dns zone contract audit derived

{
  "input": {
    "body": {
      "zone": "example.test",
      "records": [
        {
          "ttl": 3600,
          "name": "example.test",
          "type": "A",
          "value": "203.0.113.10"
        },
        {
          "ttl": 3600,
          "name": "example.test",
          "type": "CNAME",
          "value": "hosting.vendor.test"
        },
        {
          "ttl": 3600,
          "name": "example.test",
          "type": "MX",
          "value": "10 mail.example.test"
        },
        {
          "ttl": 3600,
          "name": "mail.example.test",
          "type": "CNAME",
          "value": "mx.vendor.test"
        },
        {
          "ttl": 300,
          "name": "www.example.test",
          "type": "A",
          "value": "203.0.113.11"
        },
        {
          "ttl": 60,
          "name": "www.example.test",
          "type": "A",
          "value": "203.0.113.11"
        },
        {
          "ttl": 3600,
          "name": "*.example.test",
          "type": "A",
          "value": "203.0.113.12"
        },
        {
          "ttl": 3600,
          "name": "old.example.test",
          "type": "CNAME",
          "value": "gone.example.test"
        },
        {
          "ttl": 3600,
          "name": "other.test",
          "type": "A",
          "value": "203.0.113.13"
        }
      ],
      "contract": {
        "max_ttl": 86400,
        "min_ttl": 300,
        "required": [
          {
            "name": "example.test",
            "type": "MX"
          },
          {
            "name": "_dmarc.example.test",
            "type": "TXT"
          }
        ],
        "forbid_wildcards": true
      }
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "zone": "example.test",
      "valid": false,
      "limits": {
        "maxRecords": 2000,
        "maxFindings": 500,
        "maxHeaderBytes": 131072,
        "maxIncludeTree": 200,
        "spfLookupLimit": 10,
        "maxRecordLength": 4096,
        "spfVoidLookupLimit": 2
      },
      "passed": false,
      "checked": {
        "max_ttl": 86400,
        "min_ttl": 300,
        "required": 2,
        "wildcards_forbidden": true
      },
      "complete": true,
      "findings": [
        {
          "code": "TTL_BELOW_MINIMUM",
          "name": "www.example.test",
          "type": "A",
          "detail": "www.example.test A has a TTL of 60 and the contract requires at least 300. A short TTL multiplies query volume and resolver load."
        },
        {
          "code": "WILDCARD_RECORD",
          "name": "*.example.test",
          "type": "A",
          "detail": "*.example.test is a wildcard, which answers for every name the zone does not define, including ones nobody intended."
        },
        {
          "code": "RECORD_OUTSIDE_ZONE",
          "name": "other.test",
          "type": "A",
          "detail": "other.test is not inside example.test, so it is not this zone's record to publish."
        }
      ],
      "name_count": 6,
      "request_id": "example-request",
      "service_id": "dns_zone_contract_audit",
      "assumptions": [
        "Nothing resolves DNS. Names are normalised so a trailing dot does not create a second name, which otherwise makes every cross-reference check miss.",
        "A target that is itself a CNAME is reported because it is forbidden for MX, NS and CNAME, and because the resulting failure is intermittent rather than total, which is why it survives in production.",
        "A target inside the zone that the zone does not define is reported as resolving to nothing. A target outside the zone is not followed, since this product has no view of another zone."
      ],
      "cname_count": 3,
      "limitations": [
        "The records supplied. Whether they are published, whether an external target resolves, and whether delegation is correct at the parent are all outside this.",
        "valid is true only when every rule held and every check the caller asked for was performed."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "record_count": 9,
      "finding_count": 9,
      "types_present": [
        "A",
        "CNAME",
        "MX"
      ],
      "service_version": "1.0.0",
      "findings_by_code": {
        "WILDCARD_RECORD": 1,
        "RECORD_DUPLICATED": 1,
        "TARGET_IS_A_CNAME": 1,
        "TTL_BELOW_MINIMUM": 1,
        "CNAME_AT_ZONE_APEX": 1,
        "TARGET_NOT_IN_ZONE": 1,
        "RECORD_OUTSIDE_ZONE": 1,
        "REQUIRED_RECORD_ABSENT": 1,
        "TTL_VARIES_WITHIN_A_RECORD_SET": 1
      }
    }
  }
}