{
  "domain": "example.com",
  "records": {
    "ns": [
      "elliott.ns.cloudflare.com",
      "hera.ns.cloudflare.com"
    ],
    "a": [
      "104.20.23.154",
      "172.66.147.243"
    ],
    "aaaa": [
      "2606:4700:10::6814:179a",
      "2606:4700:10::ac42:93f3"
    ],
    "mx": null,
    "cname": null,
    "txt": [
      "_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9",
      "v=spf1 -all"
    ],
    "caa": null,
    "soa": "elliott.ns.cloudflare.com. dns.cloudflare.com. 2410849323 10000 2400 604800 1800",
    "ds": [
      "2371 ecdsap256sha256 2 c988ec423e3880eb8dd8a46fe06ca230ee23f35b578d64e78b29c3e1c83d245a"
    ],
    "dnskey": [
      "256 3 ecdsap256sha256 kxipjoibnzdswqekayagq6fm/xthrrp1ue6av9r/n3ewxpgcecwjb47peeej/q6vayfw/7ufo5mxozfxkyza3a==",
      "256 3 ecdsap256sha256 mjyzielp0gqnii1+j+wag/3t0imddilj1cxr0oobkzqhskh2fqx6tm2ncyu57poj83szcwlkqijzhs1mh5wbaw==",
      "256 3 ecdsap256sha256 ojmresz5e4gyzs/q6xdrvu1qmpyijcwzjaoau8xnezeqcykd5ar0ird8kqxxfjkqmvfrvmgpmm1x8fgaa2xhsa==",
      "257 3 ecdsap256sha256 mdsswuyr3dpw132moi8v9xeswe8jto0dxcjjnopkl+gqjxpvxckhaef+kkxlbxilfdlut0rak9iuzy1l53ekgq=="
    ],
    "has_dnssec": true
  },
  "ns_hosts": [
    {
      "host": "elliott.ns.cloudflare.com",
      "ip": "108.162.195.228",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "108.162.195.0/24",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "dns",
      "anycast": true
    },
    {
      "host": "elliott.ns.cloudflare.com",
      "ip": "162.159.44.228",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "162.159.32.0/20",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "dns",
      "anycast": true
    },
    {
      "host": "elliott.ns.cloudflare.com",
      "ip": "172.64.35.228",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "172.64.35.0/24",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "dns",
      "anycast": true
    },
    {
      "host": "elliott.ns.cloudflare.com",
      "ip": "2606:4700:58::a29f:2ce4",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "2606:4700:50::/44",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "dns",
      "anycast": true
    },
    {
      "host": "elliott.ns.cloudflare.com",
      "ip": "2803:f800:50::6ca2:c3e4",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "2803:f800:50::/45",
      "country": "CR",
      "provider": "Cloudflare",
      "kind": "dns",
      "anycast": true
    },
    {
      "host": "elliott.ns.cloudflare.com",
      "ip": "2a06:98c1:50::ac40:23e4",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "2a06:98c1:50::/45",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "dns",
      "anycast": true
    },
    {
      "host": "hera.ns.cloudflare.com",
      "ip": "108.162.192.162",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "108.162.192.0/24",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "dns",
      "anycast": true
    },
    {
      "host": "hera.ns.cloudflare.com",
      "ip": "172.64.32.162",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "172.64.32.0/24",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "dns",
      "anycast": true
    },
    {
      "host": "hera.ns.cloudflare.com",
      "ip": "173.245.58.162",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "173.245.58.0/24",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "dns",
      "anycast": true
    },
    {
      "host": "hera.ns.cloudflare.com",
      "ip": "2606:4700:50::adf5:3aa2",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "2606:4700:50::/44",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "dns",
      "anycast": true
    },
    {
      "host": "hera.ns.cloudflare.com",
      "ip": "2803:f800:50::6ca2:c0a2",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "2803:f800:50::/45",
      "country": "CR",
      "provider": "Cloudflare",
      "kind": "dns",
      "anycast": true
    },
    {
      "host": "hera.ns.cloudflare.com",
      "ip": "2a06:98c1:50::ac40:20a2",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "2a06:98c1:50::/45",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "dns",
      "anycast": true
    }
  ],
  "web_hosts": [
    {
      "host": "example.com",
      "ip": "104.20.23.154",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "104.20.16.0/20",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "cdn",
      "anycast": true
    },
    {
      "host": "example.com",
      "ip": "172.66.147.243",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "172.66.144.0/20",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "cdn",
      "anycast": true
    },
    {
      "host": "example.com",
