Cybersecurity response desk with a laptop, checklist, and incident response kit.

Information security strategy

TruthDNS: Deterministic Calculations for Local AI—and the Security Boundaries

Explore TruthDNS for local AI: live DNS calculator examples, MCP connection options, signed responses, privacy boundaries and practical security checks.

Back to articles

A local language model can write a convincing explanation without carrying out the calculation behind it. For teams using AI to prepare reports, work through examples or assist with everyday analysis, a useful control is to make that calculation a separate, inspectable tool call.

TruthDNS provides deterministic calculator tools for local AI, with arithmetic, percentages, rounding, statistics and date operations delivered through DNS queries. Its practical promise is specific: for a supported operation, the same inputs and rules produce the same result. The model still has to ask the right question and use the answer correctly.

Disclosure: A-Infosec’s publisher also manages TruthDNS. This is a project introduction with practical checks, rather than an independent product review.

Separate the language task from the calculation

Consider a simple request: “What is 15% of 200?” The model can identify the percentage operation, send the inputs to a calculator and use the returned result in its explanation. This makes the calculation visible instead of leaving the reader to infer whether it happened.

A reusable tool can also avoid generating a fresh script for each supported operation. That does not make it a replacement for Python: custom analysis, large datasets and private or offline work may be better handled locally. The choice depends on the task and its data.

How the DNS calculation works

DNS commonly resolves website names, but TXT records can also carry text responses. TruthDNS encodes an operation and its inputs in the query name and returns a readable answer. For the percentage example:

dig +short percent.15.200.math.truthdns.info TXT
"15% of 200 = 30"

This demonstration needs a network connection and a terminal with dig. It does not require an account, an API key or changes to your domain’s DNS settings. Windows users can try nslookup -type=TXT percent.15.200.math.truthdns.info and inspect the TXT answer.

For an AI workflow, the path is: user request → model chooses an operation → configured tool queries TruthDNS → tool returns a result → model explains it. Installing a tool does not establish that the model will actually call it; that behaviour needs testing in the chosen application.

Three live examples, including a failure

The following DNS responses were checked on 24 October 2026. These are functional checks of readable TXT answers, not a load test or verification of signed responses.

1. A percentage

dig +short percent.15.200.math.truthdns.info TXT
"15% of 200 = 30"

The response repeats both the calculation and its result, making it easier to spot a wrong operation or input.

2. Decimal addition

dig +short sum.0p1.0p2.math.truthdns.info TXT
"0.1 + 0.2 = 0.3"

In the query, 0p1 represents 0.1. This encoding keeps the decimal value within a DNS label. The returned text uses ordinary decimal notation.

3. Division by zero

dig +short divide.10.0.math.truthdns.info TXT
"10 / 0: error: cannot divide by zero"

An explicit error is a useful part of the interface. The AI application should preserve that failure and ask for corrected inputs, rather than substitute an invented answer. More operations and rounding examples are available in the TruthDNS worked examples.

Deterministic answers have a defined scope

A calculator can execute the requested operation correctly while the overall answer remains wrong. The model might select percentage change instead of percentage of a value, omit an invoice line or copy a result incorrectly. Determinism addresses the calculation step; it does not remove every source of AI error.

Rules matter too. A rounded result needs an understood rounding policy. A workday calculation needs the correct dates and supplied holidays. TruthDNS’s documentation says its workday operations use the holidays provided by the caller, rather than automatically loading a national holiday calendar. Input and size limits also apply.

Response signatures and data privacy solve different problems

TruthDNS documents a signed response format for clients that verify authenticity and integrity. Production automation should use the published verifier and trusted key material to check the response against the request, and reject a failed verification. The plain dig demonstrations above do not perform those application-level signature checks.

A valid signature does not establish that the model selected the right inputs. It also does not encrypt the query or keep the values private. These are separate properties that need separate controls.

A local model can still send data outside the device. With this hosted calculation route, the operation and values travel over the network and may be visible to DNS resolvers and the service. Use non-sensitive values. Keep confidential calculations in a local tool when that is the required privacy boundary.

For security teams, this belongs in the same data-flow review as other AI tools: identify what leaves the endpoint, which systems can log it and how failures are handled. A-Infosec’s guide to data loss prevention provides wider context for controlling data movement.

Connecting a local AI application

TruthDNS currently documents terminal access, MCP servers and an agent calculator skill. MCP supplies the connection between an AI application and a tool; it does not by itself guarantee model compatibility or correct tool use.

According to the current project documentation, the MCP tool has been tested end to end over MCP, while testing with real models inside LM Studio or Ollama remains pending. The maths-only server and the fuller calculator server have different scopes; the calculator skill also requires its verifier. Follow the current TruthDNS connection instructions for package prerequisites and the appropriate route.

Before relying on a connection, check three behaviours: the application exposes the tool to the model; the model calls it and preserves the returned result; and invalid inputs, network failures and failed verification remain visible to the user.

Evaluate the complete workflow

A short calculator request may be convenient, but speed and token use depend on the model, application, resolver, cache and network. The three lookups here do not establish a performance advantage. Measure the complete workflow if those benefits matter to your deployment.

FX rates and holiday data are listed as planned features on the current TruthDNS website. They should not be treated as available services. For a first evaluation, start with a supported calculation using public values, inspect the request and response, and exercise a failure case.

Read TruthDNS’s reliability and data-handling notes before connecting it to an automated workflow. The useful security control is a clear chain from the requested operation to a checked result, with visible limits at each step.