Help & Documentation
Everything you need to investigate DNS, detect tampering, and trust your resolver's story.
Table of Contents
1. Getting Started
What is Syxx Dimensions?
Syxx Dimensions is a DNS investigation suite that traces lookups end to end. It detects spoofed answers, poisoned caches, silent exfiltration, transparent proxies, content injection, and DNSSEC failures. It ships as both a web application served from syxx.app and a native desktop app for macOS, Windows, and Linux.
Web Server vs Desktop App
| Capability | Web (syxx.app) | Desktop App |
|---|---|---|
| DNS resolution & comparison | ✅ Server vantage | ✅ Local vantage |
| Content diff (mirror/warp) | ✅ Pro | ✅ |
| Network path diagnostics | — | ✅ Local-only |
| DNS leak detection | — | ✅ Local-only |
| Packet capture & forensics | — | ✅ Local-only |
| Evidence signing (witness) | — | ✅ Local-only |
| Combined conclusion (conclude) | Partial | ✅ Full pipeline |
How to Activate Pro
- Visit syxx.app/account and sign in.
- Enter your license key to receive a session token.
- The token unlocks prophet, mirror, and warp in the web terminal, plus all desktop features.
The Six Toolsets
🔮 Prophet — DNS resolution integrity. Is a single query/response exchange trustworthy?
🪞 Mirror — Content comparison. Is something actively interfering with what you asked for?
🚪 Portal — Network path diagnostics. What does the path to the destination actually look like?
🍽️ Glutton — Privacy leak detection. Is your VPN keeping DNS queries private?
🔒 Cage — Capture & forensics. What DNS traffic is flowing, and who is responsible?
📜 Witness — Trust infrastructure. Can the evidence and the app itself be trusted?
2. Web Terminal Commands
Each command runs in the web terminal at syxx.app. Enter a domain or URL, select the command, and read the output below the terminal.
🔮 prophet — Multi-Vantage DNS Investigation Pro
What it does: Queries your domain from the Syxx server vantage using multiple resolvers, then compares answers against your local resolver to detect interception or inconsistency.
DNS spoofing, cache poisoning, transparent proxy interception, resolver disagreement, DNSSEC validation failures.
How to use it
- Enter the target domain (e.g.
example.com). - Select prophet from the command dropdown.
- Click Run.
Reading the output
| Field | Meaning |
|---|---|
| Unique Answers | Distinct IP/CNAME values returned across all resolvers |
| Consensus | Percentage of resolvers that agree on the majority answer |
| DNSSEC | Whether the chain validated (secure / insecure / bogus) |
| Resolver detail | Per-resolver answer, latency, and rcode |
🔮 nslookup — DNS Record Lookup Free
What it does: Queries a resolver for any record type on your domain and returns the raw answer. Useful for quick checks of A, AAAA, MX, TXT, CNAME, and more.
Unexpected record values, missing records, NXDOMAIN responses, SERVFAIL conditions.
How to use it
- Enter the domain.
- Optionally select a record type (defaults to A).
- Select nslookup and click Run.
Reading the output
| Field | Meaning |
|---|---|
| Server | Resolver that answered the query |
| Rcode | Response code (NOERROR, NXDOMAIN, SERVFAIL) |
| Records | Each answer with TTL, type, and value |
🔮 dig — Detailed DNS Query Free
What it does: Same core query as nslookup but with additional detail: the AD (Authenticated Data) flag, human-readable rcode names, and full header information.
DNSSEC-aware resolver behavior, authentication flag inconsistencies, truncated responses.
How to use it
- Enter the domain and optional record type.
- Select dig and click Run.
Reading the output
| Field | Meaning |
|---|---|
| AD Flag | Whether the resolver validated DNSSEC (true/false) |
| Rcode Name | Human-readable response status |
| Answer Count | Number of resource records returned |
🔮 whois — Registration Lookup Free
What it does: Fetches RDAP/WHOIS registration data for a domain, showing who owns it, when it was registered, and its current status.
Recently registered domains (phishing indicators), expired registrations, registrar changes, nameserver hijacking.
Reading the output
| Field | Meaning |
|---|---|
| Registrar | The registrar managing the domain |
| Created / Expires | Registration and expiration dates |
| Status | Domain status flags (e.g. clientTransferProhibited) |
| Nameservers | Authoritative nameservers on record |
🔮 email — Email Authentication Check Free
What it does: Checks SPF, DMARC, and DKIM records for a domain and renders a pass/fail/inconclusive conclusion for each protocol.
