About

A namespace's rules only matter if they can be discovered.

For decades, the operators of the world's domain namespaces have done the hard work of trust. Eligibility screening. Credential checks. Charter verification. Registration policies enforced on every name in the zone.

That work is real. But it lives in PDF policy documents, registry websites, and institutional memory: formats built for people to read, in an era when people did the reading.

At the network layer, none of it is visible. The DNS treats every delegated name identically: a domain whose registrant passed regulatory screening resolves exactly like a lookalike registered in ninety seconds. The distinctions that namespace operators enforce, the entire point of a restricted namespace, are illegible exactly where software makes its decisions.

ZoneProof exists to close that gap.

What ZoneProof is

ZoneProof is a neutral, machine-readable index of domain namespace trust attributes.

Every top-level domain in the DNS root has a record in the index: its registration policy, verification requirements, and structural attributes, published as structured data at a stable location that any system can retrieve.

Namespace records are available at https://zoneproof.org/.well-known/tld/{tld}.json.

The index is populated from day one using publicly available information: IANA root records, published registry policies, and independent structural research. Where a value has been researched, the record says so. Where it has not, the record carries an honestly marked default, never a guess dressed up as a fact.

An open registration policy is a legitimate answer, not a lesser one. ZoneProof describes namespaces; it does not rank them.

From described to authored

A record built from public sources is a sketch drawn from the outside. It can go stale when policies change, and it can only be as specific as what an outside researcher can find.

The operators of a namespace know more, and ZoneProof gives them the pen. Namespace stewards can take authorship of their own record in three steps:

• Claim. Assert stewardship of your namespace.
• Confirm. Prove it against authoritative records.
• List. Publish current policy, verification levels, and structural detail no outside researcher could compile.

Records carry lifecycle status so the index stays honest over time. A record whose steward steps away can revert toward the public-data baseline. Trust that never expires is not trust.

Claiming is open now as early access. The founding cohort of listed namespaces will set the depth standard for the rest of the index.

Going deeper: listing the zone itself

Stewards can extend their record beyond policy, down to the names: a listing of the delegated second-level domains in the zone.

This turns a record about a namespace into an enumerable map of it. Presence in a listed zone becomes a checkable fact rather than an inference. Instead of asking what distinguishes a genuine name from a lookalike, a system consulting the index can ask a simpler question: is this name in the listed zone at all?

For generic TLDs, zone files are already publicly available; listing one in ZoneProof discloses nothing new. It makes existing public data structured and discoverable in context. For country-code TLDs, where publication practices vary, zone inclusion is strictly opt-in. And in every case, a listed zone contains delegated names only: never WHOIS or registrant contact data.

ZoneProof indexes names, not people.

For verified registrants

Verification that can't be discovered might as well not exist.

If your organization holds a name in a verified namespace, a bank in .bank, a pharmacy in .pharmacy, or a CPA firm in .cpa, you cleared a real bar to get it. ZoneProof lets that credential travel with your name.

Registrants in listed namespaces can claim, confirm, and list a record of their own, published at a well-known location on their own domain:

https://{yourdomain}/.well-known/zoneproof.json

The record is anchored to the namespace behind it. Your listing means what it means because your registry's eligibility screening means what it means. ZoneProof does not verify you; your registry already did. ZoneProof makes that fact discoverable.

What ZoneProof is not

Restraint is part of the design.

• ZoneProof does not verify anyone. Verification is done by registries, regulators, and credentialing bodies. ZoneProof indexes the results of that work; it does not perform or replace it.
• ZoneProof does not confer trust. A record reflects ZoneProof-indexed status: what has been claimed, confirmed, and listed. It is not an adjudication of ground truth.
• ZoneProof does not predict how the data will be used. Browsers, crawlers, compliance tools, and other software decide what to consult and how to weigh it. ZoneProof's job is simpler: make authoritative namespace data available, in a standard structure, at a stable address, so any system that wants it can find it.

Why now

More of the web's reading is done by software every year. The trust signals the web grew up with, padlocks and brand recognition, were designed for human eyes, and they do not translate. An enumerable, machine-readable namespace is a fundamentally more discoverable asset than an opaque one.

The namespaces that did the work of trust deserve to be legible. ZoneProof is where they claim the record.