> For the complete documentation index see https://domscan.net/llms.txt. Markdown versions of every docs page are available by appending .md to the page URL.

Source: https://domscan.net/zh/docs/dns-security

# DNS 安全分析

通过 DomScan API，电子邮件和 DNS 安全分析，包括 SPF、DKIM、DMARC、DNSSEC 和 CAA 记录。分析所有电子邮件身份验证机制，并返回带有可操作建议的安全评分。

电子邮件和 DNS 安全分析，包括 SPF、DKIM、DMARC、DNSSEC 和 CAA 记录。分析所有电子邮件身份验证机制，并返回带有可操作建议的安全评分。

GET /v1/dns/security 积分: 3

#### 查询参数

| 参数 | 类型 | 必需 |
| --- | --- | --- |
| domain | string | 必需 |

#### 响应字段

| 字段 | 类型 |
| --- | --- |
| `domain` | string |
| `security_score` | integer \| null |
| `security_grade` | string \| null |
| `checks_unknown` | integer |
| `score_confidence` | string |
| `spf` | object |
| `spf.classification` | object |
| `spf.classification.status` | string |
| `spf.classification.reason` | string |
| `spf.classification.evidence` | object |
| `spf.classification.evidence.source` | string |
| `spf.classification.evidence.method` | string |
| `spf.classification.evidence.observed_at` | string |
| `spf.classification.evidence.detail` | string |
| `spf.classification.checked_at` | string |
| `spf.exists` | boolean \| null |
| `spf.record` | string |
| `spf.valid` | boolean |
| `spf.policy` | string |
| `spf.includes[]` | string[] |
| `spf.dns_lookup_count` | integer |
| `spf.dns_lookup_limit_exceeded` | boolean |
| `spf.include_tree[]` | object[] |
| `spf.include_tree[]` | object |
| `spf.include_tree[].domain` | string |
| `spf.include_tree[].lookups` | integer |
| `spf.lookup_walk_count` | integer |
| `spf.macros_present` | boolean |
| `spf.macro_references[]` | string[] |
| `spf.walk[]` | object[] |
| `spf.walk[]` | object |
| `spf.walk[].domain` | string |
| `spf.walk[].depth` | integer |
| `spf.walk[].record` | string |
| `spf.walk[].mechanisms[]` | string[] |
| `spf.walk[].includes[]` | string[] |
| `spf.walk[].redirect` | string \| null |
| `spf.walk[].direct_lookup_count` | integer |
| `spf.walk[].total_lookup_count` | integer |
| `spf.walk[].macros_present` | boolean |
| `spf.walk[].macro_references[]` | string[] |
| `spf.walk[].multiple_records` | integer |
| `spf.walk_errors[]` | string[] |
| `spf.lookup_tree` | object |
| `spf.lookup_tree.root_domain` | string |
| `spf.lookup_tree.node_count` | integer |
| `spf.lookup_tree.max_depth` | integer |
| `spf.lookup_tree.cycles_detected[]` | string[] |
| `spf.lookup_tree.nodes[]` | object[] |
| `spf.lookup_tree.nodes[]` | object |
| `spf.lookup_tree.nodes[].domain` | string |
| `spf.lookup_tree.nodes[].depth` | integer |
| `spf.lookup_tree.nodes[].status` | string |
| `spf.lookup_tree.nodes[].direct_lookup_count` | integer |
| `spf.lookup_tree.nodes[].total_lookup_count` | integer |
| `spf.lookup_tree.nodes[].includes[]` | string[] |
| `spf.lookup_tree.nodes[].redirect` | string \| null |
| `spf.lookup_tree.nodes[].mechanisms[]` | string[] |
| `spf.lookup_tree.nodes[].errors[]` | string[] |
| `spf.lookup_tree.edges[]` | object[] |
| `spf.lookup_tree.edges[]` | object |
| `spf.lookup_tree.edges[].from` | string |
| `spf.lookup_tree.edges[].to` | string |
| `spf.lookup_tree.edges[].type` | string |
| `spf.issues[]` | string[] |
| `dkim` | object |
| `dkim.classification` | object |
| `dkim.classification.status` | string |
| `dkim.classification.reason` | string |
| `dkim.classification.evidence` | object |
| `dkim.classification.evidence.source` | string |
| `dkim.classification.evidence.method` | string |
| `dkim.classification.evidence.observed_at` | string |
| `dkim.classification.evidence.detail` | string |
| `dkim.classification.checked_at` | string |
| `dkim.exists` | boolean \| null |
| `dkim.selectors_checked[]` | string[] |
| `dkim.selectors_found[]` | string[] |
| `dkim.valid` | boolean |
| `dmarc` | object |
| `dmarc.classification` | object |
| `dmarc.classification.status` | string |
| `dmarc.classification.reason` | string |
| `dmarc.classification.evidence` | object |
| `dmarc.classification.evidence.source` | string |
| `dmarc.classification.evidence.method` | string |
| `dmarc.classification.evidence.observed_at` | string |
| `dmarc.classification.evidence.detail` | string |
| `dmarc.classification.checked_at` | string |
