Using "0x20.dnsp.co"

"0x20.dnsp.co" reports whether your resolver is using DNS-0x20 case randomisation, and shows you the name exactly as it arrived.

DNS names are case-insensitive when they are compared, but the case is preserved when a query is copied into the answer. Some resolvers exploit this: they randomise the capitalisation of the name they send, then require the reply to come back with the same pattern. An attacker trying to forge a response has to guess the capitalisation as well as the query ID and source port, which makes cache poisoning considerably harder.

If the name comes back mixed-case, your resolver is using the technique. If it comes back exactly as you typed it, it is not. Neither answer is wrong — it is simply a defence that some resolvers use and others do not.

Example, a resolver that does not randomise:

prompt> dig +short 0x20.dnsp.co TXT
"0x20_case_randomisation=no"
"name_as_received=0x20.dnsp.co"

Example, one that does:

prompt> dig +short 0x20.dnsp.co TXT
"0x20_case_randomisation=yes"
"name_as_received=0X20.dNsP.cO"