Using "mismatch.dnsp.co"

"mismatch.dnsp.co" answers an A query with a TXT record — deliberately the wrong type — to show you whether anything between you and us is filtering the response.

A well-behaved recursive resolver will not pass an answer whose type does not match the question. That is sensible: it is one of the ways cache-poisoning attempts are smuggled past a resolver. So if you ask us directly you will see the TXT record, and if you ask through most resolvers you will see nothing at all.

The result tells you something about your resolver rather than about us. Seeing the TXT record through a resolver means that resolver is passing type-mismatched data on to you, which is a weaker posture than the alternative.

Asked directly — the mismatched record is visible:

prompt> dig mismatch.dnsp.co A @dnsp.co
;; ANSWER SECTION:
mismatch.dnsp.co.	0	IN	TXT	"TXT-ANSWER-TO-A-QUERY"

Asked through a recursive resolver — usually stripped:

prompt> dig +short mismatch.dnsp.co A
(no answer)