      "ip": "2606:4700:10::6814:179a",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "2606:4700:10::/44",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "cdn",
      "anycast": true
    },
    {
      "host": "example.com",
      "ip": "2606:4700:10::ac42:93f3",
      "asn": 13335,
      "as_name": "CLOUDFLARENET - Cloudflare, Inc.",
      "prefix": "2606:4700:10::/44",
      "country": "US",
      "provider": "Cloudflare",
      "kind": "cdn",
      "anycast": true
    }
  ],
  "mx_hosts": null,
  "findings": [
    {
      "layer": "network",
      "severity": "medium",
      "title": "DNS and web on a single anycast operator",
      "detail": "Both nameservers and web origin announce from AS13335 (CLOUDFLARENET - Cloudflare, Inc.). The anycast network cushions localized failures, but the operator remains a single dependency — a global control-plane incident affects everything at once.",
      "evidence": [
        "elliott.ns.cloudflare.com → 108.162.195.228 · AS13335 Cloudflare · US",
        "elliott.ns.cloudflare.com → 162.159.44.228 · AS13335 Cloudflare · US",
        "elliott.ns.cloudflare.com → 172.64.35.228 · AS13335 Cloudflare · US",
        "elliott.ns.cloudflare.com → 2606:4700:58::a29f:2ce4 · AS13335 Cloudflare · US",
        "elliott.ns.cloudflare.com → 2803:f800:50::6ca2:c3e4 · AS13335 Cloudflare · CR",
        "elliott.ns.cloudflare.com → 2a06:98c1:50::ac40:23e4 · AS13335 Cloudflare · US",
        "hera.ns.cloudflare.com → 108.162.192.162 · AS13335 Cloudflare · US",
        "hera.ns.cloudflare.com → 172.64.32.162 · AS13335 Cloudflare · US",
        "hera.ns.cloudflare.com → 173.245.58.162 · AS13335 Cloudflare · US",
        "hera.ns.cloudflare.com → 2606:4700:50::adf5:3aa2 · AS13335 Cloudflare · US",
        "hera.ns.cloudflare.com → 2803:f800:50::6ca2:c0a2 · AS13335 Cloudflare · CR",
        "hera.ns.cloudflare.com → 2a06:98c1:50::ac40:20a2 · AS13335 Cloudflare · US",
        "example.com → 104.20.23.154 · AS13335 Cloudflare · US",
        "example.com → 172.66.147.243 · AS13335 Cloudflare · US",
        "example.com → 2606:4700:10::6814:179a · AS13335 Cloudflare · US",
        "example.com → 2606:4700:10::ac42:93f3 · AS13335 Cloudflare · US"
      ],
      "remediate": "For high-availability domains, host authoritative DNS with a second, independent operator."
    },
    {
      "layer": "dns",
      "severity": "low",
      "title": "Nameservers on a single anycast provider",
      "detail": "All nameservers are Cloudflare, a globally anycast operator — resilient to localized failures, but still a single operator-level dependency (control plane, account, global outage).",
      "evidence": [
        "elliott.ns.cloudflare.com → 108.162.195.228 · AS13335 Cloudflare · US",
        "elliott.ns.cloudflare.com → 162.159.44.228 · AS13335 Cloudflare · US",
        "elliott.ns.cloudflare.com → 172.64.35.228 · AS13335 Cloudflare · US",
        "elliott.ns.cloudflare.com → 2606:4700:58::a29f:2ce4 · AS13335 Cloudflare · US",
        "elliott.ns.cloudflare.com → 2803:f800:50::6ca2:c3e4 · AS13335 Cloudflare · CR",
        "elliott.ns.cloudflare.com → 2a06:98c1:50::ac40:23e4 · AS13335 Cloudflare · US",
        "hera.ns.cloudflare.com → 108.162.192.162 · AS13335 Cloudflare · US",
        "hera.ns.cloudflare.com → 172.64.32.162 · AS13335 Cloudflare · US",
        "hera.ns.cloudflare.com → 173.245.58.162 · AS13335 Cloudflare · US",
        "hera.ns.cloudflare.com → 2606:4700:50::adf5:3aa2 · AS13335 Cloudflare · US",
        "hera.ns.cloudflare.com → 2803:f800:50::6ca2:c0a2 · AS13335 Cloudflare · CR",
        "hera.ns.cloudflare.com → 2a06:98c1:50::ac40:20a2 · AS13335 Cloudflare · US"
      ],
      "remediate": "Acceptable for most; for tier-1 domains add a second anycast provider for operator independence."
    },
    {
      "layer": "web",
      "severity": "info",
      "title": "Web served via CDN (Cloudflare)",
      "detail": "The web tier resolves into a CDN/anycast network, which absorbs traffic across many PoPs and shields the origin.",
      "evidence": [
        "example.com → 104.20.23.154 · AS13335 Cloudflare · US",
        "example.com → 172.66.147.243 · AS13335 Cloudflare · US",
        "example.com → 2606:4700:10::6814:179a · AS13335 Cloudflare · US",
        "example.com → 2606:4700:10::ac42:93f3 · AS13335 Cloudflare · US"
      ],
      "remediate": ""
    },
    {
      "layer": "pki",
      "severity": "info",
      "title": "No CAA records",
      "detail": "Without a CAA record, any public CA may issue certificates for this domain, widening the mis-issuance attack surface.",
      "evidence": null,
      "remediate": "Publish a CAA record naming only your intended CA(s)."
    }
  ],
  "grade": "B",
  "score": 86,
  "has_cdn": true,
  "cdn_name": "Cloudflare"
}