Method

How the report is built

1 · Delegation from the parent

We send a non-recursive NS query to the TLD's name servers (.com, .com.tr …). The NS records in the referral and the glue addresses in the additional section are the delegation itself; they need not match the zone's own NS records, and any divergence shows up in the report.

2 · Direct query to every name server

We ask each server for the SOA over both UDP and TCP. Response time, the AA (authority) flag, the serial number and whether it recurses for outsiders are all measured individually.

3 · Record checks

SOA timers are judged against the RFC 1912 ranges and MX records against the RFC 2181 rules. SPF, DMARC, DKIM, MTA-STS, DS/DNSKEY and CAA records are read separately.

4 · WHOIS

RDAP (HTTPS, structured JSON) is tried first. If the TLD offers no RDAP endpoint, a classic WHOIS query goes over 43/TCP and the raw output is shown in the report as well.

Checklist

Parent zone

NS records read from the parent (IP + TTL)
Whether the TLD can be checked directly
Whether the name servers are listed at the parent
Name server A records
Whether the parent sent glue
Whether the domain is registered (NXDOMAIN)

Name servers

NS records reported by the zone
Parent / zone set agreement, stealth NS
Whether servers report the same NS set
Glue consistency, glue in answers
Response, AA flag, TCP/53, recursion
Network and operator (ASN) spread, serial agreement
Public IP, IPv6, CNAME at apex

SOA & mail

Primary server, administrator email, serial format
refresh / retry / expire / minimum ranges
MX redundancy, CNAME violation, PTR, public IP
SPF terminator and lookup limit, DMARC policy
DKIM selectors, MTA-STS

Web, DNSSEC, WHOIS

Apex/www records, TTL, IPv6
Hosting: ASN, prefix, country, reverse DNS
DS ↔ DNSKEY chain, CAA
Registrar, IANA ID, abuse contact
Creation/expiry dates, domain age, status codes

API

GET /api/dns?domain=example.com
GET /api/dns/<parent|ns|soa|mx|web|mail|dnssec>?domain=example.com
GET /api/whois?domain=example.com