Observed arrival · 2026-10-13

dnsproof: receipts for DNS promises

dnsproof.net Visit website

Editorial interest 82/100 Selection signal · not a rating of the site

An open-source suite of three DNS tools that checks advertised records, tracks resolutions, and tests network defenses.

Landing page captured for the 2026-10-13 issue.

For: DNS operators and network defenders
Worth noticing: canarydns emits labeled, one-way test patterns to a zone the operator controls, then reports which escaped.

Field notes

The suite separates three jobs: svcbscan compares HTTPS/SVCB records with live connection behavior; dnsledger ingests dnstap and records first- and last-seen resolution; canarydns tests controls from inside a network with labeled, one-way patterns sent to a zone the operator controls. The homepage says all three are single Go binaries under Apache-2.0. dnsledger also names its Passive DNS Common Output Format and a bailiwick check intended to exclude poisoned answers.

Observed signals

Read the marks

Editorial observations of this landing page, not a rating.

○OpenPublic substance visible

✦PrettyNotable craft visible

●ProPolished or operationally mature

◎NicheUnusually specific use

One card from the complete issue

Wrong Answers Go Boing

463,485 arrived 1,000 judged 984 catalogued Enter the complete issue