.Gov.uk Registry Checks Specification
This specification documents the implementation of the .gov.uk Registry Checks policy.
1. Specification Version: 1.0 – 16th August 2024.
2. Each check listed below are currently operational on the .gov.uk registry as a ‘soft check’ on the .gov.uk registry.
| Check Name | Description |
| Nameserver IP redundancy | Each delegated nameserver must resolve to at least one IP address. No two delegated nameservers for the same domain may share the same IPv4 address or the same IPv6 address. |
| Lame Delegation | Each delegated nameserver must return an authoritative response (AA flag set) for the domain when queried for records within the zone. |
| Glue records | Where a delegated nameserver is in-bailiwick, corresponding glue records must exist in the parent zone and the IPv4 and IPv6 addresses published in the glue records must match those returned by public DNS resolution for that nameserver. |
| Open AXFR prohibition check | A zone transfer request (AXFR) must not result in successful transfer of zone contents. Any response indicating that transfer is denied, refused, or otherwise unsuccessful shall be considered a pass. |
| Autonomous System diversity check | At least two delegated nameservers must be reachable via IP addresses originating from different Autonomous System Numbers (ASNs). |
| IP resolvability & validity check | Delegated nameservers must resolve to publicly routable IPv4 and/or IPv6 addresses. They must not be listed in the Special-Purpose Address Registry (IPv4 and IPv6). |
| Nameservers TTL check | The TTL associated with each delegated nameserver record must be between 300 and 172800 seconds inclusive. |
| Nameserver consistency check | The NS records returned from authoritative nameservers for the domain must exactly match the set of nameservers registered in the delegation. |
| DNSSEC chain integrity check | All DS records in the delegation for a domain must have corresponding DNSKEYs in the child zone. |
| ZSK RRSET validation Check | For all nameservers delegated for a domain, if there is a KSK then the ZSK must be able to validate any RRSETs within the zone of the domain. |
| DNSKEY secure signing algorithm (ZSK) check | If DNSSEC is enabled, all Zone Signing Keys (ZSKs) must use one of the following algorithms: 3, 5, 6, 7, 8, 10, 12, 13, 14. |
| Referral size limit check | The referral response generated by the parent zone must not exceed 512 octets when returned in a DNS response without EDNS0 support. |
| Publicly resolvable hostnames check | All delegation nameservers for a domain must resolve to IP addresses on the public internet. This can be an A and/or AAAA record. |
| DNS UDP availability check | All delegation nameservers for a domain must answer DNS queries over UDP. |
| DNS TCP availability check | All delegation nameservers for a domain must answer DNS queries over TCP. |
| Recursive prohibition check | All delegation nameservers for a domain must not provide a recursive name service. |
| Nameserver CNAME prohibition check | Delegation nameservers for a domain must not have a corresponding CNAME record. |
| EDNS0 support check | All delegation nameservers for a domain must support EDNS0. |
| DMARC presence & configuration check | A DMARC check passes where: a syntactically valid DMARC record exists; the record contains “v=DMARC1”; the record contains a valid “p=” policy value. Recommended and optional elements are advisory and do not affect pass/fail status. |
| MX record configuration check | If the domain publishes one or more MX records, each MX record must contain a preference value between 0 and 65535 and each mail exchanger hostname must be unique. |
| CAA record configuration check | A domain must publish at least one syntactically valid CAA record. The check fails if: no CAA record is present; or any returned CAA record does not conform to RFC 8659 or RFC 9495. |
Minerva House, Edmund Halley Road, Oxford Science Park, OX4 4DQ, United Kingdom