ZoneFirst — DNS Measurement Infrastructure

Active DNS measurement for anti-abuse and email-infrastructure research.

What these hosts do / 这些主机在做什么

They perform active DNS resolution of publicly registered domain names — querying authoritative name servers for MX, NS, A, AAAA and TXT records — to build an index of publicly published mail and name-server infrastructure. This supports anti-abuse and phishing research.

这些主机对公开注册的域名做主动 DNS 解析，查询权威服务器的 MX/NS/A/AAAA/TXT 记录， 用于反滥用与钓鱼基础设施研究。

What they do not do / 不做的事

• No open recursive resolver. Inbound port 53 is firewalled closed. 不运行开放递归解析器，入站 53 端口已封。
• No port scanning. SMTP banner/certificate collection touches only hosts that published themselves as an MX record. 不做端口扫描；SMTP 采集只针对自己公布为 MX 的主机。
• No mail is ever delivered — sessions end at EHLO then QUIT. 从不投递任何邮件。
• No end-user DNS traffic is captured. Every query originates here. 不采集任何终端用户的 DNS 流量，所有查询都是我们自己发起的。

Rate limits / 速率

Opt out / 退出

Email abuse@darksphere.ai with the domain, zone or network range you want excluded. Exclusions are applied at the resolver before any query is sent, and existing records for that scope are deleted. We aim to respond within one business day.

发信到 abuse@darksphere.ai 说明要排除的域名/zone/网段即可。 排除在解析器发出查询之前生效，且会删除该范围内已有的记录。我们争取一个工作日内回复。

Privacy / 隐私

Only DNS data published by authoritative name servers is stored: owner name, record type, record data, and the time we observed it. No client IP addresses, no query logs from third parties, no personal data from certificate subjects. Requests under GDPR Art. 17 / Art. 21: privacy@darksphere.ai.

Hosts