclusion, transport, and special modes are ordered usefully. Every clause contributes operational information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 11-parameter tool with full schema coverage, rich annotations, and an output schema, the description supplies enough operational context about scope, transport, alternatives, and edge cases. Return values are appropriately left to the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds cross-parameter semantics for resolver=all, from, follow, and the address-resolver board requirement. Most individual parameter meanings remain in the schema, so it does not fully earn a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Dig one name and type at one board resolver'), describes the side-by-side resolver-all mode, and lists the result artifacts. It explicitly differentiates from sibling check_domain for whole-domain queries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear when-not rule ('Not for a whole domain: check_domain') and explains context-dependent modes such as resolver=all, from region probes, and follow: true for CNAME-chain walks. The agent can choose between this and the named alternative without inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All isitdns tools Inspect

Try in Browser

Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?