n26.com

15-check dossier · scoreboard above, section details below

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/n26.com/badge.svg)](https://www.domainposture.com/d/n26.com)

HTML

<a href="https://www.domainposture.com/d/n26.com"><img src="https://www.domainposture.com/d/n26.com/badge.svg" alt="Domain posture" /></a>

Scanning…

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

resolving mx…

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

resolving dmarc…

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

tracing redirects…

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

inspecting web surface…

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.

n26.com

15-check dossier · scoreboard above, section details below

Get a pack →

embed badge

Markdown

[![Domain posture](https://www.domainposture.com/d/n26.com/badge.svg)](https://www.domainposture.com/d/n26.com)

HTML

<a href="https://www.domainposture.com/d/n26.com"><img src="https://www.domainposture.com/d/n26.com/badge.svg" alt="Domain posture" /></a>

Mostly compliant · 4 items need attention

Aggregate grade across 15 checks. Auditors typically flag any High-severity finding.

Pass: 11
Warn: 4
Fail: 0

What an auditor would flag first

medium
SPF
~all softfail — receivers may still accept
SOC 2 CC6.7ISO 27001 A.8.20
low
DKIM
1/6 DKIM selectors valid
SOC 2 CC6.7
low
Security headers
2 security header(s) missing
SOC 2 CC6.6ISO 27001 A.8.23

Need this as an artifact your auditor can verify?

Your n26.com scan flagged 1 medium and 3 low findings. A signed pack covers the apex plus up to 100 CT-discovered subdomains, Ed25519-signed and ISO-timestamped, delivered in 10–30 minutes.

Get a pack →See methodology See a sample$29

Scanning…

15-check summary

DNS recordsA/AAAA records present
MX5 MX record(s) present
SPF~all softfail — receivers may still accept
DMARCp=reject — strict policy
DKIM1/6 DKIM selectors valid
TLS certificatecert valid for 100 days
Redirect chainHTTPS served correctly
Security headers2 security header(s) missing
CORSno CORS headers — cross-origin requests blocked by default
Web surfaceHTTPS surface reachable (robots ✓, sitemap ✓, title ✓)
MTA-STSnot applicable: no _mta-sts TXT record
TLS-RPTnot applicable: no TLSRPT record
DNSSECDNSSEC not configured — no DS or DNSKEY records found
WHOISdomain registered until 2026-09-16
Certificate Transparencycheck failed: crt.sh: Error: crt.sh http 429; certspotter: Error: certspotter http 429

dns

info

Open standalone →

A/AAAA records present

Why it matters: Without authoritative A or AAAA records on the apex, the domain is unreachable. Missing baseline DNS shows up in vendor reviews as evidence of unmanaged infrastructure (SOC 2 CC6.6).

A: ttl=60 3.175.86.57
ttl=60 3.175.86.102
ttl=60 3.175.86.110
ttl=60 3.175.86.125
AAAA: —
NS: ttl=172800 ns-1111.awsdns-10.org.
ttl=172800 ns-1688.awsdns-19.co.uk.
ttl=172800 ns-309.awsdns-38.com.
ttl=172800 ns-823.awsdns-38.net.
SOA: ttl=900 ns-1688.awsdns-19.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
CAA: —
TXT: ttl=300 "1password-site-verification=7LP4OAJZJRGV3OKFZJYRCGL6XQ"
ttl=300 "_0s9fu0xsjnadj6e77tcfl69tgxhf7ud"
ttl=300 "apple-domain-verification=2cknrhZSdEJUTkjg"
ttl=300 "atlassian-domain-verification=ltj2N+hAofDVKdGd7oh5+7Vf0JybM1Ee8M+75LjgV4+WnA9d6DVslVEoCmeuJyEc MS=ms38013555"
ttl=300 "docker-verification=50e8fcfe-86cb-4637-a38f-b0031d9027b6"
ttl=300 "docusign=d5e825c7-dff4-4bbb-899e-1431986cfcb1"
ttl=300 "dtm-domain-verification=ppCUmVzUEhRwekPQ-hWttL_rCQe_0Z5VPGNPnPkoazw"
ttl=300 "figma-domain-verification=87b9d8b26b7a6fbd662a75273d521b1b0b4058aca7540d0dfc620902d4fec065-1744728337"
ttl=300 "onetrust-domain-verification=bb91f2ee6f2041e3b7a6b52fb091305e"
ttl=300 "onetrust-domain-verification=f81156cafbc343f1abdca613284dfd4a"
ttl=300 "stripe-verification=09cd0f13fd719aa1c44eabe83e7dc2532bf54f78a23ac469f715c2e7992c901a"
ttl=300 "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com " "include:_spf.salesforce.com include:u1369857.wl.sendgrid.net include:mg-spf.greenhouse.io include:servers.mcsv.net include:amazonses.com " "a:mcsrel.hopexcloud.com ip4:167.89.0.0/17 ip4:168.245.0.0/17 ~all"