| `dmarc.exists` | boolean \| null |
| `dmarc.record` | string |
| `dmarc.valid` | boolean |
| `dmarc.policy` | string |
| `dmarc.subdomain_policy` | string |
| `dmarc.percentage` | integer |
| `dmarc.rua[]` | string[] |
| `dmarc.ruf[]` | string[] |
| `dmarc.issues[]` | string[] |
| `bimi` | object |
| `bimi.classification` | object |
| `bimi.classification.status` | string |
| `bimi.classification.reason` | string |
| `bimi.classification.evidence` | object |
| `bimi.classification.evidence.source` | string |
| `bimi.classification.evidence.method` | string |
| `bimi.classification.evidence.observed_at` | string |
| `bimi.classification.evidence.detail` | string |
| `bimi.classification.checked_at` | string |
| `bimi.exists` | boolean \| null |
| `bimi.record` | string |
| `bimi.logo_url` | string |
| `bimi.authority_url` | string |
| `bimi.valid` | boolean |
| `bimi.logo_fetch_ok` | boolean \| null |
| `bimi.logo_http_status` | integer \| null |
| `bimi.logo_content_type` | string \| null |
| `bimi.logo_bytes` | integer \| null |
| `bimi.logo_svg_detected` | boolean \| null |
| `bimi.vmc_present` | boolean |
| `bimi.vmc_fetched` | boolean \| null |
| `bimi.vmc_http_status` | integer \| null |
| `bimi.vmc_content_type` | string \| null |
| `bimi.vmc_certificate_valid` | boolean \| null |
| `bimi.vmc_subject` | string \| null |
| `bimi.vmc_issuer` | string \| null |
| `bimi.vmc_not_before` | string \| null |
| `bimi.vmc_not_after` | string \| null |
| `bimi.vmc_days_to_expiry` | integer \| null |
| `bimi.vmc_fingerprint_sha256` | string \| null |
| `bimi.vmc_san_domains[]` | string[] |
| `bimi.errors[]` | string[] |
| `dnssec` | object |
| `dnssec.classification` | object |
| `dnssec.classification.status` | string |
| `dnssec.classification.reason` | string |
| `dnssec.classification.evidence` | object |
| `dnssec.classification.evidence.source` | string |
| `dnssec.classification.evidence.method` | string |
| `dnssec.classification.evidence.observed_at` | string |
| `dnssec.classification.evidence.detail` | string |
| `dnssec.classification.checked_at` | string |
| `dnssec.enabled` | boolean \| null |
| `dnssec.valid` | boolean |
| `dnssec.algorithm` | string |
| `dnssec.key_tag` | integer |
| `dnssec.validation_status` | string |
| `dnssec.validated_by_proxy` | boolean |
| `dnssec.validation_reason` | string \| null |
| `dnssec.ds_records[]` | string[] |
| `dnssec.dnskey_records[]` | string[] |
| `dnssec.rrsig_present` | boolean |
| `dnssec.resolver` | string |
| `dnssec.mismatch_detail` | object |
| `dnssec.mismatch_detail.checked` | boolean |
| `dnssec.mismatch_detail.mismatch_detected` | boolean |
| `dnssec.mismatch_detail.reason` | string \| null |
| `dnssec.mismatch_detail.ds_record_count` | integer |
| `dnssec.mismatch_detail.dnskey_record_count` | integer |
| `dnssec.mismatch_detail.rrsig_present` | boolean \| null |
| `dnssec.mismatch_detail.validation_status` | string \| null |
| `dnssec.mismatch_detail.resolver` | string \| null |
| `caa` | object |
| `caa.classification` | object |
| `caa.classification.status` | string |
| `caa.classification.reason` | string |
| `caa.classification.evidence` | object |
| `caa.classification.evidence.source` | string |
| `caa.classification.evidence.method` | string |
| `caa.classification.evidence.observed_at` | string |
| `caa.classification.evidence.detail` | string |
| `caa.classification.checked_at` | string |
| `caa.exists` | boolean \| null |
| `caa.records[]` | object[] |
| `caa.records[]` | object |
| `caa.records[].flags` | integer |
| `caa.records[].tag` | string |
| `caa.records[].value` | string |
| `caa.issuers[]` | string[] |
| `caa.issue_wild[]` | string[] |
| `caa.iodef` | string |
| `issuance_readiness` | object |
| `issuance_readiness.caa` | object |
| `issuance_readiness.caa.exists` | boolean |
| `issuance_readiness.caa.records[]` | object[] |
| `issuance_readiness.caa.records[]` | object |
| `issuance_readiness.caa.records[].flags` | integer |
| `issuance_readiness.caa.records[].tag` | string |
| `issuance_readiness.caa.records[].value` | string |
| `issuance_readiness.caa.issue_issuers[]` | string[] |
