Code · Mac app · in progress
It Is Always DNS
A macOS app for DNS lookups and diagnostics, short name iiadns. It shows what a name resolves to, from which server, and why, and it's being built to check whether your queries go where you think they do.
Source on GitHub → Build from source · in progress
§ What it does
When a site resolves differently than you expect, or you're not sure your DNS queries go where you think they do on a VPN, tools like dig give you scattered answers. It Is Always DNS puts them in one Mac app. The name comes from the running joke that DNS is always the cause.
Queries run through DNSKit, a resolver written in Swift with no dependencies, so the app never shells out to nslookup. A small Go server, leakd, handles leak tests by recording which resolvers actually ask about its test names.
§ Features
- Lookups for A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, SRV, CAA and ANY records, with the server and response time.
- Query the system resolver or a specific one, over UDP or TCP, with the DNSSEC DO bit and a raw hexdump.
- A live view of the Mac's DNS configuration.
- A menu bar item next to the main window.
idns, adig-style command line on the same engine. It also does reverse lookups and compares one query across several resolvers.
§ At a glance
| Runs on | macOS 26 |
| Status | Early · build from source |
| Engine | DNSKit · Swift, no dependencies |
| Command line | idns |
| Leak-test server | leakd · Go |
§ Status
- Working now: the DNSKit engine and
idns(16 tests, cross-checked againstdig), the app's Lookup and Resolvers tabs, and the leakd server. - Not wired up yet: the app's Leak Test tab, which needs a deployed leakd and a verdict engine.
- Planned: encrypted DNS (DoH, DoT, DoQ),
dig +trace, and ASN and location details for resolvers. - There's no download yet. Building it needs macOS 26, Xcode 26, and Go for the server.
§ Questions
- Does the DNS leak test work yet?
- Not in the app. The leakd server works end to end, but the app's Leak Test tab isn't connected to it yet. That's next.
- Is there a command-line version?
- Yes.
idnsis adig-style front end to the same DNS engine. - Does it support DNS over HTTPS or TLS?
- Not yet. Encrypted transports are on the roadmap.