fetched 2026-06-17T08:33:11.222Z

dns

info

Open standalone →

resolving…

mx

info

Open standalone →

5 MX record(s) present

Why it matters: MX records direct inbound mail. Misconfiguration silently breaks email delivery and lets attackers stand up parallel MX hosts for spoofing campaigns (ISO 27001 A.8.21).

pri=1 aspmx.l.google.com.
pri=5 alt1.aspmx.l.google.com.
pri=5 alt2.aspmx.l.google.com.
pri=10 aspmx2.googlemail.com.
pri=10 aspmx3.googlemail.com.

fetched 2026-06-17T08:33:10.849Z

mx

info

Open standalone →

resolving mx…

spf

medium

Open standalone →

~all softfail — receivers may still accept

Why it matters: SPF tells receiving servers which hosts may send mail for the domain. Without it, any sender can forge the envelope-from — the primary mechanism behind business-email-compromise (SOC 2 CC6.7).

Recommendations

Move to -all (hardfail) once your mail flow is confirmed — softfail gives no real protection

v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com include:_spf.salesforce.com include:u1369857.wl.sendgrid.net include:mg-spf.greenhouse.io include:servers.mcsv.net include:amazonses.com a:mcsrel.hopexcloud.com ip4:167.89.0.0/17 ip4:168.245.0.0/17 ~all

v=spf1
include:_netblocks.google.com
include:_netblocks2.google.com
include:_netblocks3.google.com
include:_spf.salesforce.com
include:u1369857.wl.sendgrid.net
include:mg-spf.greenhouse.io
include:servers.mcsv.net
include:amazonses.com
a:mcsrel.hopexcloud.com
ip4:167.89.0.0/17
ip4:168.245.0.0/17
~all

fetched 2026-06-17T08:33:10.965Z

spf

info

Open standalone →

resolving spf…

dmarc

info

Open standalone →

p=reject — strict policy

Why it matters: DMARC binds SPF and DKIM into an enforceable policy (quarantine or reject) and surfaces spoofing attempts via aggregate reports. `p=none` or absent means spoofing succeeds silently (SOC 2 CC6.7).

v=DMARC1; p=reject; rua=mailto:[email protected],mailto:[email protected]; ruf=mailto:[email protected],mailto:[email protected]; pct=100; sp=reject; fo=1; adkim=r; aspf=r;

v=: DMARC1
p=: reject
rua=: mailto:[email protected],mailto:[email protected]
ruf=: mailto:[email protected],mailto:[email protected]
pct=: 100
sp=: reject
fo=: 1
adkim=: r
aspf=: r

fetched 2026-06-17T08:33:10.860Z

dmarc

info

Open standalone →

resolving dmarc…

dkim

low

Open standalone →

1/6 DKIM selectors valid

Why it matters: DKIM signs outbound mail so receivers can detect tampering. Missing selectors or rotated-away keys break DMARC alignment and let receivers downgrade trust (ISO 27001 A.8.24).