| `issuance_readiness.caa.issuewild_issuers[]` | string[] |
| `issuance_readiness.caa.iodef` | string \| null |
| `issuance_readiness.caa.letsencrypt_allowed` | boolean |
| `issuance_readiness.caa.google_trust_services_allowed` | boolean |
| `issuance_readiness.http01` | object |
| `issuance_readiness.http01.challenge_path` | string |
| `issuance_readiness.http01.reachable` | boolean |
| `issuance_readiness.http01.ready` | boolean |
| `issuance_readiness.http01.status_code` | integer \| null |
| `issuance_readiness.http01.final_url` | string \| null |
| `issuance_readiness.http01.redirects` | integer \| null |
| `issuance_readiness.http01.error` | string \| null |
| `issuance_readiness.checked_at` | string |
| `authoritative_consistency` | object |
| `authoritative_consistency.record_type` | string |
| `authoritative_consistency.all_authoritative` | boolean |
| `authoritative_consistency.answer_sets_match` | boolean |
| `authoritative_consistency.inconsistent_nameservers[]` | string[] |
| `authoritative_consistency.consistent_serial` | boolean |
| `authoritative_consistency.serials[]` | object[] |
| `authoritative_consistency.serials[]` | object |
| `authoritative_consistency.serials[].host` | string |
| `authoritative_consistency.serials[].udp_soa_serial` | string \| null |
| `authoritative_consistency.serials[].tcp_soa_serial` | string \| null |
| `authoritative_consistency.reference_answers[]` | string[] |
| `delegation_health` | object |
| `delegation_health.nameservers[]` | object[] |
| `delegation_health.nameservers[]` | object |
| `delegation_health.nameservers[].host` | string |
| `delegation_health.nameservers[].addresses[]` | string[] |
| `delegation_health.nameservers[].in_bailiwick` | boolean |
| `delegation_health.nameservers[].glue_required` | boolean |
| `delegation_health.nameservers[].udp` | object |
| `delegation_health.nameservers[].udp.authoritative` | boolean |
| `delegation_health.nameservers[].udp.status` | string |
| `delegation_health.nameservers[].udp.query_ms` | integer \| null |
| `delegation_health.nameservers[].udp.answer_count` | integer |
| `delegation_health.nameservers[].udp.answers[]` | string[] |
| `delegation_health.nameservers[].udp.soa_serial` | string \| null |
| `delegation_health.nameservers[].udp.truncated` | boolean |
| `delegation_health.nameservers[].udp.error` | string \| null |
| `delegation_health.nameservers[].tcp` | object |
| `delegation_health.nameservers[].tcp.authoritative` | boolean |
| `delegation_health.nameservers[].tcp.status` | string |
| `delegation_health.nameservers[].tcp.query_ms` | integer \| null |
| `delegation_health.nameservers[].tcp.answer_count` | integer |
| `delegation_health.nameservers[].tcp.answers[]` | string[] |
| `delegation_health.nameservers[].tcp.soa_serial` | string \| null |
| `delegation_health.nameservers[].tcp.truncated` | boolean |
| `delegation_health.nameservers[].tcp.error` | string \| null |
| `delegation_health.nameservers[].lame` | boolean |
| `delegation_health.nameservers[].issues[]` | string[] |
| `delegation_health.in_bailiwick_nameservers[]` | string[] |
| `delegation_health.glue_required_count` | integer |
| `delegation_health.all_in_bailiwick_resolve` | boolean |
| `delegation_health.missing_addresses[]` | string[] |
| `delegation_health.lame_nameservers[]` | string[] |
| `dns_transport` | object |
| `dns_transport.udp_working` | boolean |
| `dns_transport.tcp_working` | boolean |
| `dns_transport.tcp_supported_nameservers[]` | string[] |
| `dns_transport.tcp_failed_nameservers[]` | string[] |
| `dns_transport.truncation_tested` | boolean |
| `dns_transport.truncation_nameserver` | string |
| `dns_transport.truncation_record_type` | string |
| `dns_transport.truncation_observed` | boolean \| null |
| `dns_transport.tcp_fallback_ready` | boolean \| null |
| `nameserver_drift` | object |
| `nameserver_drift.checked` | boolean |
| `nameserver_drift.drift_detected` | boolean \| null |
| `nameserver_drift.public_nameservers[]` | string[] |
| `nameserver_drift.authoritative_nameservers[]` | string[] |
| `nameserver_drift.missing_from_authority[]` | string[] |
| `nameserver_drift.extra_at_authority[]` | string[] |
