Skip to main content
Organizational domain for agentquery could not be determined — the Public Suffix List compiled into this build does not recognize the suffix. Email-security scope below is not determinable; this is not a finding that the domain is or is not a subdomain. Re-run when the PSL snapshot is updated.
Registry Zone Health Intelligence — agentquery is a shared registry suffix.
This report focuses on zone infrastructure health: DNSSEC signing, nameserver diversity, certificate authority policy, and delegation security. Email authentication protocols (SPF, DMARC, DKIM) are not applicable to registry suffixes — they apply to domains registered under this zone.
Registry operators, ICANN, and ccTLD authorities can use this view to assess zone security posture.
DNS Tool
Registry Zone Health Report
Generated 26 Jul 2026, 00:48 UTC
Version v26.50.05-344-gc4825d920
Integrity fdca88769338efacb3d51a640dbd5f8e53f1875805907065c2ae3683a3057b2b6468e5ee2f657680afd956b86b25c0ee33a34e35b0cd4cd4395c3dab6d51f7ac
Subject Domain
agentquery

Registry Zone Health Report

agentquery
26 Jul 2026, 00:48 UTC ·v26.50.05-344-gc4825d920 · SHA-3-512: fdca✱✱✱✱ Verify ·Cross-Referenced
Executive Topology Replay
Recon Mode Snapshot Re-analyze New Domain
Engineer workspace · evidence preserved

Read the verdict first. Descend only as far as the incident requires.

This report keeps the complete technical record while separating decision, interpretation, evidence, and raw reproduction into a stable disclosure gradient.

L0PostureL1InterpretationL2EvidenceL3Raw & reproduce
Hurry path
MX & Routing Subdomains DNSSEC What changed
KEYBOARD !1@2#3$4%5^6 jump to that section · esc back to the verdict

Non-existent / Undelegated Domain

Domain is not delegated or has no DNS records. This may be an unused subdomain or unregistered domain.

What This Means

  • No authoritative DNS data is available for this domain
  • Security posture cannot be evaluated without DNS records
  • The domain may never have been registered, or has expired
  • If this is your domain, check your registrar to confirm it's active
Try Another Domain
Intelligence Sources

This analysis used 4 DNS resolvers (consensus), reverse DNS (PTR), Team Cymru (ASN attribution), IANA RDAP (registrar), crt.sh (CT logs), and SMTP probing (transport). All using open-standard protocols.

Full List
Verify Report Integrity SHA-3-512 Has this report been altered since generation? Verify below

This cryptographic hash seals the analysis data, domain, timestamp, and tool version into a tamper-evident fingerprint. Any modification to the report data will produce a different hash. This is distinct from the posture hash (used for drift detection) — the integrity hash uniquely identifies this specific report instance.

fdca88769338efacb3d51a640dbd5f8e53f1875805907065c2ae3683a3057b2b6468e5ee2f657680afd956b86b25c0ee33a34e35b0cd4cd4395c3dab6d51f7ac
Evaluations reference 12 RFCs. Methods are reproducible using the verification commands provided. Results reflect DNS state at 26 Jul 2026, 00:48 UTC.
Download Raw Intelligence Download Checksum (.sha3) Cross-Reference Verification

Download the intelligence dump and verify its integrity, like you would a Kali ISO or any critical artifact. The SHA-3-512 checksum covers every byte of the download — deterministic serialization ensures identical hashes across downloads.

After downloading, verify with any of these commands:

Tip: cd ~/Downloads first (or wherever you saved the files).

OpenSSL + Sidecar (macOS, Linux, WSL) 
cat dns-intelligence-agentquery.json.sha3 && echo '---' && openssl dgst -sha3-512 dns-intelligence-agentquery.json
Python 3 (cross-platform) 
python3 -c "import hashlib; print(hashlib.sha3_512(open('dns-intelligence-agentquery.json','rb').read()).hexdigest())"
sha3sum (coreutils 9+) 
sha3sum -a 512 dns-intelligence-agentquery.json
Compare the output against the .sha3 file or the checksum API at /api/analysis/18092/checksum. Hash algorithm: SHA-3-512 (Keccak, NIST FIPS 202).