Recommendations

Check the missing selectors in your DNS provider and re-add any removed records

default:: —
google:: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmiNzlM11oh6hWD0wQa5voPb3J0KOfg93h/c+qMktJiknlvE1NLexK8CfQoQq/ZbUQKzMU74sJFdRZLpoWPWbss38P/ndH0+feJCtFaiZd9xvr3OA5AggUnWB8I24rtMipjO3JpocBhuRYUVmIsY3V1xlit0Zxzryr0n+wgKx/DXupcJM5wpkrvurJAGWNgYFU0WcY3aFVOy9CvTCXUUIMllU++OFjUBa/suhbHNbxi5e6E2mSVpi7zlHwFp8SYs4kwUhGnUliwkoX0VppQdEAud3MEsdzAY2a0ANq3eHx6Jz9/ygCe+G9tusIDmLQ85LSm/xOau6rbLxSgONVfXaIQIDAQAB
k1:: —
selector1:: —
selector2:: —
mxvault:: —

fetched 2026-06-17T08:33:11.109Z

dkim

info

Open standalone →

probing dkim selectors…

tls

info

Open standalone →

cert valid for 100 days

Why it matters: A valid current TLS certificate is the baseline for data in transit. Expiry, weak chain, or hostname mismatch break HTTPS and fail PCI 4.2.1 / SOC 2 CC6.1.

subject cn:: n26.com
issuer:: Amazon RSA 2048 M01 / Amazon
valid:: Mar 12 00:00:00 2026 GMT → Sep 25 23:59:59 2026 GMT
authorized:: yes
sha256:: 07:D8:3F:20:1C:6E:E0:AE:44:8F:C7:05:8C:83:53:1F:4B:92:85:36:3D:F3:E9:0B:B8:8B:6A:E5:7A:29:F1:0B
sans: n26.com
n26.se
www.number26.ch
mag-es.n26.com
www.n26.co.za
n26.co.uk
join.n26.com
n26.fr
www.n26.me
next.n26.com
number26.it
www.n26.co.uk
www.n26.it
number26.eu
mag-it.n26.com
number26.rocks
number26.nl
n26.rocks
mag-fr.n26.com
number26.de
mag-de.n26.com
www.number26.de
n26.gr
www.n26.at
mag.n26.com
n26.cl
www.n26.es
n26.kr
n26.ch
www.n26.eu
www.n26.rocks
n26.de
www.n26.fr
number26.uk
n26.co.za
n26.li
www.n26.nl
number26.ch
www.n26.se
www.number26.uk
n26.design
n26.pt
www.n26.cl
www.n26.design
www.n26.gr
www.number26.rocks
www.number26.eu
www.n26.ch
www.n26.kr
n26.me
www.number26.it
n26.at
n26.eu
n26.es
www.number26.nl
get.n26.com
www.n26.com
n26.it
number26.fr
number26.se
www.number26.se
n26.nl
www.number26.fr
www.n26.de
www.n26.pt
www.n26.li

fetched 2026-06-17T08:33:11.077Z

tls

info

Open standalone →

fetching tls cert…

redirects

info

Open standalone →

HTTPS served correctly

Why it matters: Bare HTTP requests must redirect to HTTPS without dropping the user mid-chain. Plain-text fallback or open redirects fail PCI 4.2.1 and feed phishing chains (SOC 2 CC6.6).

final status: 200 · 2 hops

[302] https://n26.com/
[200] https://n26.com/en-eu

fetched 2026-06-17T08:33:11.380Z

redirects

info

Open standalone →

tracing redirects…

headers

low

Open standalone →

2 security header(s) missing

Why it matters: Security headers — HSTS, CSP, X-Frame-Options, Referrer-Policy — defend against XSS, clickjacking, and downgrade attacks. Absent headers map directly to OWASP ASVS V14 findings (ISO 27001 A.8.23).