| `nameserver_drift.inconsistent_nameservers[]` | string[] |
| `nameserver_drift.serial_mismatch_detected` | boolean \| null |
| `mta_sts` | object |
| `mta_sts.classification` | object |
| `mta_sts.classification.status` | string |
| `mta_sts.classification.reason` | string |
| `mta_sts.classification.evidence` | object |
| `mta_sts.classification.evidence.source` | string |
| `mta_sts.classification.evidence.method` | string |
| `mta_sts.classification.evidence.observed_at` | string |
| `mta_sts.classification.evidence.detail` | string |
| `mta_sts.classification.checked_at` | string |
| `mta_sts.exists` | boolean \| null |
| `mta_sts.record` | string |
| `mta_sts.valid` | boolean |
| `mta_sts.policy_id` | string |
| `mta_sts.policy_fetch_ok` | boolean |
| `mta_sts.policy_http_status` | integer \| null |
| `mta_sts.mode` | string |
| `mta_sts.max_age` | integer |
| `mta_sts.mx_hosts[]` | string[] |
| `mta_sts.mx_records[]` | string[] |
| `mta_sts.policy_matches_mx` | boolean \| null |
| `mta_sts.uncovered_mx[]` | string[] |
| `mta_sts.errors[]` | string[] |
| `tls_rpt` | object |
| `tls_rpt.exists` | boolean |
| `tls_rpt.record` | string |
| `tls_rpt.valid` | boolean |
| `tls_rpt.rua[]` | string[] |
| `tls_rpt.errors[]` | string[] |
| `resolver_latency` | object |
| `resolver_latency.record_type` | string |
| `resolver_latency.resolvers[]` | object[] |
| `resolver_latency.resolvers[]` | object |
| `resolver_latency.resolvers[].resolver` | string |
| `resolver_latency.resolvers[].label` | string |
| `resolver_latency.resolvers[].query_ms` | integer \| null |
| `resolver_latency.resolvers[].status` | string |
| `resolver_latency.resolvers[].answer_count` | integer |
| `resolver_latency.resolvers[].answers[]` | string[] |
| `resolver_latency.resolvers[].server` | string \| null |
| `resolver_latency.resolvers[].error` | string \| null |
| `resolver_latency.min_ms` | integer \| null |
| `resolver_latency.max_ms` | integer \| null |
| `resolver_latency.avg_ms` | number \| null |
| `zone_transfer` | object |
| `zone_transfer.exposed` | boolean |
| `zone_transfer.nameservers[]` | object[] |
| `zone_transfer.nameservers[]` | object |
| `zone_transfer.nameservers[].host` | string |
| `zone_transfer.nameservers[].exposed` | boolean |
| `zone_transfer.nameservers[].query_ms` | integer |
| `zone_transfer.nameservers[].records_returned` | integer |
| `zone_transfer.nameservers[].soa_seen` | boolean |
| `zone_transfer.nameservers[].reason` | string \| null |
| `zone_transfer.nameservers[].sample_records[]` | string[] |
| `blacklist` | object |
| `blacklist.domain` | string |
| `blacklist.listed` | boolean |
| `blacklist.lists[]` | object[] |
| `blacklist.lists[]` | object |
| `blacklist.lists[].name` | string |
| `blacklist.lists[].listed` | boolean |
| `blacklist.lists[].status` | string |
| `blacklist.lists[].code` | string |
| `blacklist.lists[].meaning` | string |
| `blacklist.lists[].unknown_reason` | string |
| `blacklist.lists_unknown` | integer |
| `blacklist.threat_level` | string |
| `blacklist.check_type` | string |
| `blacklist.checked_at` | string |
| `edge_summary` | object |
| `edge_summary.relay_configured` | boolean |
| `edge_summary.evidence_sources[]` | string[] |
| `edge_summary.secure_dns_chain` | boolean |
| `edge_summary.zone_transfer_exposed` | boolean \| null |
| `edge_summary.authoritative_consistency_ok` | boolean \| null |
| `edge_summary.nameserver_drift_detected` | boolean \| null |
| `edge_summary.lame_nameserver_count` | integer \| null |
| `edge_summary.tcp_fallback_ready` | boolean \| null |
| `edge_summary.avg_resolver_latency_ms` | number \| null |
| `edge_summary.fastest_resolver` | string \| null |
| `edge_summary.slowest_resolver` | string \| null |
| `edge_summary.issuance_http01_ready` | boolean \| null |
| `edge_summary.caa_restricts_issuers` | boolean |
| `edge_summary.bimi_vmc_valid` | boolean \| null |
| `edge_summary.mta_sts_enforced` | boolean |
| `edge_summary.tls_rpt_configured` | boolean |
| `edge_summary.spf_lookup_limit_exceeded` | boolean |
| `recommendations[]` | string[] |
| `checked_at` | string |
| `check_duration_ms` | integer |
| `meta` | object |
| `meta.served_by` | string |

