Using "min.dnsp.co and minreport.dnsp.co"

These two work together to show whether your resolver practises QNAME minimisation.


Traditionally a resolver sends the entire name to every server in the chain. Looking up "a.b.token.min.dnsp.co" means the root servers, and every server below them, are told the whole thing — even though the root only needs to know about "co" in order to point further down. QNAME minimisation (RFC 9156) sends each server only the part it needs, so the upper servers learn much less about what you are doing.


Look up a name under "min.dnsp.co" with a random token of your own, then ask "minreport.dnsp.co" about that same token. We record how much of the name arrived and how many separate queries it took.


One caveat worth knowing: if the answer comes from a cache, we never see the query at all and the report will say "no" when the truth is "we cannot tell". Always use a token you have never used before.


Step 1 — look up a name with a token you invent:

prompt> dig +short a.b.mytoken123.min.dnsp.co 198.51.100.1

Step 2 — ask what we saw:

prompt> dig +short mytoken123.minreport.dnsp.co TXT "qname_minimisation=no" "queries_seen=1" "saw A a.b.mytoken123.min.dnsp.co (+0.0s)" "Your resolver sent the whole name in one query, so every server in the chain saw all of it."