DNSSEC detection
DNSSEC support has always been measured live rather than maintained by hand: each run asks the resolver for a domain published with a deliberately broken signature, and a resolver that validates refuses to return it. What went wrong was how a missing answer was read.
- No answer is no longer treated as "no DNSSEC". That probe runs last, after a dozen or more queries against the same resolver, so on a busy run it was the one most likely to be squeezed out by a slow or rate-limiting server. Silence was being recorded as a lack of support, which is why a provider could appear to validate on one of its addresses and not on another. An inconclusive probe is now retried on a fresh connection with a longer timeout.
- Validation is now confirmed against a correctly signed control domain, so a resolver that is failing every query cannot be mistaken for one that is rejecting bad signatures. The "authenticated data" flag is deliberately not used as the deciding signal, because at least one large provider sets it while still returning the broken signature.
- A dropped DNS-over-TLS session is retried on a fresh connection. Previously every remaining probe on that server failed once the resolver closed the connection.
Verified against thirteen resolvers with known behaviour, including confirmation that Level 3, Comodo and 114DNS genuinely do not validate.
EDNS Client Subnet tester
Results now show an ECS badge for resolvers that honour EDNS Client Subnet (RFC 7871), and the flag is included in CSV and JSON exports. The app sends a client subnet option and reports whether the resolver echoes it back, which is what separates a resolver that takes the client's network into account from one that ignores it. Works over plain DNS, DoH and DoT.
Assets
- Windows installer:
DNS-Hop-Setup-v2.4.7.exe - Windows portable:
DNS-Hop-Portable-v2.4.7.zip - Linux:
DNS-Hop-AppImage-v2.4.7-x86_64.AppImage(with.sha256)