Recommendations

Add response header — X-Frame-Options: DENY (or SAMEORIGIN if framing is intended)
Add response header — Referrer-Policy: strict-origin-when-cross-origin

final url: https://n26.com/en-eu

security headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri /report-csp;report-to /report-csp;base-uri 'self';child-src number26://* *.n26.com n26.com *.doubleclick.net pixel.mathtag.com n26.go2cloud.org www.googletagmanager.com *.youtube-nocookie.com youtube-nocookie.com;connect-src 'self' https://spc.n26.com * https://*.logs.datadoghq.eu;font-src 'self' data:;img-src https://spc.n26.com 'self' data: images.ctfassets.net images.contentful.com * *.greenhouse.io;media-src videos.contentful.com videos.ctfassets.net n26.bynder.com;object-src 'none';style-src 'unsafe-inline' 'self' tagmanager.google.com;script-src 'self' cdn.number26.de 'unsafe-inline' * connect.facebook.net *.youtube-nocookie.com s.ytimg.com youtube-nocookie.com youtube.com boards.greenhouse.io datadoghq.eu datadoghq-browser-agent.com cdn.cookielaw.org;worker-src 'self';default-src *;frame-ancestors app.contentful.com 'self' *.n26.com;frame-src *.n26.com www.googletagmanager.com *.doubleclick.net www.youtube-nocookie.com boards.greenhouse.io job-boards.greenhouse.io
x-frame-options: —
x-content-type-options: nosniff
referrer-policy: —
permissions-policy: accelerometer=(), autoplay=(self), camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=()

other headers

age: 1654
cache-control: max-age=1, s-maxage=1800, stale-while-revalidate=1800
connection: keep-alive
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 17 Jun 2026 08:05:37 GMT
server: envoy
transfer-encoding: chunked
vary: Accept-Encoding
via: 1.1 db72ce07d5cc2e673dc69dbc37b98234.cloudfront.net (CloudFront)
x-amz-cf-id: nmh3CjIsBl7KlzLGQ1buKx2T8IFe3jzMmBBDWys4W7yJrxbfer7Y_w==
x-amz-cf-pop: MRS53-P4
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 131
x-xss-protection: 1; mode=block

fetched 2026-06-17T08:33:11.390Z

headers

info

Open standalone →

fetching headers…

cors

info

Open standalone →

no CORS headers — cross-origin requests blocked by default

Why it matters: Overly permissive CORS (wildcard with credentials, or reflected origin) lets any origin read authenticated responses from this domain. OWASP A05 misconfiguration territory (NIST AC-4).

origin: https://domainposture.com
method: GET
preflight status: 302

access-control-* headers

access-control-allow-origin: —
access-control-allow-methods: —
access-control-allow-headers: —
access-control-allow-credentials: —
access-control-max-age: —
access-control-expose-headers: —

no access-control-* headers returned — site does not advertise CORS to this origin

fetched 2026-06-17T08:33:11.269Z

cors

info

Open standalone →

sending preflight…

web-surface

info

Open standalone →

HTTPS surface reachable (robots ✓, sitemap ✓, title ✓)

Why it matters: Public files — robots.txt, sitemap.xml, head meta — are what attackers see first during reconnaissance. Misadvertised paths, stale sitemaps, and verbose generators leak more than intended (ISO 27001 A.8.9).

