32 – DNS (Zonemaster)

The test runs Zonemaster, the tool used by among others the Swedish Internet Foundation to audit DNS setups. DNS is what makes the domain name lead to the right server. If it breaks, the rest of the website doesn't matter.

What is tested?

Zonemaster runs a large number of test cases, which Webperf groups into two areas:

Standards compliance: delegation, reachability and syntax
Integrity and security: DNSSEC and whether the name servers answer consistently

How it affects the score

Each remark is classed as critical, error or warning. Warnings and errors carry different penalties, and remarks of the "notice" kind don't affect the score at all. They're reported as information. The review shows how many of the criteria passed without a remark.

Score	Meaning
5.0	The DNS setup is great
4.0	Good, with minor remarks
3.0	About average, should be improved
2.0	Rather poor setup
1.0	Very poor setup

Broken delegation is its own outcome: the domain then can't be resolved reliably, which is more serious than individual remarks.

Prerequisites

Zonemaster runs in a Docker container, so Docker must be installed and running.

Running the test

python default.py -u https://example.com -t 32 -r

Settings

Setting	Default	Meaning
`tests.dns.image`	`zonemaster/cli`	The Docker image used
`tests.dns.timeout`	`180`	Seconds before the run is aborted
`tests.dns.ipv6`	`false`	Run the test cases over IPv6 as well
`tests.dns.registrable`	`true`	Test the registrable domain rather than the full host
`tests.dns.warning-penalty`	`0.75`	Penalty per warning
`tests.dns.error-penalty`	`1.5`	Penalty per error
`tests.dns.profile.use`	`false`	Use a custom Zonemaster profile

tests.dns.registrable controls whether www.example.com is tested as that zone or as example.com. The default is usually what you want, since it's the registrable domain that holds the name servers.