Every DNS debugging session starts the same way: you run dig, you get an answer, you move on. The problem is that dig tells you what one resolver saw on one path at one moment in time. The domain name system is a tree — thirteen root server identities, a handful of TLD servers, however many nameservers you’ve delegated to — and a normal lookup walks exactly one branch of that tree and stops at the first answer that works.
That’s usually fine. It’s exactly not fine when you’ve just moved nameservers, or one of your authoritative servers is misbehaving, or a referral is quietly broken in a way that only matters the day something else also fails. The working branch hides the broken ones.
What ExploreDNS does
ExploreDNS is a free tool from Hansen IT Solutions that walks the entire delegation tree for a domain — the way a real iterative resolver would, but without the shortcuts. It starts at the root servers, follows every referral it receives, resolves nameserver addresses out-of-band when the glue records are missing, and keeps going until every branch is exhausted. Then it collates everything it saw into one report: a readable tree in the browser, or JSON if you’re piping it somewhere.
You can use it right now at exploredns.hansenits.com — no account, no cost, no “contact sales” button. There’s also a CLI and Docker images if you’d rather stay in a terminal, which I’ll get to.
The problems this actually catches
When you can see every path through the delegation instead of one lucky path, a whole class of DNS problems stop being mysterious:
- You’ve moved nameservers. Are the root and TLD servers pointing every path at the new delegation, or is your laptop’s cached resolver just telling you what you want to hear? Each branch shows what the public hierarchy actually serves, not what your cache remembers.
- Authoritative servers disagreeing. If one secondary is still serving the old zone, a single lookup might hit the healthy one and look fine. Side-by-side branch results surface the disagreement immediately.
- Missing or stale glue. When a referral names nameservers whose addresses aren’t shipped in the parent zone, ExploreDNS resolves them out-of-band and shows you the gap — before a resolver somewhere else fails to.
- CNAME spaghetti. It follows CNAME chains to the end and detects loops, which is exactly what you want when a migration has left a trail of aliases three services deep.
- Transport weirdness. Answers that truncate over UDP, EDNS0 buffer sizes misbehaving, servers that only respond on TCP — you can force TCP for the whole traversal and compare.
- Version fingerprinting. It queries
version.bind(CHAOS class) along the way, so you get a picture of what software is actually answering on each branch — handy for audits and for finding that one NS nobody remembers patching.
All thirteen roots
A single traversal from one root server is still one view. Enable “all root servers” and ExploreDNS starts a traversal from every one of the thirteen root server sets, in parallel, and merges the results. Because the roots and TLD servers are the one piece of DNS infrastructure everyone genuinely shares, this is the closest thing to asking the public DNS hierarchy, collectively, “what do you actually think of this domain?” Inconsistent answers between roots almost always mean something interesting upstream — or a cache doing something it shouldn’t.
The web interface
The public instance streams traversal progress in real time — you watch the tree build branch by branch as queries complete, with a summary panel tracking results, answers, errors, maximum depth and duration. For big zones with deep delegations it’s oddly mesmerising, and more practically, you spot the red branches as they happen rather than parsing a wall of text afterwards.
For terminal people
ExploreDNS is written in Go and ships as a single static binary with no runtime dependencies, so it’s equally at home on your laptop or a jump box:
# MX records, all 13 root server sets, JSON output
exploredns --type MX --all-root-servers --json example.com | jq .
# Force TCP end-to-end (answers that only survive TCP show up fast)
exploredns --always-tcp example.com
Grab a prebuilt binary from the releases page, go install it directly, or use the published Docker images for the CLI and the web UI if you’d rather self-host the whole thing behind your own domain. Worth knowing: by default the tool runs in fast mode, sharing resolved nameserver addresses across branches for speed. Turn it off (--fast=false) when you want every branch to resolve independently — slower, but it exposes per-branch resolution failures that fast mode papers over.
A nod to where it came from
ExploreDNS is inspired by the classic dnstraverse Ruby tool, which did this dance years ago and then slowly faded as Ruby runtimes became something nobody wanted to install for one utility. This is a modern Go rewrite with the same stubborn idea at its core: don’t trust the first answer; walk the whole tree. It’s released under GPLv3, and the source is up on our Gitea if you want to see how the traversal works or run your own instance.
After DNS comes uptime
Getting every branch of your delegation answering correctly is step one. Knowing it stays that way is step two — if you haven’t already, have a look at HITS Scout, our uptime monitoring service that checks more than your homepage. DNS resolving everywhere, endpoints actually answering: it’s the same philosophy, one layer up.
Point your next DNS mystery at exploredns.hansenits.com and see what the whole tree thinks.

