↓ Skip to main content
OpsKit

DNS Ops Lab - Resolver Diff, Cutover Planner & Cache Debugger

Investigate resolver divergence, plan DNS cutovers, explain NXDOMAIN cache behavior, and trace alias chains with a browser-based DNS operations lab.

Resolver Diff Lab

Query

Quick examples

Why this is useful

“Propagation” usually means different recursive resolvers are holding different cache states. This view compares answers directly instead of flattening them into a vague global status.

Cloudflare vs Google side-by-side
Status, TTL, AD flag, and answers
Expected-value mismatch hints
Partial failure stays usable
One resolver failed, but partial comparison data is still available.
DNS Cutover Planner

Plan inputs

Quick presets

Runbook mindset

This planner assumes your goal is to reduce stale-cache risk before the change, then verify from more than one resolver after the cutover.

Lower TTL ahead of time
Account for cache-drain window
Keep rollback window visible
Copy terminal checks before touching prod
NXDOMAIN Cache Explainer

Query

Quick examples

What this clarifies

Negative caching is why “I added the record already” can still return nothing for a while. This module surfaces the likely SOA-derived wait window and tells you whether you are seeing NXDOMAIN, NODATA, or mixed answers across resolvers.

One resolver failed, but partial negative-cache evidence is still available.
Alias & Delegation Path

Query

Quick examples

Designed for migrations

Alias path tracing is useful when CDN onboarding, SaaS verification, or hostname cutovers hide a mismatch several hops away from the name you changed.

CNAME and HTTPS alias hops
Broken terminal answers
Zone and NS context
Warnings for deep chains
One provider failed during trace collection, but a usable chain was still recovered.

Why DNS Ops Lab Exists
#

Most DNS sites stop at generic record lookups and propagation maps. Real incidents are usually messier: one resolver still serves stale data, an alias chain ends somewhere unexpected, or a newly created record is shadowed by negative caching.

DNS Ops Lab is built around those operational workflows instead of commodity lookups.

If you want a broader starting point for everyday DNS lookups, propagation checks, reverse DNS, mail DNS, and record generation, use DNS Tools. DNS Ops Lab stays focused on the deeper troubleshooting path.

Included Modules
#

Resolver Diff Lab
#

Compare live answers from multiple public resolvers side by side:

  • Detect mismatched answers, TTL drift, and status-code divergence
  • Check whether the answer set matches the value you expected to see
  • Separate “propagation” myths from actual resolver-cache behavior

DNS Cutover Planner
#

Plan record changes before you touch production:

  • Estimate when to lower TTL
  • See a safe cutover window and cache-drain horizon
  • Keep copyable dig commands close to the plan

NXDOMAIN Cache Explainer
#

Understand why a record still appears missing after you created it:

  • Surface SOA-derived negative-cache timing
  • Show the likely authoritative zone apex
  • Explain whether you are seeing NXDOMAIN, NODATA, or mixed resolver behavior

Alias & Delegation Path
#

Trace what your hostname actually resolves through:

  • Follow CNAME and HTTPS alias hops
  • Flag deep or broken chains
  • Add zone and NS context so SaaS/CDN onboarding issues are easier to spot

Privacy Model
#

This page does not send DNS data to OpsKit servers. It performs browser-to-resolver queries directly against public DNS-over-HTTPS endpoints.

  • No local storage
  • No cookies
  • No server-side proxy in this version

Operational Notes
#

  • Public resolvers do not perfectly represent every recursive resolver on the internet
  • Negative caching is derived from recursive evidence and SOA data, not authoritative log access
  • Use this tool to shorten debugging loops, then verify critical production changes with your normal terminal workflow

Quick Command Reference
#

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# Compare two resolvers directly
dig @1.1.1.1 example.com A
dig @8.8.8.8 example.com A

# Inspect SOA and negative-cache context
dig example.com SOA
dig missing.api.example.com A

# Follow an alias chain
dig app.example.com CNAME
dig app.example.com HTTPS
dig final-target.example.net A

Related Tools#