robots.txt

present

User-agent: *
Allow: /build/**/js/*.js$

# Bad bots
User-agent: AITCSRobot/1.1
User-agent: Alexibot
User-agent: Aqua_Products
User-agent: Arachnophilia
User-agent: ASpider/0.09
User-agent: asterias
User-agent: asterias
User-agent: AURESYS/1.0
User-agent: b2w/0.1
User-agent: BackDoorBot
User-agent: BackDoorBot/1.0
User-agent: BackRub/.
User-agent: Baiduspider-video
User-agent: Big Brother
User-agent: Bizbot003
User-agent: BizBot04 kirk.overleaf.com
User-agent: Black Hole
User-agent: Black.Hole
User-agent: BlackWidow
User-agent: BLEXBot
User-agent: BlowFish
User-agent: BlowFish/1.0
User-agent: Bookmark search tool
User-agent: Bot mailto:[email protected]
User-agent: BotALot
User-agent: BotRightHere
User-agent: BSpider/1.0 libwww-perl/0.40
User-agent: BuiltBotTough
User-agent: Bullseye
User-agent: Bullseye/1.0
User-agent: BunnySlippers
User-agent: CACTVS Chemistry Spider
User-agent: Cegbfeieh
User-agent: ChangeDetection
User-agent: Checkbot/x.xx LWP/5.x
User-agent: CheeseBot
User-agent: CherryPicker
User-agent: CherryPickerElite/1.0
User-agent: CherryPickerSE/1.0
User-agent: ChinaClaw
User-agent: combine/0.0
User-agent: conceptbot/0.3
User-agent: Copernic
User-agent: CopyRightCheck
User-agent: cosmos
User-agent: Crescent
User-agent: Crescent Internet ToolPak HTTP OLE Control v.1.0
User-agent: Custo
User-agent: CyberPatrol SiteCat Webbot
User-agent: CyberSpyder/2.1
User-agent: Daumoa
User-agent: Deweb/1.01
User-agent: DISCo
User-agent: DISCo Pump 3.0
User-agent: DISCo Pump 3.2
User-agent: DISCoFinder
User-agent: DittoSpyder
User-agent: Download Demon
User-agent: Download Demon/3.2.0.8
User-agent: Download Demon/3.5.0.11
User-agent: dumbot
User-agent: eCatch
User-agent: eCatch/3.0
User-agent: EirGrabber
User-agent: EmailCollector
User-agent: EmailSiphon
User-agent: EmailWolf
User-agent: EnigmaBot
User-agent: EroCrawler
User-agent: es
User-agent: explorersearch
User-agent: Express WebPictures
User-agent: Express WebPictures (www.express-soft.com)
User-agent: ExtractorPro
User-agent: EyeNetIE
User-agent: FairAd Client
User-agent: FelixIDE/1.0
User-agent: fido/0.9 Harvest/1.4.pl2
User-agent: Fish-Search-Robot
User-agent: Flaming AttackBot
User-agent: FlashGet
User-agent: FlashGet WebWasher 3.2
User-agent: Foobot
User-agent: Freecrawl
User-agent: FrontPage
User-agent: FrontPage [NC,OR]
User-agent: Gaisbot
User-agent: gcreep/1.0
User-agent: GetRight
User-agent: GetRight/2.11
User-agent: GetRight/3.1
User-agent: GetRight/3.2
User-agent: GetRight/3.3
User-agent: GetRight/3.3.3
User-agent: GetRight/3.3.4
User-agent: GetRight/4.0.0
User-agent: GetRight/4.1.0
User-agent: GetRight/4.1.1
User-agent: GetRight/4.1.2
User-agent: GetRight/4.2
User-agent: GetRight/4.2b (Portuguxeas)
User-agent: GetRight/4.2c
User-agent: GetRight/4.3
User-agent: GetRight/4.5
User-agent: GetRight/4.5a
User-agent: GetRight/4.5b
User-agent: GetRight/4.5b1
User-agent: GetRight/4.5b2
User-agent: GetRight/4.5b3
User-agent: GetRight/4.5b6
User-agent: GetRight/4.5b7
User-agent: GetRight/4.5c
User-agent: GetRight/4.5d
User-agent: GetRight/4.5e
User-agent: GetRight/5.0beta1
User-agent: GetRight/5.0beta2
User-agent: GetURL.rexx v1.05
User-agent: GetWeb!
User-agent: Go!Zilla
User-agent: Go!Zilla (www.gozilla.com)
User-agent: Go!Zilla 3.3 (www.gozilla.com)
User-agent: Go!Zilla 3.5 (www.gozilla.com)
User-agent: Go-Ahead-Got-It
User-agent: Golem/1.1
User-agent: GrabNet
User-agent: Grafula
User-agent: Gromit/1.0
User-agent: grub
User-agent: HappyFunBot
User-agent: Harvest
User-agent: Harvest/1.5
User-agent: Hatena Antenna
User-agent: Hazel's Ferret Web hopper
User-agent: hloader
User-agent: HMView
User-agent: httplib
User-agent: HTTrack
User-agent: HTTrack 3.0
User-agent: HTTrack [NC,OR]
User-agent: Huaweisymantecspider
User-agent: humanlinks
User-agent: Hâ€°mâ€°hâ€°kki/0.2
User-agent: Image Stripper
User-agent: Image Sucker
User-agent: inagist.com url crawler
User-agent: IncyWincy/1.0b1
User-agent: Indy Library
User-agent: Indy Library [NC,OR]
User-agent: InfoNaviRobot
User-agent: Informant
User-agent: INGRID/0.1
User-agent: InterGET
User-agent: Internet Ninja
User-agent: I

