ZoneProof FAQ

Because discovery is moving from browsers to AI agents, and the trust signals namespaces spent decades building are invisible to them. An agent that cannot see registry screening treats a screened domain like any other string.

ZoneProof exists so that verification survives the handoff: indexed for every TLD, confirmed by the stewards who hold the pen.

ZoneProof publishes machine-readable records for internet namespaces. Every active delegated top-level domain starts with a baseline record built from public sources, including IANA root data, registry agreements, RDAP, WHOIS, and published policy materials.

Confirmed namespace stewards can claim the record, confirm control, and list first-party policy or zone data. ZoneProof makes it queryable by software, AI systems, and anyone who needs to know whether a domain's namespace carries registry-enforced verification requirements.

ZoneProof covers active DNS root zone delegations by IANA: generic TLDs, country-code TLDs, and internationalized TLDs, plus registry-delegated second-level public-suffix zones such as co.uk or gov.au.

Namespace-level records exist for TLDs today. TLD landing pages such as /bank and /insurance are intended to explain the namespace to both stewards and registrants. Deeper zone listings and registrant-level records are being rolled out namespace by namespace.

A namespace claim confirms who may author the ZoneProof record for a TLD or delegated namespace. It upgrades the record from a public-source baseline to a steward-maintained listing.

A zone claim or zone listing goes deeper. The confirmed steward lists delegated names under that namespace, making the zone discoverable as an enumerable set of names. For credentialed TLDs such as .bank or .insurance, that can show which names are actually in the screened namespace.

ZoneProof indexes delegated names, not people. A zone listing does not publish WHOIS, registrant contacts, private account data, or non-public eligibility files.

The party with authoritative control of the namespace at that level can claim a listing.

The IANA database lists three contacts for every delegated TLD: sponsor, administrative contact, and technical contact. Each of these is eligible for claiming a TLD, although their permissions may vary.

Second-level public-suffix listings can be claimed by the entity that operates that zone, even if it differs from the parent TLD's manager.

Where available, individual domain listings in registry-verified TLDs can be claimed by the domain's verified registrant.

Claiming confirms control of the ZoneProof listing and authorization to maintain first-party data for it. It does not signal partnership with, certification by, or endorsement from ZoneProof.

Claiming a listing for a TLD or an individual domain is free. The baseline ability to claim and maintain an accurate listing is free, and always will be.

One capability is a paid subscription: Zone Sync, which ingests a namespace's zone file and refreshes it on a schedule so the listed zone stays current. Zone Sync is priced by zone size - plans start at $950/year for zones up to 10 names - and is described on the pricing page.

A synced zone adds data to a record; it never changes how the record's status is characterized. If a subscription ends, the record remains claimed and free; the zone listing freezes with a visible last-synced date and later ages out.

Use the claim flow to find the listing, identify your organization, and provide your role with respect to the namespace. The flow has two tracks: one for TLD operators and managers, and one for registrants who hold a domain in a verified TLD.

ZoneProof confirms control via several methods. For TLD operators, confirmation through the contact of record with IANA or ICANN may be available.

Other methods include asking the claimant to publish a one-time DNS TXT token on the namespace, or, for individual domains, to place a small file at /.well-known/zoneproof.json.

Once confirmation succeeds, the record can be marked as confirmed and your organization can be shown as the listing's confirmed operator or registrant. Bulk claiming is available for organizations claiming multiple listings under common control.

Because unclaimed records are inferred, and confirmed records are authoritative.

ZoneProof enables a registry operator to replace a public-source sketch with a current, first-party namespace record.

Unclaimed records are useful, but they can be stale or generic. Claiming gives the steward the pen: policy details, verification levels, official endpoints, and namespace-specific fields can be listed by the party responsible for the zone.

For credentialed TLDs, a zone claim can also make delegated names discoverable. That means software can ask not just whether .bank is restricted, but whether a specific name is listed in the .bank zone.

Claiming also creates a notification channel if your record changes, is disputed, or verification needs to be renewed.

ZoneProof runs an MCP server at https://mcp.zoneproof.org/mcp. MCP-capable AI clients can connect to it alongside an organization's own MCP servers.

The integration model is complementary. ZoneProof answers namespace and verification questions, such as the registry's official website, whether a domain is in a restricted TLD, and what screening its registry enforces. Registries and registrants can operate their own MCP servers to answer more granular questions about their organization.

A ZoneProof listing can also point to other machine-readable endpoints, including /.well-known/ resources, a domain-owned MCP server, or llms.txt, so agents discovering a domain through ZoneProof know where to go next.

Within defined limits. ZoneProof records follow a published schema, and fields are classified by how they are sourced and verified. Some fields come from public records, such as those published by IANA and ICANN, and cannot be edited by claimants. Other fields are asserted by the confirmed claimant and are labeled as such, including corrections to inaccuracies in published data.

As a confirmed claimant, you can populate and maintain claimant-asserted fields such as organization display name, public contact points, official endpoints, and machine-readable resources. For domain listings, that can include content from your own /.well-known/zoneproof.json file.

You cannot alter verified facts, add promotional copy to query responses, or influence how ZoneProof characterizes other namespaces. That restraint is what makes a ZoneProof answer trustworthy.

Email [email protected] with the record in question and, where possible, a pointer to the authoritative source that contradicts it, such as an IANA entry, ICANN Registry Agreement, or RDAP response.

Reports are triaged against the applicable system of record. ZoneProof corrects its data to match authoritative sources rather than adjudicating disagreements itself. However, you may also submit issue reports if the public records are incorrect or out-of-date.

If the issue concerns a ZoneProof listing you do not control, the same channel can open a review and re-verification process.

Listings may be expanded by adding metadata at the registry level or adding the TLD's zone file of delegated names.

For example, a credentialed TLD can list its zone so every screened name in that namespace becomes discoverable. A dotBrand can list the complete set of names under its control. A ccTLD can choose whether delegated-name listing fits its publication practices.

If the ZoneProof schema or MCP tools do not yet support a question you want answered about your namespace, you can request a schema extension.