{"selection_policy":"Cache first, then primary provider; fall back only on timeout, rate limit, malformed response or service failure","quota_policy":"DNSTrace.dev does not rotate providers to bypass quotas or access terms","consistency_policy":"A successful response stays attributed to the provider that produced it; authoritative and measurement sources are not mixed as interchangeable facts","providers":[{"id":"cloudflare-doh","name":"Cloudflare 1.1.1.1","capabilities":["dns"],"role":"primary","endpoint":"https://cloudflare-dns.com/dns-query","documentation":"https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/","access":"Public DNS-over-HTTPS endpoint; no authentication","runtime":"active"},{"id":"google-doh","name":"Google Public DNS","capabilities":["dns"],"role":"fallback","endpoint":"https://dns.google/resolve","documentation":"https://developers.google.com/speed/public-dns/docs/doh","access":"Public DNS-over-HTTPS endpoint; no authentication","runtime":"active"},{"id":"rdap-org","name":"RDAP.org","capabilities":["rdap"],"role":"primary","endpoint":"https://rdap.org/","documentation":"https://about.rdap.org/","access":"Public RDAP bootstrap service","runtime":"active"},{"id":"iana-rdap-bootstrap","name":"IANA RDAP Bootstrap Registries","capabilities":["rdap"],"role":"authoritative-discovery","endpoint":"https://data.iana.org/rdap/","documentation":"https://www.iana.org/assignments/rdap-dns","access":"Public bootstrap registries defined for RDAP discovery","runtime":"active"},{"id":"ripestat","name":"RIPEstat","capabilities":["routing","rpki","abuse"],"role":"primary","endpoint":"https://stat.ripe.net/data/","documentation":"https://stat.ripe.net/docs/data-api/ripestat-data-api","access":"Public API; regular usage above 1,000 requests/day should be registered with RIPE NCC","runtime":"active"},{"id":"cloudflare-ip-ranges","name":"Cloudflare Published IP Ranges","capabilities":["routing"],"role":"authoritative-discovery","endpoint":"https://api.cloudflare.com/client/v4/ips","documentation":"https://developers.cloudflare.com/api/resources/ips/methods/list/","access":"Cloudflare-published anycast range list; refreshed daily through the Worker cache","runtime":"active"},{"id":"ipapi","name":"ipapi","capabilities":["ip-geolocation"],"role":"primary","endpoint":"https://ipapi.co/","documentation":"https://ipapi.co/api/","access":"Public trial fields; provider plans and quotas apply","runtime":"active"},{"id":"ipwhois","name":"ipwho.is","capabilities":["ip-geolocation"],"role":"fallback","endpoint":"https://ipwho.is/","documentation":"https://ipwhois.io/documentation","access":"Public endpoint; provider usage policy applies","runtime":"active"},{"id":"freeipapi","name":"FreeIPAPI","capabilities":["ip-geolocation"],"role":"fallback","endpoint":"https://free.freeipapi.com/api/json/","documentation":"https://freeipapi.com/docs/api-reference/api-introduction","access":"Public free endpoint; 60 requests/minute on the documented free plan","runtime":"active"},{"id":"globalping","name":"Globalping","capabilities":["global-dns","global-network"],"role":"primary","endpoint":"https://api.globalping.io/v1/","documentation":"https://globalping.io/docs/api.globalping.io","access":"Shared public measurement capacity; polling and credit limits apply","runtime":"active"},{"id":"ripe-atlas","name":"RIPE Atlas","capabilities":["global-dns"],"role":"optional","endpoint":"https://atlas.ripe.net/api/v2/","documentation":"https://atlas.ripe.net/docs/apis/rest-api-manual/","access":"Requires a RIPE Atlas account, API key and measurement credits","runtime":"available with credentials"},{"id":"crtsh","name":"crt.sh","capabilities":["certificate-transparency","subdomain-discovery"],"role":"primary","endpoint":"https://crt.sh/","documentation":"https://crt.sh/","access":"Public certificate-transparency search; service availability and fair-use limits apply","runtime":"active"},{"id":"certspotter","name":"Cert Spotter","capabilities":["certificate-transparency","subdomain-discovery"],"role":"optional","endpoint":"https://api.certspotter.com/v1/issuances","documentation":"https://sslmate.com/help/reference/ct_search_api_v1","access":"Unauthenticated queries are limited to personal or evaluation use; production requires an account","runtime":"available with credentials"},{"id":"google-favicon","name":"Google S2 Favicons","capabilities":["favicon"],"role":"primary","endpoint":"https://www.google.com/s2/favicons","documentation":"https://www.google.com/s2/favicons","access":"Best-effort public image endpoint with a local generated fallback","runtime":"active"},{"id":"networkcalc","name":"NetworkCalc","capabilities":["live-tls"],"role":"primary","endpoint":"https://networkcalc.com/api/security/certificate/","documentation":"https://networkcalc.com/api/docs/security/","access":"Public live TLS certificate endpoint; no authentication","runtime":"active"},{"id":"cloudflare-request-context","name":"Cloudflare Request Context","capabilities":["visitor-network"],"role":"first-party","endpoint":null,"documentation":"https://developers.cloudflare.com/workers/runtime-apis/request/#incomingrequestcfproperties","access":"Provided directly to the Worker for the current request","runtime":"active"},{"id":"apple-private-relay-ranges","name":"Apple Private Relay Egress Ranges","capabilities":["visitor-network"],"role":"authoritative-discovery","endpoint":"https://mask-api.icloud.com/egress-ip-ranges.csv","documentation":"https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay","access":"Apple-published egress range list; refreshed daily through the Worker cache","runtime":"active"},{"id":"ipify-ipv4","name":"ipify IPv4","capabilities":["visitor-network"],"role":"primary","endpoint":"https://api4.ipify.org/","documentation":"https://www.ipify.org/","access":"Browser-requested IPv4-only address endpoint; service policy and availability apply","runtime":"active"},{"id":"icanhazip-ipv4","name":"icanhazip IPv4","capabilities":["visitor-network"],"role":"fallback","endpoint":"https://ipv4.icanhazip.com/","documentation":"https://major.io/p/a-new-future-for-icanhazip/","access":"Best-effort browser fallback when the primary IPv4-only endpoint is unavailable","runtime":"active"},{"id":"direct-authoritative","name":"Direct Authoritative Nameserver Queries","capabilities":["authoritative-dns"],"role":"first-party","endpoint":null,"documentation":"https://dnstrace.dev/methodology","access":"DNS queries over TCP port 53 from the Worker to each delegated nameserver; no recursive resolver in between","runtime":"active"},{"id":"direct-target","name":"Direct Target Measurement","capabilities":["live-http"],"role":"first-party","endpoint":null,"documentation":"https://dnstrace.dev/methodology","access":"Live HTTPS request from the serving Worker location","runtime":"active"}]}