#### 请求示例

```bash
curl -H "X-API-Key: $DOMSCAN_API_KEY" "https://domscan.net/v1/dns/security?domain=example.com"
```

```javascript
const response = await fetch("https://domscan.net/v1/dns/security?domain=example.com", {
  headers: { "X-API-Key": process.env.DOMSCAN_API_KEY },
});
const data = await response.json();
console.log(data);
```

```python
import os
import requests

response = requests.get(
    "https://domscan.net/v1/dns/security?domain=example.com",
    headers={"X-API-Key": os.environ["DOMSCAN_API_KEY"]},
)
print(response.json())
```

```go
package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://domscan.net/v1/dns/security?domain=example.com", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("X-API-Key", os.Getenv("DOMSCAN_API_KEY"))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	data, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(resp.Status, string(data))
}
```

```ruby
require "json"
require "net/http"

uri = URI("https://domscan.net/v1/dns/security?domain=example.com")
request = Net::HTTP::Get.new(uri)
request["X-API-Key"] = ENV.fetch("DOMSCAN_API_KEY")

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end
puts JSON.pretty_generate(JSON.parse(response.body))
```

#### 响应示例

```json
{
  "domain": "google.com",
  "security_score": 97,
  "security_grade": "A+",
  "spf": {
    "exists": true,
    "record": "v=spf1 include:_spf.google.com ~all",
    "valid": true,
    "policy": "softfail",
    "includes": [
      "_spf.google.com"
    ],
    "dns_lookup_count": 1,
    "dns_lookup_limit_exceeded": false,
    "include_tree": [
      {
        "domain": "_spf.google.com",
        "lookups": 1
      }
    ],
    "lookup_walk_count": 1,
    "macros_present": false,
    "macro_references": [],
    "walk": [
      {
        "domain": "google.com",
        "depth": 0,
        "record": "v=spf1 include:_spf.google.com ~all",
        "mechanisms": [
          "include:_spf.google.com",
          "~all"
        ],
        "includes": [
          "_spf.google.com"
        ],
        "redirect": null,
        "direct_lookup_count": 1,
        "total_lookup_count": 1,
        "macros_present": false,
        "macro_references": [],
        "multiple_records": 1
      }
    ],
    "walk_errors": [],
    "issues": []
  },
  "dkim": {
    "exists": true,
    "selectors_checked": [
      "google",
      "selector1",
      "selector2"
    ],
    "selectors_found": [
      "google"
    ],
    "valid": true
  },
  "dmarc": {
    "exists": true,
    "record": "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com",
    "valid": true,
    "policy": "reject",
    "subdomain_policy": "reject",
    "percentage": 100,
    "rua": [
      "mailto:mailauth-reports@google.com"
    ],
    "ruf": [],
    "issues": []
  },
  "bimi": {
    "exists": true,
    "record": "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem",
    "logo_url": "https://example.com/logo.svg",
    "authority_url": "https://example.com/vmc.pem",
    "valid": true,
    "logo_fetch_ok": true,
    "logo_http_status": 200,
    "logo_content_type": "image/svg+xml",
    "logo_bytes": 2048,
    "logo_svg_detected": true,
    "vmc_present": true,
    "vmc_fetched": true,
    "vmc_http_status": 200,
    "vmc_content_type": "application/x-pem-file",
    "vmc_certificate_valid": true,
    "vmc_subject": "/CN=Example Inc VMC",
    "vmc_issuer": "/CN=Example Issuer",
    "vmc_not_before": "2026-01-01T00:00:00Z",
    "vmc_not_after": "2027-01-01T00:00:00Z",
    "vmc_days_to_expiry": 258,
