Everything you need to investigate DNS, detect tampering, and trust your resolver's story.
Syxx Dimensions is a DNS investigation suite that traces lookups end to end. It detects spoofed answers, poisoned caches, silent exfiltration, transparent proxies, content injection, and DNSSEC failures. It ships as both a web application served from syxx.app and a native desktop app for macOS, Windows, and Linux.
| Capability | Web (syxx.app) | Desktop App |
|---|---|---|
| DNS resolution & comparison | ✅ Server vantage | ✅ Local vantage |
| Content diff (mirror/warp) | ✅ Pro | ✅ |
| Network path diagnostics | — | ✅ Local-only |
| DNS leak detection | — | ✅ Local-only |
| Packet capture & forensics | — | ✅ Local-only |
| Evidence signing (witness) | — | ✅ Local-only |
| Combined verdict (conclude) | Partial | ✅ Full pipeline |
🔮 Prophet — DNS resolution integrity. Is a single query/response exchange trustworthy?
🪞 Mirror — Content comparison. Is something actively interfering with what you asked for?
🚪 Portal — Network path diagnostics. What does the path to the destination actually look like?
🍽️ Glutton — Privacy leak detection. Is your VPN keeping DNS queries private?
🔒 Cage — Capture & forensics. What DNS traffic is flowing, and who is responsible?
📜 Witness — Trust infrastructure. Can the evidence and the app itself be trusted?
Each command runs in the web terminal at syxx.app. Enter a domain or URL, select the command, and read the output below the terminal.
What it does: Queries your domain from the Syxx server vantage using multiple resolvers, then compares answers against your local resolver to detect interception or inconsistency.
DNS spoofing, cache poisoning, transparent proxy interception, resolver disagreement, DNSSEC validation failures.
example.com).| Field | Meaning |
|---|---|
| Unique Answers | Distinct IP/CNAME values returned across all resolvers |
| Consensus | Percentage of resolvers that agree on the majority answer |
| DNSSEC | Whether the chain validated (secure / insecure / bogus) |
| Resolver detail | Per-resolver answer, latency, and rcode |
What it does: Queries a resolver for any record type on your domain and returns the raw answer. Useful for quick checks of A, AAAA, MX, TXT, CNAME, and more.
Unexpected record values, missing records, NXDOMAIN responses, SERVFAIL conditions.
| Field | Meaning |
|---|---|
| Server | Resolver that answered the query |
| Rcode | Response code (NOERROR, NXDOMAIN, SERVFAIL) |
| Records | Each answer with TTL, type, and value |
What it does: Same core query as nslookup but with additional detail: the AD (Authenticated Data) flag, human-readable rcode names, and full header information.
DNSSEC-aware resolver behavior, authentication flag inconsistencies, truncated responses.
| Field | Meaning |
|---|---|
| AD Flag | Whether the resolver validated DNSSEC (true/false) |
| Rcode Name | Human-readable response status |
| Answer Count | Number of resource records returned |
What it does: Fetches RDAP/WHOIS registration data for a domain, showing who owns it, when it was registered, and its current status.
Recently registered domains (phishing indicators), expired registrations, registrar changes, nameserver hijacking.
| Field | Meaning |
|---|---|
| Registrar | The registrar managing the domain |
| Created / Expires | Registration and expiration dates |
| Status | Domain status flags (e.g. clientTransferProhibited) |
| Nameservers | Authoritative nameservers on record |
What it does: Checks SPF, DMARC, and DKIM records for a domain and renders a pass/fail/inconclusive verdict for each protocol.
Missing or weak SPF policies, absent DMARC records, DKIM misconfiguration, email spoofing exposure.
| Field | Meaning |
|---|---|
| SPF | Whether a valid SPF record exists and its policy strength |
| DMARC | Whether a DMARC record exists with a reject/quarantine policy |
| DKIM | Whether DKIM selector records are published |
What it does: Searches Certificate Transparency logs to discover subdomains that have been issued TLS certificates. Reveals the full attack surface of a domain.
Unknown subdomains, wildcard certificates, shadow IT services, certificate issuance anomalies.
Returns a deduplicated list of subdomain names sorted alphabetically. Each entry is a unique subdomain found in CT logs.
What it does: Queries 17 public resolvers distributed worldwide and shows what each one returns for your domain. Calculates a consensus and propagation percentage.
DNS propagation delays, geo-specific hijacking, split-horizon DNS, regional censorship.
| Field | Meaning |
|---|---|
| Per-resolver | Each resolver's name, location, and returned answer |
| Consensus | The majority answer across all resolvers |
| Propagation % | Percentage of resolvers returning the consensus answer |
What it does: Tests whether a resolver blocks known domains by querying a set of control domains that should resolve. Identifies DNS-level filtering or firewall interference.
DNS filtering, ISP-level blocking, corporate firewall interference, government censorship.
| Field | Meaning |
|---|---|
| Per-domain | Each control domain: blocked or open |
| Assessment | Overall verdict: clean, partial filtering, or heavy filtering |
What it does: Walks the DNSSEC chain from root → TLD → your domain, verifying DS, DNSKEY, and RRSIG records at each level.
Broken DNSSEC chains, missing DS records, expired RRSIG signatures, DNSSEC downgrade attacks.
| Field | Meaning |
|---|---|
| Step | Each level: root, TLD, domain |
| Status | valid, invalid, or inconclusive for each step |
| Detail | Record types found and validation notes |
What it does: Fetches a web page from the Syxx server vantage and compares the rendered content against what your local machine receives. Detects in-transit content modification.