sitemap.xml

present — 7 url(s)

head

title: Love your bank | Spend, save, and invest in one app
description: N26 is the first bank you'll love. Beautifully simple, 100% mobile, and trusted by millions. Open your free bank account in minutes.

social

og:type: website
og:title: Love your bank | N26 Bank
og:description: N26 is the first bank you'll love. Beautifully simple, 100% mobile, and trusted by millions. Open your free bank account in minutes.
og:image: https://n26.com/og-image-n26.png
og:url: https://n26.com/en-eu

fetched 2026-06-17T08:33:11.413Z

web-surface

info

Open standalone →

inspecting web surface…

dnssec

low

Open standalone →

DNSSEC not configured — no DS or DNSKEY records found

Why it matters: DNSSEC cryptographically signs DNS responses, blocking cache-poisoning attacks. US federal civilian agencies are required to enable it under OMB M-22-09 (NIST SC-20).

Recommendations

Enable DNSSEC in your DNS provider's control panel and add the resulting DS record at your registrar

enabled: no
DS records: —
DNSKEY records: —

fetched 2026-06-17T08:33:10.923Z

dnssec

info

Open standalone →

checking dnssec…

mta-sts

info

Open standalone →

not applicable: no _mta-sts TXT record

Why it matters: MTA-STS forces inbound SMTP to use TLS and refuse downgraded connections. Without it, an in-path attacker can strip TLS and read mail in plaintext (SOC 2 CC6.7).

no _mta-sts TXT record

mta-sts

info

Open standalone →

checking mta-sts…

tls-rpt

info

Open standalone →

not applicable: no TLSRPT record

Why it matters: TLS-RPT publishes a reporting address for SMTP-TLS failures. Without it, downgrade attacks on inbound mail go unnoticed (SOC 2 CC7.2).

no TLSRPT record

tls-rpt

info

Open standalone →

checking tls-rpt…

whois

info

Open standalone →

domain registered until 2026-09-16

Why it matters: Registrar and expiry tell auditors the domain is owned, current, and not about to lapse. An expired or about-to-expire domain fails business-continuity evidence (SOC 2 A1.2).

registrar: Amazon Registrar, Inc.
created: 2005-09-16T18:32:45Z
expires: 2026-09-16T18:32:45Z
statuses: clientTransferProhibited https://icann.org/epp#clientTransferProhibited

fetched 2026-06-17T08:33:12.971Z

whois

info

Open standalone →

resolving whois…

ct-log

info

Open standalone →

check failed: crt.sh: Error: crt.sh http 429; certspotter: TypeError: fetch failed

Why it matters: Every certificate issued for this domain is published in Certificate Transparency logs — including subdomains you may have forgotten. Unknown subdomains in CT are pre-disclosed attack surface (ISO 27001 A.8.16).

crt.sh: Error: crt.sh http 429; certspotter: TypeError: fetch failed

ct-log

info

Open standalone →

querying CT logs…

additional context — IP + user-agent lookups

lookups that complement a dossier — useful when investigating a finding, but not part of the dossier engine itself.

IP lookup — geolocation, ASN, ISP for any IP address surfaced by the DNS or redirect sections.
user-agent parser — the browser/OS/device the request came from.
single-record DNS lookup — drill into one record type at a time.