Ask an LLM "why does mail to my domain bounce?" and you get a plausible list of everything that has ever caused a bounce. Ask an engineer, and they do something different: they run dig, look at the answer, and let the evidence pick the next question. The difference is not knowledge; it is that the engineer is allowed to touch the network.
So we gave the model the network. DNS Detective is a small agent, running on DigitalOcean Serverless Inference, that diagnoses DNS, TLS and email-record problems by calling real probe tools in a loop: resolve records, shake hands with TLS endpoints, pull registration data, fetch URLs. It probes, reads, probes again, and delivers a diagnosis where every claim cites a lookup it actually ran. The whole thing is about 300 lines of Python, and this post walks the build plus three real diagnoses recorded as they happened.
The-DevOps-Daily/dns-detective on GitHub
One tool-calling loop plus four probes (dns_lookup, tls_check, rdap_lookup, http_check) turns a chat model into a diagnostician that follows evidence instead of listing possibilities.
On camera it solved three real mysteries: example.com's bouncing mail (a null MX , 0 .), a monitoring alert on expired.badssl.com ( certificate expired 2015 , read from the offered cert after verification failed), and dnssec-failed.org's split behavior ( bogus DS record , and the model noticed the DS digest is literally the ASCII for "broken chain of trust send help!").