    "vmc_fingerprint_sha256": "AA:BB:CC:DD",
    "vmc_san_domains": [
      "google.com"
    ],
    "errors": []
  },
  "dnssec": {
    "enabled": true,
    "valid": true,
    "algorithm": "ECDSAP256SHA256",
    "key_tag": 12345,
    "validation_status": "secure",
    "validated_by_proxy": true,
    "validation_reason": "chain validated via delv",
    "ds_records": [
      "12345 13 2 1a2b3c4d5e6f"
    ],
    "dnskey_records": [
      "256 3 13 AbCdEfGhIjKlMnOp"
    ],
    "rrsig_present": true,
    "resolver": "127.0.0.1",
    "mismatch_detail": {
      "checked": true,
      "mismatch_detected": false,
      "reason": "chain validated via delv",
      "ds_record_count": 1,
      "dnskey_record_count": 1,
      "rrsig_present": true,
      "validation_status": "secure",
      "resolver": "127.0.0.1"
    }
  },
  "caa": {
    "exists": true,
    "records": [
      {
        "flags": 0,
        "tag": "issue",
        "value": "pki.goog"
      }
    ],
    "issuers": [
      "pki.goog"
    ],
    "issue_wild": [],
    "iodef": "mailto:security@google.com"
  },
  "issuance_readiness": {
    "caa": {
      "exists": true,
      "records": [
        {
          "flags": 0,
          "tag": "issue",
          "value": "pki.goog"
        },
        {
          "flags": 0,
          "tag": "iodef",
          "value": "mailto:security@google.com"
        }
      ],
      "issue_issuers": [
        "pki.goog"
      ],
      "issuewild_issuers": [],
      "iodef": "mailto:security@google.com",
      "letsencrypt_allowed": false,
      "google_trust_services_allowed": true
    },
    "http01": {
      "challenge_path": "/.well-known/acme-challenge/domscan-probe-1713474000",
      "reachable": true,
      "ready": true,
      "status_code": 404,
      "final_url": "http://google.com/.well-known/acme-challenge/domscan-probe-1713474000",
      "redirects": 0,
      "error": null
    },
    "checked_at": "2026-04-18T21:00:00Z"
  },
  "authoritative_consistency": {
    "record_type": "SOA",
    "all_authoritative": true,
    "answer_sets_match": true,
    "inconsistent_nameservers": [],
    "consistent_serial": true,
    "serials": [
      {
        "host": "ns1.google.com",
        "udp_soa_serial": "2026041801",
        "tcp_soa_serial": "2026041801"
      }
    ],
    "reference_answers": [
      "google.com. 60 IN SOA ns1.google.com. dns-admin.google.com. 2026041801 900 900 1800 60"
    ]
  },
  "delegation_health": {
    "nameservers": [
      {
        "host": "ns1.google.com",
        "addresses": [
          "216.239.32.10"
        ],
        "in_bailiwick": false,
        "glue_required": false,
        "udp": {
          "authoritative": true,
          "status": "NOERROR",
          "query_ms": 14,
          "answer_count": 1,
          "answers": [
            "google.com. 60 IN SOA ns1.google.com. dns-admin.google.com. 2026041801 900 900 1800 60"
          ],
          "soa_serial": "2026041801",
          "truncated": false,
          "error": null
        },
        "tcp": {
          "authoritative": true,
          "status": "NOERROR",
          "query_ms": 18,
          "answer_count": 1,
          "answers": [
            "google.com. 60 IN SOA ns1.google.com. dns-admin.google.com. 2026041801 900 900 1800 60"
          ],
          "soa_serial": "2026041801",
          "truncated": false,
          "error": null
        },
        "lame": false,
        "issues": []
      }
    ],
    "in_bailiwick_nameservers": [],
    "glue_required_count": 0,
    "all_in_bailiwick_resolve": true,