Missing or weak SPF policies, absent DMARC records, DKIM misconfiguration, email spoofing exposure.
Reading the output
| Field | Meaning |
|---|---|
| SPF | Whether a valid SPF record exists and its policy strength |
| DMARC | Whether a DMARC record exists with a reject/quarantine policy |
| DKIM | Whether DKIM selector records are published |
🔮 subdomains — CT Log Enumeration Free
What it does: Searches Certificate Transparency logs to discover subdomains that have been issued TLS certificates. Reveals the full attack surface of a domain.
Unknown subdomains, wildcard certificates, shadow IT services, certificate issuance anomalies.
Reading the output
Returns a deduplicated list of subdomain names sorted alphabetically. Each entry is a unique subdomain found in CT logs.
🔮 propagation — Global Resolver Check Free
What it does: Queries 17 public resolvers distributed worldwide and shows what each one returns for your domain. Calculates a consensus and propagation percentage.
DNS propagation delays, geo-specific hijacking, split-horizon DNS, regional censorship.
Reading the output
| Field | Meaning |
|---|---|
| Per-resolver | Each resolver's name, location, and returned answer |
| Consensus | The majority answer across all resolvers |
| Propagation % | Percentage of resolvers returning the consensus answer |
🔮 firewall — Filter Detection Free
What it does: Tests whether a resolver blocks known domains by querying a set of control domains that should resolve. Identifies DNS-level filtering or firewall interference.
DNS filtering, ISP-level blocking, corporate firewall interference, government censorship.
Reading the output
| Field | Meaning |
|---|---|
| Per-domain | Each control domain: blocked or open |
| Assessment | Overall conclusion: clean, partial filtering, or heavy filtering |
🔮 dnssec — Chain Validation Free
What it does: Walks the DNSSEC chain from root → TLD → your domain, verifying DS, DNSKEY, and RRSIG records at each level.
Broken DNSSEC chains, missing DS records, expired RRSIG signatures, DNSSEC downgrade attacks.
Reading the output
| Field | Meaning |
|---|---|
| Step | Each level: root, TLD, domain |
| Status | valid, invalid, or inconclusive for each step |
| Detail | Record types found and validation notes |
🪞 mirror — Content Diff Pro
What it does: Fetches a web page from the Syxx server vantage and compares the rendered content against what your local machine receives. Detects in-transit content modification.
Content injection, ISP ad insertion, transparent proxy modification, man-in-the-middle content tampering.
How to use it
- Enter a full URL (e.g.
https://example.com). - Select mirror and click Run.
- Review the diff output showing added, removed, and changed content.
🪞 warp — Source Diff Pro
What it does: Compares the raw HTML, CSS, and JavaScript source of a page fetched from the Syxx server against your local fetch. Shows byte-level differences in the source code.
Script injection, stylesheet modification, HTML rewriting, tracker insertion, malicious code injection.
How to use it
- Enter a full URL.
- Select warp and click Run.
- Review per-resource diffs (HTML, CSS, JS).
📜 conclude — Combined Conclusion Pro
What it does: Aggregates results from all available tools into a single combined conclusion. Requires the desktop app for the full pipeline; the web version provides a partial conclusion based on server-side data.
Comprehensive threat assessment combining DNS integrity, content authenticity, and trust signals.
Note: For the full conclude pipeline (including local network path, leak detection, and forensics), use the desktop app.
3. Web API (Programmatic)
Full API reference: /docs/api
Quick Start
- Authenticate: POST your license key to
/api/authto receive a session token. - Make requests: Include
Authorization: Bearer <token>in subsequent requests. - Parse responses: All endpoints return JSON with a consistent structure:
{status, data, meta}.
Common Patterns
Investigate a domain:
GET /api/prophet?domain=example.com → resolution consensus, DNSSEC status, per-resolver detail.
Check DNSSEC:
GET /api/dnssec?domain=example.com → chain validation from root to domain.
Enumerate subdomains:
GET /api/subdomains?domain=example.com → deduplicated CT log results.
Check email auth:
GET /api/email?domain=example.com → SPF/DMARC/DKIM conclusions.
4. Desktop App (CLI)
The desktop app provides local-vantage tools that the web server cannot replicate. Install from syxx.app for macOS, Windows, or Linux.
syxx prophet <domain>
DNS investigation from your local vantage. Queries multiple resolvers from your machine and compares answers to detect local interception.
Options: --type A|AAAA|MX|TXT|CNAME to specify record type. --resolver <ip> to use a custom resolver.
syxx mirror <domain>
Content comparison from your local vantage. Fetches the page locally and compares against the Syxx server fetch.
