dns.pizza

A signed zone confesses every name.

DNSSEC signs DNS answers so they cannot be forged. That includes the answer “no such name”, and the original way of signing it is a confession: ask for zzz.example.com and the zone replies, signed, “nothing exists between www.example.com and example.com”. Every denial names the next real record.

So you can ask for each name in turn and follow the chain until it wraps back to the start, holding the whole zone: every host, staging box and forgotten subdomain, including the ones nobody put in a certificate or a link. Type a domain and we walk it, or tell you why it will not walk.

Try dnssec-tools.org (walks in a second), isc.org (hundreds of names), iana.org (NSEC3), cloudflare.com (black lies).

How the walk works

  • Every name owns an NSEC record (RFC 4034 §4) that lists the next name in the zone's sorted order and the record types held at this one. We ask for it at the apex, read the next name, ask again there, and stop when the next name is the apex again.
  • Delegations are stepped over. A subzone handed to other nameservers answers for itself, and its own chain would lead us away. So at a delegation we ask for a name that sorts just after it and read the parent's covering record out of the “no such name” reply.
  • It is all public. Every question goes through Cloudflare's and Google's public resolvers, one at a time. No zone transfer, no guessing, no brute force. RFC 7129 describes zone walking as a known property of NSEC; it is the reason NSEC3 was invented.
  • Big zones take more than one run. We stop after about 400 names or 35 seconds and give you a link that carries on from the last name.

If your zone walks

First, remember that DNS was never a secret store: anything in it can be found some other way, from certificate logs to passive DNS. Do not rely on an unlisted name to protect a machine. If you would still rather not hand out the list, switch the zone to NSEC3 (a setting in BIND, Knot, PowerDNS and most signers; RFC 9276 says zero extra iterations and no salt) or to a provider that signs denials on the fly, as Cloudflare does. Our DNSSEC validator checks the chain of trust itself.