Scoring Architecture & Technical Methodology

How the Uganda DNS Observatory Evaluates Infrastructure

A transparent, reproducible, open-source scoring model designed in accordance with African and global Internet engineering best practices (IETF RFCs, ICANN/SSAC guidelines, and ISOC resilience recommendations).

1. Composite DNS Zone Health Index (0 - 100 Points)

Evaluates clean resolution, nameserver redundancy, and network latency

The DNS Health Index measures whether a domain can be resolved reliably by global and local resolving nameservers without errors, timeouts, or single points of failure.

+35 Points (Domain Resolution)

Awarded when the authoritative nameservers successfully return valid `A` (and/or `AAAA`) records without `SERVFAIL`, `NXDOMAIN`, or timeout conditions.

+25 Points (Multiple Nameservers)

Requires at least two (2) distinct authoritative nameservers (`NS`) configured for the zone to ensure basic high availability.

+20 Points (Unique Subnet Diversity)

Verifies that authoritative nameserver IP addresses do not all reside within the exact same `/24` IPv4 or `/48` IPv6 routing prefix.

+10 Points (Latency & Zero Errors)

+10 points if average resolution response time is under 150 milliseconds. +10 points if no formatting or syntax warnings exist.

2. Cryptographic Zone Security (DNSSEC Index)

RFC 4033, RFC 4034, and RFC 4035 verification of signed chains of trust

DNS Security Extensions (DNSSEC) protect Ugandan Internet users from cache poisoning and man-in-the-middle redirection attacks by cryptographically signing zone data.

DNSKEY Verification: The scanner queries authoritative nameservers specifically for `DNSKEY` resource records (`flags: 256 / 257`) to ensure zone signing keys are published.

Delegation Signer (DS) Verification: The scanner verifies that the parent `.ug` Top-Level Domain registry publishes a corresponding `DS` record, establishing an unbroken cryptographic chain of trust from the root zone down to the institutional domain.

3. Dual-Stack IPv6 Readiness Score (0 - 100%)

Assessing transition from legacy IPv4 toward next-generation Internet protocols

As global IPv4 address exhaustion accelerates, dual-stack `AAAA` adoption is essential for Uganda’s continued growth, IoT expansion, and 5G cellular rollouts.

50% Weight: Host Domain AAAA Record

Does `domain.go.ug` or `domain.co.ug` resolve to a valid IPv6 address (`2c0f:...` or `2001:...`) alongside its `A` record?

50% Weight: Nameserver IPv6 Support

Do the authoritative nameservers (`ns1.domain.ug`) themselves possess `AAAA` glue records enabling IPv6-only resolvers to query the zone?

4. Nameserver Resilience Index (0 - 100 Points)

Preventing routing blackouts, data center power outages, and BGP hijacks

A domain with multiple nameservers located in the exact same physical data center or routing subnet can experience total blackout if that single data center loses power or optical fiber connectivity.

Geographic & Routing Separation: Checking distinct Autonomous System Numbers (ASNs) and IP blocks across nameservers.
Anycast Cloud Delegation: Rewarding zones leveraging robust global Anycast networks alongside local African IXP nodes (e.g., UIXP in Kampala).
Timeout & Error Penalties: Deducting points if one nameserver responds while the secondary nameserver drops queries or lags above 300ms.

Have Questions or Want to Recommend a Domain?

Contact the Uganda DNS Forum technical committee for scan adjustments and zone inclusion.

Explore Measured Zones