DNS Toolkit
A zero-runtime-dependency DNS toolkit for PHP. Speaks the wire protocol over raw sockets to read answers straight from a zone authoritative nameservers, plus domain verification, DNSSEC validation and intoDNS-style diagnostics.
DNS Toolkit speaks the DNS wire protocol over raw sockets, so it can read a zone answer straight from the zone own authoritative nameservers rather than from whatever a recursive resolver happens to have cached. That distinction is the point: it is what makes domain-ownership verification and propagation checks trustworthy. On top of the resolver it ships domain verification, an authoritative-versus-recursive propagation check, a full DNSSEC chain validator, and an intoDNS-style diagnostics engine, all framework-agnostic and driven through one contract you can fake in tests.
What It Does
Authoritative Resolver
Discovers a zone nameservers and queries them directly with recursion disabled, so a record you read is really published right now, at the source of truth, not a cached copy.
Domain Verification
Reads the ownership TXT token against the authoritative servers, so a just-published record is visible immediately instead of waiting out a recursive resolver negative cache.
DNSSEC Validation
Walks the chain itself, root to TLD to zone, checking every signature rather than trusting a resolver AD bit. Signature math is delegated to OpenSSL and libsodium, never hand-rolled.
Diagnostics Engine
intoDNS and MxToolbox-style health checks, delegation traces and propagation comparisons, grouped into findings you can act on.
Zero Runtime Dependencies
Runs on ext-sockets and the standard library. Nothing to audit downstream, nothing to keep patched, no dig binary shelled out to.
Contract-Driven
Every capability sits behind one resolver contract you can bind, fake or replace, so tests run without touching the network.
Right tool for verification, wrong tool for a hot path
Every lookup is a fresh network round-trip with no cache. That is deliberate: what it returns is the ground truth right now. It also means a lookup is materially slower than your OS resolver. Reach for it when freshness or transparency matters more than throughput. Do not drop it in as a general-purpose resolver on a hot path, a cached system resolver is faster there.
Honest about DNSSEC
There is no vetted, maintained PHP library to wrap for DNSSEC chain validation, so this package does the protocol work itself: canonical form, key and signature encoding, validity windows, NSEC and NSEC3 denial proofs. Only the signature math is delegated, to OpenSSL for RSA and ECDSA and libsodium for Ed25519. The module is built against real captured signed-zone vectors and was adversarially reviewed, where a cross-zone forgery bypass was found and fixed before release.
