Advanced DNS Record Inspector
Look up and parse CERT, LOC, and IPSECKEY records.
Explicit network action
Inspect uncommon public DNS records
No request made
Nothing is queried until you submit
Returned records are parsed locally. No certificate, map, gateway, or key destination is contacted.
No network request
Local record inspector
Local only · 0 / 8,192 characters
Working notes
Use Advanced DNS Record Inspector with the boundary visible.
Advanced DNS Record Inspector looks up CERT, LOC, and IPSECKEY records through the disclosed Cloudflare DNS-over-HTTPS resolver, then parses bounded presentation-format data locally without contacting embedded locations, gateways, or certificate references.
What is Advanced DNS Record Inspector?
Beyond the common DNS record types (A, AAAA, MX, CNAME, TXT), the DNS standard defines several specialized record types for specific use cases. CERT records store X.509 certificates, PGP keys, or other certificate data directly in DNS, enabling certificate discovery without a separate PKI infrastructure. LOC records associate a domain name with a geographic location (latitude, longitude, altitude, precision), originally intended for network mapping and geographic routing. IPSECKEY records publish IPsec public keys and gateway information in DNS, enabling opportunistic encryption between hosts that have never communicated before — a host can look up another host's IPSECKEY record to establish an encrypted tunnel without pre-shared keys or manual configuration. These record types are not widely deployed but appear in specialized environments: government networks, academic institutions, and infrastructure providers. This inspector retrieves these records from Cloudflare's DNS-over-HTTPS resolver and parses the binary presentation format into human-readable fields, or you can paste RDATA directly for offline inspection without making any network requests.
When to use it
- Inspecting CERT records — look up and parse certificate data published in DNS for domains that use DANE or DNS-based certificate distribution.
- Checking LOC records — inspect the geographic coordinates associated with a domain, useful for verifying network infrastructure documentation.
- Analyzing IPSECKEY records — examine the IPsec public keys and gateway addresses published for a domain to verify opportunistic encryption configuration.
- Offline RDATA parsing — paste raw RDATA directly into the inspector to decode presentation-format data without making DNS queries.
- DNS record auditing — verify that advanced record types are correctly formatted and contain the expected field values.
How to use it
- 01Choose CERT, LOC, or IPSECKEY, enter the DNS owner name, and review the exact record type and provider disclosure.
- 02Run the explicit lookup and open any returned record in the local inspector.
- 03Review parsed fields and cautious diagnostics, or paste RDATA directly to inspect it without making a request.
Common mistakes
- Expecting common records — CERT, LOC, and IPSECKEY are specialized record types. Most domains do not publish them. An empty result is normal, not an error.
- Treating LOC as authoritative — LOC records are self-reported by the domain owner. The coordinates are not verified and may be inaccurate, outdated, or intentionally vague.
- Confusing CERT with TLSA — CERT records store certificates directly in DNS. TLSA records (DANE) store certificate associations for specific services. They are different standards with different use cases.
- IPSECKEY is not HTTPS keys — IPSECKEY records are for IPsec tunnel establishment, not HTTPS/TLS. They do not replace TLSA or certificate transparency.
Synthetic example
IPSECKEY gateway
Input
10 1 2 192.0.2.38 AQIDBA==
Result
Precedence 10 · IPv4 gateway · RSA algorithm · Base64 public-key syntax parsed
Related standards
Limits and data boundary
- Cloudflare receives the query name, record type, connection IP, and normal HTTPS metadata only after submission.
- CERT payloads are not decoded or cryptographically validated; LOC data is not checked against real geography; IPSECKEY material is not used to establish an IPsec connection.
- The resolver AD bit is displayed but StackCache does not independently validate DNSSEC. Results and pasted data remain in memory only.
Frequently asked questions
- What is a CERT DNS record?
- A CERT record stores a certificate or related certificate data in DNS. It can reference X.509 certificates, PGP keys, or other certificate types associated with a domain name.
- What is a LOC DNS record?
- A LOC record stores geographic location data (latitude, longitude, altitude) in DNS. It is used to associate a domain name with a physical location, though it is not widely deployed.
- What is an IPSECKEY DNS record?
- An IPSECKEY record publishes an IPsec public key and gateway information in DNS, enabling opportunistic encryption between hosts without pre-configured security associations.
Keep working