The quickest way to see if a domain is blocked at Quad9 is using our Blocked Domain Tester.
When Quad9 blocks a domain, the response is NXDOMAIN. NXDOMAIN is also returned when a domain does not exist.To differentiate between domains that are nonexistent, and domains that are blocked, we set the AUTHORITY value differently. When you receive an NXDOMAIN with AUTHORITY: 0, that is a block from Quad9. When you receive NXDOMAIN with AUTHORITY: 1, then that is a domain that does not exist.
A domain will also fail to resolve if DNSSEC authentication fails, but that will result in the SERVFAIL code instead of NXDOMAIN.
- Blocked Domain
- Nonexistent Domain
- DNSSEC Failure
dig @9.9.9.9 isitblocked.org | grep "status\|AUTHORITY"
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 29193
;; flags: qr rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
dig @9.9.9.9 sfaisofnadgre.odafds | grep "status\|AUTHORITY:"
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 22595
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1dig @9.9.9.9 A brokendnssec.net +dnssec | grep status
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 40999