shohei

日本語 | 中文

shohei is a next-generation DNS diagnostic CLI. Where dig shows raw records, shohei visualizes the complete picture: the DNSSEC chain of trust from root to answer, the iterative resolution path hop-by-hop, and modern transports (DoH / DoT) — all rendered as color-coded trees in your terminal.

• DNSSEC chain tree — see every DS, DNSKEY, and trust step from . to your domain
• Iterative resolution trace — watch queries travel from root servers to TLD to authoritative NS
• Server comparison — diff two resolvers side-by-side with --compare
• DoH and DoT — DNS-over-HTTPS and DNS-over-TLS built in
• JSON output — pipe-friendly for scripting and automation
• Watch mode — auto-refresh at a set interval with --watch
• Short output — data values only, one per line, with --short
• Interactive TUI — browse records, DNSSEC chain, and trace in a single terminal window (--features tui)

Why shohei?

Installation

cargo install shohei

For the interactive TUI mode:

cargo install shohei --features tui

Or download a pre-built binary from the releases page.

Usage

DNS record query

shohei google.com              # A records (default)
shohei google.com --type AAAA  # AAAA records
shohei google.com --type NS    # Nameservers
shohei gmail.com  --type MX    # Mail exchangers

DNSSEC chain of trust

Validate the full DNSSEC chain from the root trust anchor down to the target domain. Each zone's DS and DNSKEY records are checked individually.

shohei cloudflare.com --dnssec

Iterative resolution trace

Step through the full resolution path — root servers → TLD nameservers → authoritative nameservers.

shohei google.com --trace

Modern transports

# DNS-over-HTTPS
shohei google.com --doh https://dns.google/dns-query

# DNS-over-TLS
shohei google.com --dot 1.1.1.1:853

# Custom resolver
shohei google.com --server 8.8.8.8

Short output

Strip all decoration and return just the record data — one value per line. Ideal for shell scripting.

shohei gmail.com --type MX --short

Compare two resolvers

Query the same domain from two DNS servers simultaneously and diff the results. Useful for detecting CDN anycast differences or verifying a new resolver.

# Show that both servers return the same NS records
shohei cloudflare.com --type NS --server 8.8.8.8 --compare 1.1.1.1

# Reveal CDN-induced A record differences
shohei google.com --server 8.8.8.8 --compare 1.1.1.1

Watch mode

Repeat the query every N seconds and auto-refresh the display. Press Ctrl+C to stop.

shohei google.com --watch 5         # refresh every 5 seconds
shohei google.com --type A --watch 10

Output formats

shohei google.com --output json   # JSON for scripting
shohei google.com --output plain  # No colors (CI-friendly)

Interactive TUI (requires --features tui)

Pre-loads records, DNSSEC chain, and trace in parallel, then presents all three as navigable views.

shohei google.com --tui

 shohei — google.com
┌─ Records ──────────────────────────────────────────────────────────┐
│ Query: google.com (A IN)                                           │
│                                                                    │
│ NAME                                    TTL   TYPE   DATA          │
│ ────────────────────────────────────────────────────────────────── │
│ google.com.                             120   A      142.250.x.x   │
│ ...                                                                │
└────────────────────────────────────────────────────────────────────┘
 [r] Records  [d] DNSSEC  [t] Trace  [↑↓/jk] Scroll  [q] Quit

Options

Trust States

Built with

• hickory-dns — DNSSEC, DoH, DoT support
• clap — CLI argument parsing
• ratatui — TUI framework (optional tui feature)
• owo-colors — Terminal colors
• comfy-table — Record table rendering

License

MIT — see LICENSE