Product guide
Zone Analyzer Guide
Zone Analyzer parses DNS zone exports locally and presents them in a structured grid for inspection, filtering, and lightweight validation. It is built for fast review of large record sets without requiring you to upload the zone elsewhere first.
The short answer
Use Zone Analyzer when you already have a zone export and want to sort, filter, inspect, and verify records locally in the browser.
Start here for internal DNS hygiene reviews, large zone audits, duplicate hunting, and quick web-facing record verification before or after a change window.
Upload and parsing workflow
The tool accepts drag-and-drop uploads or toolbar-based file selection. It reads line-oriented zone exports with one complete record per line, an explicit owner name on each line, and a numeric TTL, as written by BlueCat, Infoblox, BIND, NSD, Knot and PowerDNS zone dumps. The parser does not apply $ORIGIN or $TTL directives, does not carry an owner name over to lines that leave it out, and does not join parenthesized records that span several lines, such as a hand-written SOA. Records written that way can be skipped or shown with the wrong type, so export the zone in a one-record-per-line form first. See technical details.
- Reads the export file in your browser, up to 50 MB. The file itself is never uploaded.
- Parses the zone into a grid so records can be inspected row by row.
- Opens on a sample zone for Example County, a fictional public-sector organization, so every filter and tool has records to act on. The sample uses reserved example domains and documentation IP ranges, and you can download it to see the expected file format.
- Replaces the sample as soon as you load your own export. The More actions menu reopens the sample, replays the tips, exports visible rows as CSV, or closes the zone.
- Shows two short tips the first time you open the tool: right-click a hostname for DNS tools, and tick rows to run Verify selected.
Core features
| Feature | What it does | Why it matters |
|---|---|---|
| Filters | Builds custom rules by zone, type, hostname, or data | Lets you narrow large exports into focused review slices. |
| Quick pills | Toggles SOA and NS noise, PTR records, or web-facing records | Speeds up common triage patterns with one click. |
| Export CSV | Downloads the currently filtered records | Makes it easier to share only the rows that matter. |
| Visual verification | Opens screenshots only for explicitly checked A, AAAA, and CNAME rows | Prevents accidentally sending huge batches for web preview. |
How filtering is meant to be used
The filtering model is designed for iterative narrowing rather than a single static query. You can stack custom rules, use quick pills for common record classes, then export only the current view once you have isolated the rows that need follow-up.
This is especially useful when a single zone contains many operationally unrelated records and you only want the subset tied to web, mail, reverse DNS, or one hostname family.
Visual verification guard rails
Visual verification is intentionally limited. It opens screenshots of web pages only for specifically checked A, AAAA, and CNAME rows. That constraint exists to prevent the tool from accidentally submitting very large batches and to keep the action tied to clearly chosen web-facing records.
If you need preview or redirect checks, first narrow the grid and select only the rows you actually want to verify. Broad selection defeats the safety intent of the workflow.
What stays in your browser and what leaves it
Parsing, filtering, sorting and CSV export all happen in the page, so the zone file and its records stay on your computer. Three actions send data elsewhere, and each only runs when you choose it:
| Action | What is sent | Where |
|---|---|---|
| Visual Verification | The hostnames of the rows you ticked | DNS Panopticon's server, which loads each site in Cloudflare Browser Rendering for a screenshot |
| HTTP Status Code Verification | The hostnames of the rows you ticked | DNS Panopticon's server, which requests each site and follows redirects |
| Right-click DNS tools | The hostname or domain you right-clicked | The third-party site you pick from the menu, such as DNSViz, which opens in a new tab |
Only hostnames leave the browser for these actions, never record data or the rest of the file. The Zone Analyzer technical details cover caching and limits for each one.
When to use Zone Analyzer instead of Domain Visualizer
Choose Zone Analyzer when you have local zone data and want direct control over filtering and export. Choose Domain Visualizer for public-DNS records and a graph, or Security Posture for grades and remediation findings. Check the saved scan timestamp and Cached badge; a scan may be served from cache.
FAQ
Does Zone Analyzer require a live DNS lookup?
No. It is designed around parsing a provided zone export rather than fetching public DNS data for a domain.
Why are preview actions limited to selected A, AAAA, and CNAME rows?
Because those rows are the most likely to map to web-facing destinations, and requiring explicit selection prevents oversized accidental submissions.
Can I export just the filtered subset?
Yes. The CSV export uses the records currently visible after filtering, not the full original dataset by default.
Where can I review parser and pipeline internals?
See the Zone Analyzer technical details reference for the ingest, normalization, and analysis pipeline.