Free web tools

These free DNS tools inspect public DNS or process pasted zone files without requiring an account. The translator, validator, and two-file diff run in your browser, while DNS migration, RDAP, propagation, and DNSSEC checks run on the server against public data.

Which free DNS tools should you use?#

All tools are linked from the tool directory.

Assess a migration#

The DNS migration checker is the broadest starting point. It detects the current DNS provider from delegated nameservers, looks up registrar data through RDAP, checks DNSSEC, attempts public record discovery, and translates the discovered record sets against destinations.

Public discovery can be incomplete. If the authoritative server permits AXFR, the result can contain the transferred zone. Otherwise the checker asks for common names and record types and labels the discovery partial. It cannot see private names, provider-only settings, or unqueried labels. Use a provider connection or a zone export for the reviewed migration plan described in Quickstart.

Use the DNS provider detector when you only need host, registrar and nameserver facts. It does not translate a zone. Unknown hosting can mean self-hosted DNS or a nameserver pattern the catalog does not recognize.

Translate or validate a zone file#

The Zone translator parses a pasted BIND file and applies the destination catalog to every record set. Its status summary and rows are the same translation model used by migrations: Exact, Translated, Warning, Unsupported and Skipped. Download either the translated BIND file or the JSON report. Unsupported rows are omitted from active zone-file output, so review the report before import.

$ORIGIN example.com.
$TTL 300
@       IN A     192.0.2.10
www     IN CNAME @
_dmarc  IN TXT   "v=DMARC1; p=reject"

The Zone file validator is narrower. It reports parser errors by line, fully qualifies names, canonicalizes values, merges record sets, and provides a normalized download. It does not run the CLI’s complete CNAME, SPF and provider lint rule set. Use dnsmigrator lint or a managed zone’s Zone checks for those rules.

Both tools run locally in the page. Pasted zone text is not needed by a server to produce their results.

Compare files and live DNS#

Use Zone diff for two BIND snapshots. The first pane is the before state and the second is the after state. It uses exact-copy planning, so records found only in the second file are Added and records found only in the first are Removed. Changed rows show both record sets.

Use DNS record diff when one side is live authoritative DNS. Enter the domain and paste the expected zone file. The server asks the domain’s own nameserver about supported record sets, then labels each row Matches, Differs, Not live, or No answer. The result identifies the nameserver queried and reports unreadable file lines. The live comparison caps a single run and states how many additional rows were skipped.

Check DNSSEC#

The DNSSEC checker compares DS records published by the parent with DNSKEY records in the zone, identifies matching key tags, and reports whether a validating resolver accepted the chain. Possible results are signed and consistent, unsigned, broken, or unknown.

The DNSSEC migration checker adds destination context and presents the safe order for a move: remove an old DS when necessary, wait, change nameservers, enable signing at the destination, and publish the new DS. It adapts the signing instruction to the destination catalog’s DNSSEC capability, but you should still follow the destination provider guide and DNSSEC transition documentation.

A broken result means the parent and child do not form a valid chain. Fix that before using a nameserver change as a troubleshooting step.

Watch propagation#

The Propagation checker asks the configured public resolver set for one name and one of the web tool’s supported types: A, AAAA, CNAME, MX, TXT, NS, CAA, or SOA. It shows each answer, TTL and response time, then reports whether all answered resolvers agree.

The CLI propagation command supports more query types and repeatable expected values, which makes it a better fit for scripts and release checks.

npx dnsmigrator propagation www.example.com --type CNAME --expect target.example.net. --strict

Server-side safeguards#

Live tools accept public DNS names, not arbitrary internal endpoints. DNS lookups and RDAP requests use bounded server-side operations, and address guards reject private, loopback, link-local, metadata and CGNAT destinations. Public forms can require a human check and are rate-limited, cached, de-duplicated and concurrency-limited.

No live tool accepts provider credentials. To read a complete private provider zone or apply changes, create an encrypted Connection in the signed-in app.