    "missing_addresses": [],
    "lame_nameservers": []
  },
  "dns_transport": {
    "udp_working": true,
    "tcp_working": true,
    "tcp_supported_nameservers": [
      "ns1.google.com"
    ],
    "tcp_failed_nameservers": [],
    "truncation_tested": true,
    "truncation_nameserver": "ns1.google.com",
    "truncation_record_type": "DNSKEY",
    "truncation_observed": false,
    "tcp_fallback_ready": null
  },
  "nameserver_drift": {
    "checked": true,
    "drift_detected": false,
    "public_nameservers": [
      "ns1.google.com"
    ],
    "authoritative_nameservers": [
      "ns1.google.com"
    ],
    "missing_from_authority": [],
    "extra_at_authority": [],
    "inconsistent_nameservers": [],
    "serial_mismatch_detected": false
  },
  "mta_sts": {
    "exists": true,
    "record": "v=STSv1; id=2024010101Z",
    "valid": true,
    "policy_id": "2024010101Z",
    "policy_fetch_ok": true,
    "policy_http_status": 200,
    "mode": "enforce",
    "max_age": 86400,
    "mx_hosts": [
      "*.google.com"
    ],
    "mx_records": [
      "aspmx.l.google.com",
      "alt1.aspmx.l.google.com"
    ],
    "policy_matches_mx": true,
    "uncovered_mx": [],
    "errors": []
  },
  "tls_rpt": {
    "exists": true,
    "record": "v=TLSRPTv1; rua=mailto:sts-reports@google.com",
    "valid": true,
    "rua": [
      "mailto:sts-reports@google.com"
    ],
    "errors": []
  },
  "resolver_latency": {
    "record_type": "MX",
    "resolvers": [
      {
        "resolver": "1.1.1.1",
        "label": "Cloudflare",
        "query_ms": 22,
        "status": "NOERROR",
        "answer_count": 5,
        "answers": [
          "aspmx.l.google.com"
        ],
        "server": "1.1.1.1#53",
        "error": null
      },
      {
        "resolver": "8.8.8.8",
        "label": "Google Public DNS",
        "query_ms": 3,
        "status": "NOERROR",
        "answer_count": 5,
        "answers": [
          "aspmx.l.google.com"
        ],
        "server": "8.8.8.8#53",
        "error": null
      }
    ],
    "min_ms": 3,
    "max_ms": 22,
    "avg_ms": 12.5
  },
  "zone_transfer": {
    "exposed": false,
    "nameservers": [
      {
        "host": "ns1.google.com",
        "exposed": false,
        "query_ms": 18,
        "records_returned": 0,
        "soa_seen": false,
        "reason": "transfer failed",
        "sample_records": []
      }
    ]
  },
  "blacklist": {
    "domain": "google.com",
    "listed": false,
    "threat_level": "none",
    "check_type": "domain",
    "checked_at": "2026-04-18T21:00:00Z"
  },
  "edge_summary": {
    "relay_configured": true,
    "evidence_sources": [
      "dnssec_validate",
      "axfr_check",
      "dns_authority_health",
      "dns_latency",
      "issuance_readiness",
      "mail_policies",
      "bimi_audit",
      "spf_walk"
    ],
    "secure_dns_chain": true,
    "zone_transfer_exposed": false,
    "authoritative_consistency_ok": true,
    "nameserver_drift_detected": false,
    "lame_nameserver_count": 0,
    "tcp_fallback_ready": null,
    "avg_resolver_latency_ms": 12.5,
    "fastest_resolver": "Google Public DNS",
    "slowest_resolver": "Cloudflare",
    "issuance_http01_ready": true,
    "caa_restricts_issuers": true,
    "bimi_vmc_valid": true,
    "mta_sts_enforced": true,
    "tls_rpt_configured": true,
    "spf_lookup_limit_exceeded": false
  },
  "recommendations": [],
  "checked_at": "2026-04-18T21:00:00Z",
  "check_duration_ms": 312
}
```

#### HTTP 状态码

- `200` 成功
- `400` 请求错误
- `401` 未授权
- `402` 需要付款
- `429` 请求过多