{
  "domain": "berkshirehathaway.com",
  "records": {
    "ns": [
      "ns10.worldnic.com",
      "ns9.worldnic.com"
    ],
    "a": [
      "192.124.249.118"
    ],
    "aaaa": null,
    "mx": [
      {
        "pref": 5,
        "host": "berkshirehathaway-com.mail.protection.outlook.com"
      }
    ],
    "cname": null,
    "txt": [
      "ms=ms23357683",
      "v=spf1 include:spf.protection.outlook.com -all"
    ],
    "caa": null,
    "soa": "ns9.worldnic.com. namehost.worldnic.com. 122021809 10800 3600 604800 3600",
    "ds": null,
    "dnskey": null,
    "has_dnssec": false
  },
  "ns_hosts": [
    {
      "host": "ns10.worldnic.com",
      "ip": "162.159.27.124",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "162.159.27.0/24",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "cdn",
      "anycast": true
    },
    {
      "host": "ns9.worldnic.com",
      "ip": "162.159.26.110",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "162.159.26.0/24",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "cdn",
      "anycast": true
    }
  ],
  "web_hosts": [
    {
      "host": "berkshirehathaway.com",
      "ip": "192.124.249.118",
      "asn": 30148,
      "as_name": "SUCURI-SEC - Sucuri",
      "prefix": "192.124.249.0/24",
      "country": "US",
      "provider": "Sucuri",
      "kind": "cdn",
      "anycast": true
    }
  ],
  "mx_hosts": [
    {
      "host": "berkshirehathaway-com.mail.protection.outlook.com",
      "ip": "52.101.11.13",
      "asn": 8075,
      "as_name": "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation",
      "prefix": "52.96.0.0/12",
      "country": "US",
      "provider": "Microsoft 365",
      "kind": "mail",
      "anycast": true
    },
    {
      "host": "berkshirehathaway-com.mail.protection.outlook.com",
      "ip": "52.101.41.3",
      "asn": 8075,
      "as_name": "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation",
      "prefix": "52.96.0.0/12",
      "country": "US",
      "provider": "Microsoft 365",
      "kind": "mail",
      "anycast": true
    },
    {
      "host": "berkshirehathaway-com.mail.protection.outlook.com",
      "ip": "52.101.50.4",
      "asn": 8075,
      "as_name": "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation",
      "prefix": "52.96.0.0/12",
      "country": "US",
      "provider": "Microsoft 365",
      "kind": "mail",
      "anycast": true
    },
    {
      "host": "berkshirehathaway-com.mail.protection.outlook.com",
      "ip": "52.101.9.11",
      "asn": 8075,
      "as_name": "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation",
      "prefix": "52.96.0.0/12",
      "country": "US",
      "provider": "Microsoft 365",
      "kind": "mail",
      "anycast": true
    },
    {
      "host": "berkshirehathaway-com.mail.protection.outlook.com",
      "ip": "2a01:111:f403:c801::1",
      "asn": 8075,
      "as_name": "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation",
      "prefix": "2a01:111:f000::/36",
      "country": "GB",
      "provider": "Microsoft 365",
      "kind": "mail",
      "anycast": true
    },
    {
      "host": "berkshirehathaway-com.mail.protection.outlook.com",
      "ip": "2a01:111:f403:c901::1",
      "asn": 8075,
      "as_name": "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation",
      "prefix": "2a01:111:f000::/36",
      "country": "GB",
      "provider": "Microsoft 365",
      "kind": "mail",
      "anycast": true
    },
    {
      "host": "berkshirehathaway-com.mail.protection.outlook.com",
      "ip": "2a01:111:f403:c946::1",
      "asn": 8075,
      "as_name": "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation",
      "prefix": "2a01:111:f000::/36",
      "country": "GB",
      "provider": "Microsoft 365",
      "kind": "mail",
      "anycast": true
    },
    {
      "host": "berkshirehathaway-com.mail.protection.outlook.com",
      "ip": "2a01:111:f403:f902::",
      "asn": 8075,
      "as_name": "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation",
      "prefix": "2a01:111:f000::/36",
      "country": "GB",
      "provider": "Microsoft 365",
      "kind": "mail",
      "anycast": true
    }
  ],
  "findings": [
    {
      "layer": "dns",
      "severity": "low",
      "title": "Nameservers on a single anycast provider",
      "detail": "All nameservers are Cloudflare, a globally anycast operator — resilient to localized failures, but still a single operator-level dependency (control plane, account, global outage).",
      "evidence": [
        "ns10.worldnic.com → 162.159.27.124 · AS13335 Cloudflare · US",
        "ns9.worldnic.com → 162.159.26.110 · AS13335 Cloudflare · US"
      ],
      "remediate": "Acceptable for most; for tier-1 domains add a second anycast provider for operator independence."
    },
    {
      "layer": "dns",
      "severity": "low",
      "title": "DNSSEC not enabled",
      "detail": "No DS record at the parent: responses are not cryptographically authenticated and can be forged by an on-path attacker or a poisoned resolver.",
      "evidence": null,
      "remediate": "Enable DNSSEC signing and publish a DS record at the registrar. (Automate key rollover — misconfigured DNSSEC can itself cause outages.)"
    },
    {
      "layer": "web",
      "severity": "info",
      "title": "Web served via CDN (Sucuri)",
      "detail": "The web tier resolves into a CDN/anycast network, which absorbs traffic across many PoPs and shields the origin.",
      "evidence": [
        "berkshirehathaway.com → 192.124.249.118 · AS30148 Sucuri · US"
      ],
      "remediate": ""
    },
    {
      "layer": "pki",
      "severity": "info",
      "title": "No CAA records",
      "detail": "Without a CAA record, any public CA may issue certificates for this domain, widening the mis-issuance attack surface.",
      "evidence": null,
      "remediate": "Publish a CAA record naming only your intended CA(s)."
    }
  ],
  "grade": "A",
  "score": 92,
  "has_cdn": true,
  "cdn_name": "Sucuri"
}