Options: --depth full|headers|body to control comparison scope.
syxx warp <url>
Source diff from your local vantage. Compares raw HTML/CSS/JS fetched locally against the server fetch.
Options: --resource html|css|js|all to filter by resource type.
syxx portal
Network path diagnostics. Traces the route to a destination, identifies your local gateway, classifies IP addresses, and detects network anomalies.
Options: --target <host> to specify destination. --hops <n> to limit traceroute depth.
Local-only: requires direct network access.
syxx glutton
DNS leak detection. Sends controlled DNS queries and monitors whether they escape your VPN or tunnel. Reports any queries that bypass the encrypted path.
Options: --duration <seconds> for test length. --vpn <interface> to specify the tunnel interface.
Local-only: requires monitoring local network interfaces.
syxx cage
Packet capture and DNS forensics. Captures live DNS traffic, attributes queries to processes, and generates forensic reports.
Options: --interface <name> to capture on a specific interface. --duration <seconds> for capture length. --output <path> for report file.
Local-only: requires packet capture permissions.
syxx witness
Evidence signing and trust infrastructure. Signs investigation output with cryptographic attestations so results can be verified as authentic and untampered.
Options: --sign <file> to sign a report. --verify <file> to verify a signed report. --key <path> to specify a key file.
Local-only: requires access to the local key store.
syxx conclude
Combined conclusion from all tools. Runs the full pipeline (prophet, mirror, warp, portal, glutton, cage) and synthesizes a tri-state conclusion: secure, tampered, or inconclusive.
Options: --domain <name> for the target. --quick for a reduced pipeline. --json for machine-readable output.
5. Understanding DNS Threats
DNS Spoofing / Cache Poisoning
An attacker injects forged DNS responses into a resolver's cache, causing it to return incorrect IP addresses. Detected by prophet through multi-resolver disagreement and DNSSEC validation failure.
DNS Hijacking / Redirection
A resolver or intermediary silently redirects queries to attacker-controlled addresses. Detected by prophet comparing answers across vantages and propagation showing geo-specific anomalies.
Transparent Proxy Interception
A network intermediary intercepts DNS queries before they reach the intended resolver. Detected by firewall testing filter behavior and prophet identifying resolver mismatch.
DNS Exfiltration / Data Leakage
DNS queries leak outside the encrypted tunnel (VPN), exposing browsing intent. Detected by glutton monitoring query paths and cage capturing raw traffic.
CNAME Cloaking
Trackers hide behind CNAME records that point to first-party subdomains, evading blocklists. Detected by subdomains enumerating CT logs and nslookup inspecting CNAME chains.
DNSSEC Validation Failures
The cryptographic chain of trust is broken, leaving responses unauthenticated. Detected by dnssec walking the chain and dig checking the AD flag.
Content Injection / In-Transit Modification
An intermediary modifies web content (HTML, CSS, JS) between the origin server and your browser. Detected by mirror comparing rendered content and warp comparing source code.
Open Resolver Exposure
A resolver accepts queries from any source, enabling amplification attacks. Detected by firewall probing resolver behavior and prophet testing access patterns.
6. FAQ
Why do web and desktop results differ?
The web server queries from its own network vantage, while the desktop app queries from yours. Differences between the two reveal exactly the kind of interception Syxx is designed to detect. When results diverge, that divergence is itself a signal.
What does "inconclusive" mean?
Inconclusive means Syxx could not gather enough evidence to render a confident conclusion. This happens when queries time out, resolvers return inconsistent data, or required validation steps fail. An inconclusive result is honest: it means "we don't know yet," not "probably fine."
How do I interpret a DNSSEC chain?
The chain has three levels: root (.) → TLD (.com, .org) → your domain. Each level must have valid DS, DNSKEY, and RRSIG records that chain upward. If any step shows "invalid" or "inconclusive," the chain is broken and DNSSEC cannot protect that domain's responses.
What's the difference between Free and Pro?
Free tools (nslookup, dig, whois, email, subdomains, propagation, firewall, dnssec) query from a single server vantage. Pro unlocks multi-vantage comparison (prophet), content diff (mirror, warp), and the full combined conclusion (conclude). The desktop app's local-vantage tools are available to all users.
How do I report a bug?
Email bugs@syxx.app with the command you ran, the domain you tested, the output you received, and what you expected instead. If using the desktop app, include your OS and app version.
Syxx Dimensions — Every resolver tells a story.
Support: feedback@milkandgin.com