Compare DNS server results on iPhone

What a comparison does

A comparison sends one query, the same domain name and record type, to several resolvers at the same moment: System DNS, which is whatever resolver your device uses on the current network, and up to four resolvers you choose. Each one has its own protocol: UDP or TCP for standard DNS, or DNS over HTTPS (DoH) or DNS over TLS (DoT) for encrypted DNS.

Presets cover Cloudflare, Google and DNSPod, or you can enter your own server. A custom DoH server needs a credential-free address ending in /dns-query or /; for DoT, you set the host to connect to and the name its certificate is verified against.

The queries are sent only from Linkalyst. Your device’s DNS settings stay as they are.

Set up a comparison

A comparison takes a few taps:

1. Open DNS Lookup and choose “Compare” at the top.
2. Enter a domain, such as a site that loads slowly, and pick a record type. A asks for IPv4 addresses, AAAA for IPv6.
3. Leave “System DNS” checked to include your current resolver. You can uncheck it, but a comparison needs at least two resolvers.
4. Under “Protocol for added providers”, pick UDP, TCP, DoH or DoT, then tap the circle next to a provider to add it. “Custom Server” adds your own; tap the chevron on an added resolver to change it.
5. Start the comparison. One run covers up to five resolvers.

You can mix protocols, for example the same provider over UDP and over DoH, to see whether the protocol makes a difference on your network.

Read the response times

Each row shows how long that resolver took in this run. “Fastest this round” marks the quickest resolver that answered. It describes this run only: Linkalyst does not pick a best server, and one round says little on its own.

The times are not measured the same way for every resolver, either. For a resolver you add, each query opens a new connection, so its time includes connection setup, and for DoH and DoT that includes the TLS handshake. System DNS does not report how it reached its server, and it may answer from a cache, so a very quick System DNS time for a popular name may never have left the device. Expand a row and open “Full Response” to see these conditions.

As general context: in everyday use, encrypted DNS usually keeps its connection open between queries, so a time measured over a fresh connection overstates its cost.

When the answers differ

If resolvers return different records, Linkalyst shows “Resolvers returned different records” and tags the rows that differ from the most common answer with “Mismatch”. The order of the records does not count as a difference.

Different answers are often normal. Large sites and content delivery networks answer with addresses close to where a query seems to come from, and each resolver asks from its own location, so two correct answers can differ. Answers also differ when a resolver filters certain domains, when a record has just changed and caches have not caught up, or when a network rewrites DNS answers.

To check an address, switch to “Query”, look the name up with the resolver in question, and fill an address from the result into Latency Test or Port Check.

No answer, or a failure

A resolver that answers without records is different from one that could not be reached. Expand a row to see which it was:

• NXDOMAIN, shown as “Domain doesn’t exist”: the resolver says the name does not exist.
• NODATA: the name exists but has no record of the type you asked for, for example an AAAA query for a name with only IPv4 addresses.
• A timeout: no complete reply within five seconds; for a resolver you added, that time includes connecting. A timeout does not mean the name does not exist.
• A failure. “Full Response” shows its “Failure Layer”: “Connection” when the server could not be reached, TLS when the secure connection could not be set up or verified, HTTP when a DoH server answered with an error status or something other than DNS, and DNS when the reply was malformed or reported a server error.

System DNS does not expose the response code, so for it you only see that there were no records, not whether that was NXDOMAIN or NODATA.

If DoH or DoT fails while UDP to the same provider works, the network may be blocking or intercepting encrypted DNS. Some public, school and work networks do this, and DoT, which uses its own port (853 by default), is the easier one to block. Linkalyst does not fall back to unencrypted DNS or switch providers when that happens, so the failure shows as it is.

Repeat, and keep the results

Resolver times change with the time of day, the network you are on and what is already cached. Run the same comparison a few times, and again later or on another network, before deciding anything. A resolver that is fastest once may not be the next time.

Earlier comparisons are listed under “Recent 5”, and each run is saved as a report in Records, where you can look back at it or share its DNS results as CSV.

If you want to change your DNS

Linkalyst never changes the device’s DNS settings; a comparison only sends queries from the app. If the results lead you to try another resolver, that change is made outside Linkalyst: in iOS, for example for one Wi-Fi network, through a profile or app from the DNS provider, or on your router, which then hands the setting to every device on the network.

Afterwards, run the same comparison again. The new resolver now answers as System DNS, so you can see whether anything changed.