====== Telenegar DNS Check Tool ======

The **Telenegar DNS Check Tool** is a web-based diagnostic utility designed to perform global DNS queries, verify record propagation, test resolution across specific domestic and international resolvers, and validate DNSSEC trust chains.

It allows network administrators, systems engineers, and domain owners to inspect DNS responses from distributed probe locations and targeted DNS providers.

----

===== Tool Features & Parameters =====

The DNS Check interface provides flexible query controls to simulate lookups from various locations and upstream resolvers:

^ Parameter ^ Description ^ Options / Examples ^
| **Domain Name** | The fully qualified domain name (FQDN) or hostname to query. | e.g., ''telenegar.ir'', ''catc.ac.ir'', ''mail.example.com'' |
| **Record Type** | The specific DNS resource record type to retrieve. | ''A (IPv4)'', ''AAAA (IPv6)'', ''MX'', ''TXT'', ''CNAME'', ''NS'', ''PTR'', ''CAA'', ''SRV'', ''SOA'' |
| **Query Mode** | The resolution strategy used by the lookup engine. | ''Recursive (default)'', ''Authoritative'', ''Iterative / Trace'' |
| **DNS Provider** | The target upstream recursive DNS resolver or ISP network to test against. | ''TIC'' (Telecommunication Infrastructure Company), ''Cloudflare (1.1.1.1)'', ''Google (8.8.8.8)'', ''Quad9'', ''Shekan'', ''Electro'' |
| **Probe** | The remote geographical vantage point or datacenter probe executing the query. | ''Falkenstein, Germany — Hetzner Online GmbH'', domestic Iran probes, regional cloud nodes |
| **Verify DNSSEC** | Cryptographic validation checkbox to verify DNSSEC signatures and chain of trust. | Enabled / Disabled |

----

===== How to Perform a DNS Check =====

  # **Enter Domain Name:** Type the domain or subdomain you wish to inspect into the **DOMAIN NAME** field (e.g., ''catc.ac.ir'').
  # **Select Record Type:** Choose the required DNS record type from the **RECORD TYPE** dropdown menu (e.g., ''A (IPv4)'' for IP mapping, ''MX'' for mail exchange, or ''TXT'' for SPF/DMARC policies).
  # **Select Query Mode:** Leave as ''Recursive (default)'' for standard client resolution, or switch to ''Authoritative'' to query the domain's designated nameservers directly.
  # **Select DNS Provider:** Choose a specific resolver (such as ''TIC'' or ''Cloudflare'') to verify how that provider caches or resolves the domain.
  # **Select Probe Location:** Choose a distributed probe (e.g., ''Falkenstein, Germany — Hetzner Online GmbH'') to test DNS resolution from a specific global region.
  # **Enable DNSSEC (Optional):** Check the **Verify DNSSEC** box if you want the probe to validate ''RRSIG'', ''DS'', and ''DNSKEY'' records for cryptographic authenticity.
  # **Execute:** Click the blue **Resolve** button to perform the query and render the response headers, TTL, and record data.

----

===== Key Use Cases & Troubleshooting =====

==== 1. DNS Propagation Testing ====
After updating DNS records or nameservers at your registrar, test resolution using different **Probe** locations (e.g., European probes vs. local Iranian probes) to verify global propagation status.

==== 2. Domestic vs. International Resolution Comparison ====
Select domestic resolvers (such as **TIC** or local ISP providers) and compare response outputs against international providers (such as Google or Cloudflare) to diagnose CDN routing, split-horizon DNS, or local network filtering issues.

==== 3. Email Authentication Auditing ====
Inspect critical email security records before sending mail campaigns:
  * Query **MX** records to verify mail routing targets.
  * Query **TXT** records for `_dmarc.yourdomain.com`, `_mta-sts.yourdomain.com`, and `v=spf1` policies.
  * *For automated email stack diagnostics, use the [[tools:mailcheck|Telenegar Mail Check Tool]].*

==== 4. DNSSEC Validation & Trust Chain Inspection ====
Enabling the **Verify DNSSEC** checkbox helps identify misconfigured DS records, expired RRSIG signatures, or broken chain-of-trust issues that cause validation failures (`SERVFAIL`) on validating recursive resolvers.

----

===== Related Documentation & Tools =====

  * [[tools:mailcheck|Telenegar Mail Check Tool]] — Diagnostic tool for email authentication (SPF, DKIM, DMARC) and SMTP server health.
  * [[security:security-headers|HTTP Security Headers]] — Audit web server response headers and transport policies.
  * [[security:best-practices|Cybersecurity Best Practices]] — Infrastructure hardening and DNS management standards.
  * [[email:troubleshooting:reverse-dns|Reverse DNS (PTR)]] — Understanding rDNS configuration for outbound mail.
  * [[email:dns-configuration:mta-sts|MTA-STS Configuration]] — Implement enforced TLS requirements for incoming email.