DNS Zone Files and ICANN CZDS: What They Are and How to Get Access

Start with a few lines of a real-looking zone

A zone file is a text file in the master-file format of the DNS standards. The zone of a top-level domain is the list of delegations the registry publishes: for each registered name, which servers answer for it. A short, invented excerpt of a hypothetical .example TLD zone looks like this:

$ORIGIN example.
alpha        172800 IN NS    ns1.dnshost-a.net.
alpha        172800 IN NS    ns2.dnshost-a.net.
beta         172800 IN NS    ns1.dnshost-b.org.
beta         172800 IN NS    ns2.dnshost-b.org.
beta         172800 IN DS    12345 13 2 9F2C...
gamma        172800 IN NS    ns1.gamma.example.
ns1.gamma    172800 IN A     192.0.2.53
ns1.gamma    172800 IN AAAA  2001:db8::53

Everything below the TLD, including the websites, mail servers and subdomains, lives in the second-level domain's own zone, held by whoever runs its DNS. The registry zone points toward it and nothing more.

What the records mean

Record	Role in a TLD zone	Why it matters for analysis
NS	Names the authoritative nameservers for a delegated domain	Domains with NS records are "in the zone". Provider and hosting patterns can be read from the nameserver names
DS	Delegation Signer: a hash of the child's DNSSEC key	Shows that the domain is DNSSEC-signed and chained to the parent
A, AAAA (glue)	Addresses for nameservers that sit inside the domain they serve	Needed to avoid circular lookups; appear only for in-zone nameserver names
SOA	Zone metadata, including the serial number	The serial tells you whether the zone changed between snapshots

The key point is the unit of storage: a zone has one set of records per delegation, not one row per registrant. A person who owns fifty domains is fifty unrelated entries unless you link them through shared nameservers. And a domain can appear several times as separate NS lines, so you must collapse duplicates before counting names.

What ICANN CZDS is

The Centralized Zone Data Service (CZDS) is an ICANN-run portal at czds.icann.org through which gTLD registry operators make zone files available to approved requesters. ICANN's program requires participating registries to provide that access, and the portal removes the need to sign a separate agreement with each one. New gTLDs are added after delegation. For extensions that are not listed there, ICANN's page tells you to contact the registry operator directly and ask about its zone file agreement.

How access works

1. Create an account on the portal and verify your email.
2. Request each TLD separately. You select the zones you want and state a reason for the request. There is no single "all zones" permission.
3. The registry decides. Each registry operator approves or denies the request, which can happen quickly or slowly depending on the operator. Denials and long waits do occur; keep your stated purpose specific and accurate.
4. Download through the web interface or, for automation, through the service's API using your account credentials. Files are compressed master files that can be many gigabytes uncompressed for the largest zones.
5. Renew. Approvals are not permanent. Access has historically been time-limited and needs to be kept current; check the portal for each TLD's expiry.

What a zone file can and cannot tell you

Question	Answerable?	Notes
Does a name currently have a delegation?	Yes	Presence in the zone
Which names appeared since yesterday?	Yes	Diff of two snapshots; see newly registered domains
Which names disappeared?	Yes, with caveats	Deleted, expired, or placed on hold. See domain lifecycle
Who owns a name?	No	Registrant data is separate; see WHOIS and RDAP, and much of it is redacted
Is the site live or valuable?	No	Requires crawling, backlink and traffic data
Registered but not delegated?	No	Names without nameservers are absent
Subdomains?	No	Registry zones stop at the second level
Registration date or price?	No	First-seen date only

A disappearance from the zone means the delegation was removed. In most cases that is a deletion after expiry, but a name on registry or registrar hold can also drop out temporarily, which is why "removed from zone" is not identical to "available to register".

Not every TLD is in CZDS

CZDS covers generic TLDs that take part in the ICANN program. Country-code TLDs run under their own national policies, and ICANN does not require them to publish zone files, so most ccTLD zones are not available through CZDS. Some ccTLD operators distribute zone data separately, under their own terms or openly; others do not distribute it at all. Even among gTLDs, a given request can be denied or left pending, and a few operators have particular restrictions. When you work with ccTLDs, check each registry's website and contact them rather than assuming. The structural differences between extension types are summarised in the guide to gTLD, ccTLD and new gTLD.

For this reason any total derived from CZDS is a count of delegated names in the participating zones, not of all domains in the world. The scale and its caveats are discussed in how many domains exist.

From file to insight: three small analyses

Once a day's names are normalised and de-duplicated, a handful of simple operations turn the raw list into something you can act on.

Growth and churn per TLD

Count unique names today, then count how many were added and how many removed compared with yesterday. Over weeks this shows which extensions are expanding, which are shrinking and which turn over names rapidly. A zone where additions and removals are both large relative to its size has high churn, which often accompanies cheap promotional pricing.

Nameserver concentration

Group delegations by the registrable domain of their nameservers. A few DNS providers host a large share of all domains, and the distribution differs by TLD. A cluster of new names all pointing to one unusual nameserver is a pattern worth looking at, whether it turns out to be a hosting company, a parked-domain service or a campaign. For background on providers, see any DNS provider overview.

DNSSEC adoption

Divide the number of names that have DS records by the total. The result is the share of signed delegations in that zone, measurable without querying a single domain, because the parent zone holds the DS records.

All of these stay inside what the data supports. They describe delegations, not people or websites, and results from a subset of TLDs should never be extrapolated to the whole namespace.

Handling zone data in practice

• Normalise first. Lower-case names, strip the trailing dot and TLD, and de-duplicate across NS lines. Names that begin with xn-- are internationalized; see IDN and punycode if you need to decode them.
• Store compactly. Keep sorted name lists for each day rather than the full file; the diff of sorted lists is cheap to compute and easy to archive.
• Validate each snapshot. Check the SOA serial and compare file size and line count with the previous day. A truncated download will otherwise show up as thousands of fake deletions.
• Respect download limits and retries. Automated clients should back off on errors, not hammer the service.
• Keep credentials private. API credentials belong in environment variables, not in repositories.

TLDlive builds its newly registered domain lists and expired and dropped domain lists from these zone diffs.

Frequently asked questions

What does a TLD zone file contain?

Mainly NS records naming the authoritative servers for each delegated second-level domain, DS records for DNSSEC-signed domains, glue address records for in-zone nameservers, and an SOA record. There is one set of records per delegation, with no registrant details.

How often is a TLD zone updated?

That depends on the registry. Registries publish zone updates on their own schedule, from frequently to once a day, and the CZDS file is a snapshot of the published zone. A daily diff therefore captures net change over a day, not every registration event.

How long does CZDS approval take?

It depends on the registry operator, because each approves or denies requests for its own TLDs. Some respond promptly, some take longer, and some deny. Plan for per-TLD differences and request only zones you will use.

Can I republish zone file data?

Do not assume so. CZDS terms restrict redistribution and set download limits. Publishing analysis derived from the data is a different matter from republishing the files, but read the current terms and ask if in doubt.

Is .com available through CZDS?

The large legacy gTLDs have generally been available through the program, subject to registry approval when you apply, but the portal is the authority. Confirm there which zones are listed and what your account's status is for each.

Why can't I get the .uk or .io zone from CZDS?

Country-code TLDs are not governed by the ICANN gTLD program, so most are absent from CZDS. Some operators offer zone access through their own agreements; ask the registry directly.