Content injection, ISP ad insertion, transparent proxy modification, man-in-the-middle content tampering.
https://example.com).What it does: Compares the raw HTML, CSS, and JavaScript source of a page fetched from the Syxx server against your local fetch. Shows byte-level differences in the source code.
Script injection, stylesheet modification, HTML rewriting, tracker insertion, malicious code injection.
What it does: Aggregates results from all available tools into a single combined verdict. Requires the desktop app for the full pipeline; the web version provides a partial verdict based on server-side data.
Comprehensive threat assessment combining DNS integrity, content authenticity, and trust signals.
Note: For the full conclude pipeline (including local network path, leak detection, and forensics), use the desktop app.
Full API reference: /docs/api
/api/auth to receive a session token.Authorization: Bearer <token> in subsequent requests.{status, data, meta}.Investigate a domain:
GET /api/prophet?domain=example.com → resolution consensus, DNSSEC status, per-resolver detail.
Check DNSSEC:
GET /api/dnssec?domain=example.com → chain validation from root to domain.
Enumerate subdomains:
GET /api/subdomains?domain=example.com → deduplicated CT log results.
Check email auth:
GET /api/email?domain=example.com → SPF/DMARC/DKIM verdicts.
The desktop app provides local-vantage tools that the web server cannot replicate. Install from syxx.app for macOS, Windows, or Linux.
syxx prophet <domain>DNS investigation from your local vantage. Queries multiple resolvers from your machine and compares answers to detect local interception.
Options: --type A|AAAA|MX|TXT|CNAME to specify record type. --resolver <ip> to use a custom resolver.
syxx mirror <domain>Content comparison from your local vantage. Fetches the page locally and compares against the Syxx server fetch.
Options: --depth full|headers|body to control comparison scope.
syxx warp <url>Source diff from your local vantage. Compares raw HTML/CSS/JS fetched locally against the server fetch.
Options: --resource html|css|js|all to filter by resource type.
syxx portalNetwork path diagnostics. Traces the route to a destination, identifies your local gateway, classifies IP addresses, and detects network anomalies.
Options: --target <host> to specify destination. --hops <n> to limit traceroute depth.
Local-only: requires direct network access.
syxx gluttonDNS leak detection. Sends controlled DNS queries and monitors whether they escape your VPN or tunnel. Reports any queries that bypass the encrypted path.
Options: --duration <seconds> for test length. --vpn <interface> to specify the tunnel interface.
Local-only: requires monitoring local network interfaces.
syxx cagePacket capture and DNS forensics. Captures live DNS traffic, attributes queries to processes, and generates forensic reports.
Options: --interface <name> to capture on a specific interface. --duration <seconds> for capture length. --output <path> for report file.
Local-only: requires packet capture permissions.
syxx witnessEvidence signing and trust infrastructure. Signs investigation output with cryptographic attestations so results can be verified as authentic and untampered.
Options: --sign <file> to sign a report. --verify <file> to verify a signed report. --key <path> to specify a key file.
Local-only: requires access to the local key store.
syxx concludeCombined verdict from all tools. Runs the full pipeline (prophet, mirror, warp, portal, glutton, cage) and synthesizes a tri-state verdict: secure, tampered, or inconclusive.
Options: --domain <name> for the target. --quick for a reduced pipeline. --json for machine-readable output.
An attacker injects forged DNS responses into a resolver's cache, causing it to return incorrect IP addresses. Detected by prophet through multi-resolver disagreement and DNSSEC validation failure.
A resolver or intermediary silently redirects queries to attacker-controlled addresses. Detected by prophet comparing answers across vantages and propagation showing geo-specific anomalies.
A network intermediary intercepts DNS queries before they reach the intended resolver. Detected by firewall testing filter behavior and prophet identifying resolver mismatch.
DNS queries leak outside the encrypted tunnel (VPN), exposing browsing intent. Detected by glutton monitoring query paths and cage capturing raw traffic.
Trackers hide behind CNAME records that point to first-party subdomains, evading blocklists. Detected by subdomains enumerating CT logs and nslookup inspecting CNAME chains.
The cryptographic chain of trust is broken, leaving responses unauthenticated. Detected by dnssec walking the chain and dig checking the AD flag.
An intermediary modifies web content (HTML, CSS, JS) between the origin server and your browser. Detected by mirror comparing rendered content and warp comparing source code.
A resolver accepts queries from any source, enabling amplification attacks. Detected by firewall probing resolver behavior and prophet testing access patterns.
The web server queries from its own network vantage, while the desktop app queries from yours. Differences between the two reveal exactly the kind of interception Syxx is designed to detect. When results diverge, that divergence is itself a signal.
Inconclusive means Syxx could not gather enough evidence to render a confident verdict. This happens when queries time out, resolvers return inconsistent data, or required validation steps fail. An inconclusive result is honest: it means "we don't know yet," not "probably fine."
The chain has three levels: root (.) → TLD (.com, .org) → your domain. Each level must have valid DS, DNSKEY, and RRSIG records that chain upward. If any step shows "invalid" or "inconclusive," the chain is broken and DNSSEC cannot protect that domain's responses.
Free tools (nslookup, dig, whois, email, subdomains, propagation, firewall, dnssec) query from a single server vantage. Pro unlocks multi-vantage comparison (prophet), content diff (mirror, warp), and the full combined verdict (conclude). The desktop app's local-vantage tools are available to all users.
Email bugs@syxx.app with the command you ran, the domain you tested, the output you received, and what you expected instead. If using the desktop app, include your OS and app version.
Syxx Dimensions — Every resolver tells a story.
Support: feedback@milkandgin.com