Every finding in this report is backed by DNS queries you can run yourself. These vetted one-liners reproduce the exact checks used to build this report for agentquery. Our analysis adds multi-resolver consensus, RFC-based evaluation, and cross-referencing — but the underlying data is always independently verifiable. We are intelligence analysts, not gatekeepers.

DNS Records

Query A records (IPv4) RFC 1035 
dig +noall +answer agentquery A
Query AAAA records (IPv6) RFC 1035 
dig +noall +answer agentquery AAAA
Query MX records (mail servers) RFC 1035 
dig +noall +answer agentquery MX
Query NS records (nameservers) RFC 1035 
dig +noall +answer agentquery NS
Query TXT records RFC 1035 
dig +noall +answer agentquery TXT

Domain Security

Check DNSSEC DNSKEY records RFC 4035 
dig +dnssec +noall +answer agentquery DNSKEY
Check DNSSEC DS records RFC 4035 
dig +noall +answer agentquery DS
Validate DNSSEC chain (requires DNSSEC-validating resolver) RFC 4035 
dig +dnssec +cd agentquery A @1.1.1.1

Brand & Trust

Check CAA records (certificate authority authorization) RFC 8659 
dig +noall +answer agentquery CAA

DNS Records

Check HTTPS/SVCB records RFC 9460 
dig +noall +answer agentquery HTTPS

Domain Security

Check CDS/CDNSKEY automation records RFC 7344 
dig +noall +answer agentquery CDS

Infrastructure Intelligence

RDAP domain registration lookup RFC 9083 
curl -sL 'https://rdap.org/domain/agentquery' | python3 -m json.tool | head -50
Commands use dig, openssl, and curl — standard tools available on macOS, Linux, and WSL. Results may vary slightly due to DNS propagation timing and resolver caching.
Intelligence Confidence Audit Engine Gold · 9/9 Evaluated
How confident are these results? Each protocol is independently verified against RFC standards. No self-awarded badges.
SPF
Gold 15673 runs
DKIM
Gold 15463 runs
DMARC
Gold 15654 runs
DANE/TLSA
Gold 15445 runs
DNSSEC
Gold 15632 runs
BIMI
Gold 15460 runs
MTA-STS
Gold 15481 runs
TLS-RPT
Gold 15496 runs
CAA
Gold 15493 runs
Maturity: Development → Verified → Consistent → Gold → Gold Master

Appendix: Verification Commands

The core DNS queries behind this report can be independently verified using these standard terminal commands (dig, openssl, curl). DNS Tool adds multi-resolver consensus, RFC-based evaluation, and cross-referencing on top of the raw data shown here.

DNS Records

Query A records (IPv4) (RFC 1035) 
dig +noall +answer agentquery A
Query AAAA records (IPv6) (RFC 1035) 
dig +noall +answer agentquery AAAA
Query MX records (mail servers) (RFC 1035) 
dig +noall +answer agentquery MX
Query NS records (nameservers) (RFC 1035) 
dig +noall +answer agentquery NS
Query TXT records (RFC 1035) 
dig +noall +answer agentquery TXT

Domain Security

Check DNSSEC DNSKEY records (RFC 4035) 
dig +dnssec +noall +answer agentquery DNSKEY
Check DNSSEC DS records (RFC 4035) 
dig +noall +answer agentquery DS
Validate DNSSEC chain (requires DNSSEC-validating resolver) (RFC 4035) 
dig +dnssec +cd agentquery A @1.1.1.1

Brand & Trust

Check CAA records (certificate authority authorization) (RFC 8659) 
dig +noall +answer agentquery CAA

DNS Records

Check HTTPS/SVCB records (RFC 9460) 
dig +noall +answer agentquery HTTPS

Domain Security

Check CDS/CDNSKEY automation records (RFC 7344) 
dig +noall +answer agentquery CDS

Infrastructure Intelligence

RDAP domain registration lookup (RFC 9083) 
curl -sL 'https://rdap.org/domain/agentquery' | python3 -m json.tool | head -50

0s

Running Real-Time Scan Telemetry

Most scans complete in less than one minute. Some may take longer.

Markers represent known resolver locations. Anycast routing selects the nearest node — exact routing is internal to each provider.

Pipeline nodes reflect live data as each analysis phase completes.

Telemetry Log 0 polls