DigDeep — Client-Side DNSSEC, Mail, Web/HTTPS & Multi-DoH Analyzer

Inspect domain names, user@domain email identities, and IPv4/IPv6 addresses directly in your browser with zero backend servers — combining WebCrypto DNSSEC chain-of-trust validation, Mail & DANE identity auditing, Web/HTTPS & Certificate Transparency checks, BGP/RPKI lookups, 10-resolver DoH consensus, and byte-level DNS wire dissection.

JavaScript & WebCrypto Required

DigDeep runs 100% client-side with no server proxy. Enable JavaScript to execute live RFC 8484 DNS-over-HTTPS queries, verify DNSSEC chains via browser SubtleCrypto, audit Mail / SPF / DKIM / DMARC / DANE & OPENPGPKEY / SMIMEA identities, cross-check HTTPS / ECH / CAA against Certificate Transparency logs, inspect Reverse DNS + BGP/RPKI routes, compare 10 DoH resolvers & RFC 7871 EDNS Client Subnet (ECS) GeoDNS steering, and dissect raw DNS wire packets.

Key Capabilities

DNSSEC Chain-of-Trust & Zone Hygiene: Validates RFC 4034 / 4035 / 5155 chains from IANA Root KSK trust anchors using SubtleCrypto (RSA, ECDSA P-256/P-384, Ed25519), including NSEC / NSEC3 Opt-Out / Compact Denial (“Black Lies”), CDS / CDNSKEY / CSYNC rollover sync, ZONEMD (RFC 8976), wildcard (*.domain) synthesis, SaaS TXT hygiene, SOA timers, NS BGP ASN diversity, and dangling NS/CNAME takeover checks.
Mail Security & DANE Email Identity (user@domain): Audits MX routing, SMTP DANE (_25._tcp TLSA, RFC 7671/7672), recursive SPF 10-lookup budgets with an interactive sender IPv4/IPv6 evaluator, DKIM keys, DMARC (RFC 7489/9091), MTA-STS, TLS-RPT, and BIMI, plus OPENPGPKEY (RFC 7929) and SMIMEA (RFC 8162) lookup with client-side OpenPGP .asc & X.509 .pem inspection.
Web, HTTPS/SVCB, TLS ECH & Certificate Transparency: Decodes HTTPS / SVCB (RFC 9460) SvcParams (alpn, TLS ECHConfigList, ipv4hint / ipv6hint drift, dohpath), tree-walks CAA policies (RFC 8659/8657) cross-checked against Certificate Transparency (CT) logs with subdomain discovery, and validates _443._tcp Web DANE TLSA and SSHFP (RFC 4255).
IPv4 / IPv6 Reverse DNS, BGP ASN, RPKI & DNSBL: Automatically converts IPv4/IPv6 inputs to in-addr.arpa / ip6.arpa, verifies Forward-Confirmed Reverse DNS (FCrDNS), Team Cymru BGP ASN origins, RPKI Route Origin Authorizations (RFC 6811), and DNSBL IP reputation (RFC 5782).
10-Resolver DoH Consensus & RFC 7871 ECS Geo-Steering: Queries Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9 9.9.9.9, DNS.SB, DNS4EU, Mullvad, AdGuard, CleanBrowsing, and OpenDNS side-by-side (CD=0 vs CD=1) to surface RFC 8914 Extended DNS Errors (EDE), protective blocking, SOA serial skew, and DNSKEY rollover drift — plus multi-region RFC 7871 EDNS Client Subnet (Option 8) probes across 6 continents & 0.0.0.0/0 opt-out to audit GeoDNS steering and cache-busting SCOPE prefixes.
Byte-Level Wire Dissector, Zonefile Export & Offline History: Interactive hex + packet structure dissector with RFC 1035 §4.1.4 0xC0xx compression pointer visualization and arbitrary ?dns= / hex decoding, RFC 1035 .zone export, dig / delv / kdig / curl CLI reproducers, time-travel RRSIG re-verification, snapshot diffing, and SVG/PNG graph export.