DnsQuery vs Bare

DnsQuery — inspect DNS, verify DNSSEC DnsQuery is a wire-level DNS tool for engineers, sysadmins, and curious network nerds. Send a query to any resolver — public, private, or your router — and see the full response: parsed answer sections, every flag, the raw bytes annotated by region, and an independent, end-to-end DNSSEC chain-of-trust walk that doesn't just take the resolver's word for it. Query and inspect - Hand-picked list of public resolvers (Cloudflare, Google, Quad9, OpenDNS, AdGuard) with IPv4 and IPv6 addresses, plus your configured system resolver on macOS, plus custom resolvers you define yourself. - Send over UDP, TCP, DNS-over-TLS (DoT), DNS-over-HTTPS (DoH), or DNS-over-QUIC (DoQ). - Control the individual query flags that matter: Recursion Desired (RD), DNSSEC OK (DO) for RRSIG / DNSKEY / NSEC records, and Checking Disabled (CD) to bypass upstream validation. - 18+ record types including A, AAAA, MX, SRV, CAA, SSHFP, TLSA, DNSKEY, DS, RRSIG, NSEC, NSEC3. - Color-coded hex dump of query and response bytes with a legend — see at a glance where the header, labels, compression pointers, and RDATA live. - Extended DNS Errors (RFC 8914) surfaced prominently when the upstream resolver tells you why something failed. Validate DNSSEC yourself - Full chain-of-trust walk from the IANA root trust anchors (KSK-2017 and KSK-2024) down to your answer, step by step. Every DS match, DNSKEY verification, and RRSIG check is shown with the key tag and algorithm. - Handles positive answers, NXDOMAIN and NODATA via full RFC 5155 NSEC3 three-proofs (closest encloser + next closer + wildcard), CNAME chains, insecure delegations, and NSEC3 opt-out. - Enforces RFC 6840 algorithm-downgrade protection and RFC 5011 key-revoke rules — won't silently accept a stripped-stronger-algo response. - Split-horizon aware: when a zone publishes both internal and external KSKs with two DS records in the parent, validation succeeds for whichever view your chosen resolver sees, helping you troubleshoot internal zones without fighting the tool. - Clear verdict at the top: Secure, Insecure (unsigned delegation), Bogus (with the specific zone and failure reason), or Indeterminate. Sync and share - Query history and your custom resolver list sync across your Mac, iPad, and iPhone through iCloud Key-Value storage (signed into the same Apple ID). No servers, no accounts, no tracking. Who it's for If you know what an RRSIG is, you're the target audience. Use it to debug a DNSSEC rollover that went sideways, verify a new resolver's behaviour, inspect what a malicious DNS rebinding might look like, or just satisfy curiosity about what actually travels over port 53. Privacy No analytics, no telemetry, no account required. All queries go directly from your device to the resolver you chose. History is stored in your own iCloud, not ours. From the maker of DnsEditor

Bare is a web browser with ad and tracker blocking built in and switched on from the first launch. Nothing to configure, nothing to buy first. WHAT IT BLOCKS Five filter lists ship inside the app — about 163,000 rules covering ads, trackers, regional ads, cookie notices and page annoyances. They refresh in the background every day. If an update fails, the previous rules stay in use, so you are never left unprotected without being told. Blocking applies to pages you open in Bare. It does not reach into other apps, and your connection still goes straight to the site. WHEN A SITE BREAKS Tap the shield in the address bar and blocking is off for that site. Tap it again to turn it back on. Every site you have switched it off for is listed in Settings, so you can find them again months later. WHAT IT COLLECTS Anonymous counts of how the app is used, with a switch in Settings that stops them. Never a page you visited, a search you typed, or a page title. No account, no ad ID, no crash reporting. Your history stays on this device and is never synced. Bookmarks sync through your own iCloud, which we cannot see. READING Reader mode strips a page down to the article, with four text sizes and a light, sepia or dark background. Pages with no dark mode of their own can be forced dark, per site. Text size is remembered per site too. THE REST OF A BROWSER Tabs with no limit. Private tabs that leave nothing behind when you close them. Five search engines. Find on page. Downloads that show up in the Files app. Desktop mode per site. Swipe from the edge to go back and forward. NEWS ON THE START PAGE Headlines in the language the app is set to. All 35 languages have their own publishers, 159 feeds altogether. A phone set to Danish gets Danish papers. The requests go out from your phone. Nothing passes through a server of ours. Tap a headline and it opens in a tab like any other link. Turn it off in Settings and the requests stop. 35 LANGUAGES Bare follows your phone's language. Settings has a list if you want a different one, and the change takes effect while you are still looking at the screen. You do not have to restart anything. Menus, error messages, the news, all of it. FREE, ALL OF IT Every feature, every filter list, every update. No paid tier, no account, nothing held back. There is a tip in Settings if you want to leave one, and it unlocks nothing. This app contains no ads and never will.