The zone above all zones · made readable
Above every domain
sits one file.
Every web address on earth resolves by climbing to the same place: the DNS root zone — one file, publicly published, naming all 1,438 top-level domains and the servers that answer for them. Domain people call it the scripture; almost nobody has ever read it. This page parses the file itself into a register: every TLD, its nameservers, its DNSSEC state, its glue, filterable and figured.
And because the root is alive — it revises about twice a day — the register carries a watch: the zone’s serial read live from the resolvers against the snapshot’s own, and a per-TLD “ask the resolvers now” that compares the wire of this second to the file in front of you. What neither says, this page does not invent.
The register
All 1,438 delegations.
The zone
Waiting
.tld
The servers, as the zone file names them
The live check
The watch
The root turns twice a day.
The serial
Asking the resolvers…
Changed since the last snapshot
Method
The file itself, and one live wire.
The register is the zone file
The snapshot is parsed from the root zone as published at
internic.net/domain/root.zone — the actual file the root servers
serve — and stamped with the zone’s own SOA serial. Nameserver sets,
DS records (DNSSEC) and glue are read from its records, nothing else’s.
The live wire is DNS itself
Live checks use DNS-over-HTTPS at dns.google —
keyless, CORS-open, browser-direct. The watch reads the root’s SOA
serial this second; the per-TLD check asks for a TLD’s NS set and lays
the wire’s answer beside the file’s, naming any difference.
The diff is machinery, not memory
Every refresh of the register keeps its zone under
tools/snapshots/, and tools/mkroot.py diffs the two
most recent: TLDs born, TLDs gone, server sets changed, DNSSEC flipped. The
first snapshot ships alone and the page says so — a watch that pretended to
a history it does not hold would not be this site’s.
Nothing about you leaves
The register is a shipped file; the only live requests are the DNS queries you press for, sent to the resolver and no one else. No key, no account, no analytics in the loop.