# Dig online via DoH: A, MX, TXT from mobile or restricted nets > Online DoH tester free with 6 selectable resolvers (Cloudflare, Google, AliDNS, dns.sb): query A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, PTR, SRV and cross-compare to spot filtered answers. Free in-browser tool (no upload): https://www.mauriziofonte.it/tools/dns-over-https-tester DNS resolution via **DNS over HTTPS** with **6 selectable resolvers**: Cloudflare (standard, Security, Family), Google, AliDNS and dns.sb, with one-click cross-compare. Resolve **A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, PTR**. Output: parsed Answer section in a table, full raw JSON for debugging and RFC 8484 status code. The query leaves the browser straight to Cloudflare: useful to verify DNS propagation, debug SPF/DKIM/DMARC and troubleshoot MX records remotely, even from mobile or restricted networks. ## How to make a DoH query 1. **Enter the domain** - Without schema (no `https://`), no trailing slash, no path. E.g. `www.mauriziofonte.it`, `mail.google.com`. For reverse PTR: enter `1.0.0.127.in-addr.arpa` (IPv4) or ARPA reverse (IPv6). 2. **Pick the record type** - **A** (IPv4), **AAAA** (IPv6), **CNAME** (alias), **MX** (mail server), **TXT** (SPF/DKIM/DMARC/verifications), **NS** (nameservers), **SOA** (zone authority), **CAA** (cert authority), **PTR** (reverse). **ANY** not guaranteed (modern resolvers refuse it for anti-amplification). 3. **Pick a mode and press Query** - **Query** asks the chosen resolver for one record type, **Domain profile** collects all the main records of the domain, **Compare** asks every resolver in the list the same question. The result shows up in a table with name, type, TTL and value. 4. **Read the raw JSON** - Below the table, full raw JSON for debugging. Relevant fields: `Status` (0 = OK, 2 = SERVFAIL, 3 = NXDOMAIN), `TC` (truncation), `RD` (recursion desired), `RA` (recursion available), `AD` (DNSSEC validated), `CD` (DNSSEC checking disabled). ## DNS over HTTPS, in practice **DoH vs classic DNS.** DNS over HTTPS (RFC 8484) is DNS encapsulated in HTTPS on port 443, indistinguishable from regular web traffic in transit. Pros: privacy (plain-text DNS over UDP/53 is inspectable by the provider and by network intermediaries), bypass of DNS hijacking typical on public WiFi, bypass of DNS-based censorship (the inspection requires more expensive DPI). Costs: 10-30 ms extra latency compared to UDP/53, and a concentration of traffic toward a few public endpoints (1.1.1.1, 8.8.8.8, 9.9.9.9). **Cloudflare JSON endpoint.** The tool queries `cloudflare-dns.com/dns-query` with `Accept: application/dns-json`, the public REST format from Cloudflare. The response is a structured JSON with Status, Answer, Authority, Additional, readable without decoding the binary wire format from RFC 1035. **Operational use cases.** Verify DNS propagation after a change (TTL expire monitoring), debug TXT records for SPF/DKIM/DMARC before enabling email auth, check MX records for email delivery troubleshooting, inspect DNSSEC via the `AD` flag. Works from the browser without installing CLI tools: useful for quick debugging from mobile or networks where `dig` isn't available. If the question is not "what does this resolver answer" but "is my DNS change done", you need the authoritative plane: that is covered by the [DNS propagation checker](/tools/dns-propagation-checker), which queries the zone's nameservers directly and classifies every divergence instead of just displaying it. ## Glossary - **DoH**: DNS over HTTPS, RFC 8484. DNS encapsulated in HTTPS port 443. Public endpoints: Cloudflare cloudflare-dns.com/dns-query, Google dns.google/dns-query, Quad9 dns.quad9.net/dns-query. - **DoT**: DNS over TLS, RFC 7858. DNS in TLS port 853. Alternative to DoH, more efficient (no HTTP overhead) but identifiable by firewalls (dedicated port). Implemented by systemd-resolved, Android 9+, AdGuard, Pi-hole. - **TTL**: Time To Live in seconds. How long a DNS record stays cached by downstream resolvers. Typical: 300 (5 min) for dynamic records, 3600 (1h) for stable ones, 86400 (24h) for authoritative zones. - **DNSSEC**: DNS Security Extensions: cryptographic signing of DNS records to prevent spoofing. Cloudflare validates DNSSEC by default (the `AD` field is true if the zone is DNSSEC-signed and validated). - **Authoritative server**: DNS server that holds the original copy (zone file) for a domain. Distinct from caching resolvers (1.1.1.1, 8.8.8.8) that ask the authoritative and cache. Authoritatives are declared in NS records. - **ANY query**: DNS query asking all record types for a domain. Deprecated (RFC 8482) for anti-amplification (ANY response can be 100x query size, abused in DDoS). Cloudflare answers with an `HINFO` placeholder. ## Frequently asked questions ### Can I use a different endpoint than Cloudflare? Yes, from the UI: the Resolver selector offers 6 DoH endpoints (Cloudflare 1.1.1.1, Cloudflare Security 1.1.1.2, Cloudflare Family 1.1.1.3, Google 8.8.8.8, AliDNS 223.5.5.5, dns.sb) and the **Compare all resolvers** button queries all 6 in parallel, highlighting missing or filtered answers (useful to tell whether a domain is blocked by a DNS filter). The shareable link keeps domain, record type and chosen resolver. ### Is there a rate limit? Cloudflare's public endpoint has an indicative rate limit on the order of 1000 requests/hour per IP. For occasional debugging (dozens of queries) it's more than enough. For continuous monitoring, the right approach is a self-hosted resolver (CoreDNS, Pi-hole, Unbound) with backoff and cache, not hammering a public endpoint. ### Are the data private? The query goes through Cloudflare (privacy policy: 24h query log, no permanent IP storage, no sale to third parties, declared in [2018 blog post](https://blog.cloudflare.com/announcing-1111)). The browser sends HTTPS, the hosting site (mauriziofonte.it) does NOT see the query (it's a cross-origin fetch directly from the browser to Cloudflare). ### Difference vs `dig @1.1.1.1 example.com`? Equivalent. `dig` uses UDP port 53 plain-text, this tool uses HTTPS port 443 encrypted. Identical output (Answer section). Tool advantage: works from the browser without installing anything, convenient on mobile. ### Can I do reverse PTR queries? Yes, use the `1.0.0.127.in-addr.arpa` format (IPv4 reverse) or nibble-ARPA for IPv6, type PTR. E.g. for IP `8.8.8.8`: `8.8.8.8.in-addr.arpa` (4 reversed octets + suffix). ### Does it handle CAA records? Yes. CAA (RFC 8659) controls which CAs can issue certificates for a domain. Example: `letsencrypt.org` has CAA that admits only Let's Encrypt. If you switch CA, remember to update the CAA before the new issuance. ### Is wire-format response (classic DNS) supported? No, JSON only. For wire format (RFC 1035 binary) change `Accept` to `application/dns-message` and the response becomes binary `application/dns-message`, which you parse manually. Tools like `dnscrypt-proxy` do that; this tester sticks to the JSON-friendly subset. --- Tool by Maurizio Fonte, senior backend engineer. All tools: https://www.mauriziofonte.it/tools/