Root Zone Monitoring

TLD SLA Compliance Metrics

Spec 10

DNS

Period	Availability	RTT Compliance	RTT p50	RTT p95	Checks
24h	100%	100%	28ms	243ms	364
7d	99.01%	99.01%	15ms	227ms	5252
30d	99.01%	99.01%	15ms	227ms	5252

DNSSEC Validation Metrics

Registry Agreement Spec 6

DNSSEC is required by the Registry Agreement (Specification 6) but is not part of the Spec 10 SLA. We monitor DNSSEC validation independently.

Period	Validation Rate	RTT p50	RTT p95	Checks
24h	100%	18ms	18ms	6
7d	100%	18ms	18ms	110
30d	100%	18ms	18ms	110

Unlike Spec 10 services, DNSSEC has no formal availability SLA. Thresholds shown are operational guidelines.

Current Check Status

Reported by Any53 Probes

Type	AF	RTT	Last Check	Source	Details	Status
`DNS`	v4	47ms	15 hours, 25 minutes ago	local	NSID: M-SFO-1	OK
`DNS`	v6	48ms	15 hours, 25 minutes ago	local	NSID: M-SFO-4	OK
`DNSSEC`	v4	18ms	35 minutes ago	local	Key: 20326	OK
`DNSSEC`	v6	18ms	35 minutes ago	local	Key: 20326	OK

Root Server Details

13 Root Servers

The 13 root servers operated by 12 organizations form the foundation of the DNS hierarchy. We test each server independently over both IPv4 and IPv6.

Server	Operator	IPv4 RTT	IPv6 RTT	IPv4 NSID	IPv6 NSID
`a.root-servers.net`	Verisign	18ms	19ms	`a.r.usnyc-2a`	`a.r.usnyc-2a`
`b.root-servers.net`	USC-ISI	227ms	189ms	`b2-sin`	`b1-sin`
`c.root-servers.net`	Cogent	2.3ms	1.9ms	`ord1a.c.root-server…`	`ord1a.c.root-server…`
`d.root-servers.net`	UMD	1.5ms	1.4ms	`chil5.droot.maxgiga…`	`chil8.droot.maxgiga…`
`e.root-servers.net`	NASA	1.5ms	1.3ms	`p03.ord.eroot`	`p01.ord.eroot`
`f.root-servers.net`	ISC	1.4ms	1.5ms	`ord2f.f.root-server…`	`ord2f.f.root-server…`
`g.root-servers.net`	DISA	11ms	11ms	`groot-con1-1`	`groot-con1-1`
`h.root-servers.net`	US Army	23ms	23ms	`001.den.h.root-serv…`	`001.den.h.root-serv…`
`i.root-servers.net`	Netnod	42ms	27ms	`s1.yvr`	`s1.mnp`
`j.root-servers.net`	Verisign	0.87ms	0.76ms	`n.r.elord1.uschi-0`	—
`k.root-servers.net`	RIPE NCC	40ms	27ms	`ns3.us-mia.k.ripe.n…`	`ns1.us-mia.k.ripe.n…`
`l.root-servers.net`	ICANN	22ms	18ms	`us-rtv-aa`	`us-rtv-aa`
`m.root-servers.net`	WIDE	47ms	48ms	`M-SFO-1`	`M-SFO-4`

NSID (Name Server Identifier) helps identify which anycast instance responded. Anchor validation confirms the DNSSEC root trust anchor matches across address families.

Test With Your Computer

DNS

dig @a.root-servers.net root. SOA +dnssec +nsid Query SOA with DNSSEC validation and NSID

drill -D root. SOA @a.root-servers.net Alternative using drill with DNSSEC trace

Registry Information

Active

TLD Root Zone

Operator Root Server System

ICANN SLA Requirements

Per ICANN Registry Agreement Specification 10:

DNS SLA UDP RTT ≤ 500ms for 95% of queries. Availability: 99% (max 432 min/month downtime).

API Access

JSON API

Access Root Zone compliance metrics programmatically via our REST API.

Quick Start

GET /any53/api/v1/compliance/root/

curl -H "X-API-Key: ${YOUR_API_KEY}" \
  "https://www.any53.com/any53/api/v1/compliance/root/"

Example Response

{
  "tld": "root",
  "display_name": "Root Zone",
  "operator": "Root Server System",
  "updated_at": "2026-01-31T12:00:00Z",
  "dns": {
    "availability_24h": 99.99,
    "rtt_p50_ms": 12,
    "rtt_p95_ms": 42,
    "sla_threshold_ms": 500
  },
  "spec10_compliant": true
}

Generate API Key

Get a free API key to start making requests. Provide an email to upgrade to the verified tier (600 requests/hour).

Endpoints

Endpoint	Description	Tier
`GET /compliance/`	List all monitored TLDs	All
`GET /compliance/{tld}/`	Current metrics for a TLD	All
`GET /compliance/{tld}/history/`	Historical time-series data	Organization
`GET /compliance/{tld}/probes/`	Per-probe breakdown	Organization
`POST /compliance/keys/`	Generate a new API key	No auth

Rate Limits

Tier	Rate Limit	Features
Anonymous	100/hour	Current snapshot, hourly aggregates
Verified	600/hour	Current snapshot, hourly aggregates
Organization	6000/hour	Historical data, per-minute resolution, per-probe breakdown