Code · Mac app · in progress
It Is Always DNS
A native Mac tool for working out DNS problems: what a name resolves to, from which server, and why, and whether your queries are going where you think they are.
Source on GitHub → Build from source · in progress
§ What it does
When a site resolves differently than you expect, or you're not sure your DNS queries go where you think they do on a VPN, tools like dig give you scattered answers. It Is Always DNS puts them in one Mac app. The name comes from the running joke that DNS is always the cause.
Queries run through DNSKit, a resolver written in Swift with no dependencies, so the app never shells out to nslookup. A small Go server, leakd, handles leak tests by recording which resolvers actually ask about its test names.
§ Features
- Lookups that show what a name resolves to, from which server, and why.
- Query a specific resolver, reverse lookups, and the DNSSEC DO bit with a raw hexdump.
- Compare one query across several resolvers, or force TCP.
- A live view of the Mac's DNS configuration.
- A menu bar item next to the main window.
idns, adig-style command line on the same engine.
§ At a glance
| Runs on | macOS 26 |
| Status | Early · build from source |
| Engine | DNSKit · Swift, no dependencies |
| Command line | idns |
| Leak-test server | leakd · Go |
§ Status
- Working now: the DNSKit engine and
idns(16 tests, cross-checked againstdig), the app's Lookup and Resolvers tabs, and the leakd server. - Not wired up yet: the app's Leak Test tab, which needs a deployed leakd and a verdict engine.
- Planned: encrypted DNS (DoH, DoT, DoQ),
dig +trace, and ASN and location details for resolvers. - There's no download yet. Building it needs macOS 26, Xcode 26, and Go for the server.
§ Questions
- Does the DNS leak test work yet?
- Not in the app. The leakd server works end to end, but the app's Leak Test tab isn't connected to it yet. That's next.
- Is there a command-line version?
- Yes.
idnsis adig-style front end to the same DNS engine. - Does it support DNS over HTTPS or TLS?
- Not yet. Encrypted transports are on the roadmap.