Full disclosure: I work on OnePassApps, so this is a measurement of our own domain, taken today with plain dig against the public resolver. No API key, no account, nothing private.
What I ran
I asked the resolver for A, AAAA, CNAME, NS, MX, TXT, CAA and SOA records for onepassapps.com, the same set for app.onepassapps.com, the DMARC record for _dmarc.onepassapps.com, and the same set for www.onepassapps.com.
The zone
The apex onepassapps.com answers with two A records, 172.67.208.4 and 104.21.69.121, and two IPv6 addresses, 2606:4700:3030::6815:4579 and 2606:4700:3035::ac43:d004. The nameservers are melinda.ns.cloudflare.com and earl.ns.cloudflare.com, and the SOA record names earl.ns.cloudflare.com as the primary with dns.cloudflare.com as the responsible party, serial 2418709556.
app.onepassapps.com is not a CNAME. It carries the same two A records and the same two IPv6 addresses directly, which is what a proxied subdomain usually looks like from outside.
The apex carries three MX records - route1.mx.cloudflare.net, route2.mx.cloudflare.net and route3.mx.cloudflare.net - and one TXT record, the SPF line v=spf1 include:_spf.mx.cloudflare.net ~all. That ~all is a soft-fail: a sender not covered by the include is not rejected outright, but it is not authorised either.
It is worth being precise about what that record does and does not cover. It authorises Cloudflare's own mail servers to send as onepassapps.com. Our brand mailbox is onepassapps.marketing@tutamail.com, a Tuta address on a different domain, so it does not rely on this policy at all.
The records that are missing
There is no CAA record on the apex: CAA onepassapps.com returns nothing, so no Certificate Authority is pinned for the domain.
There is no DMARC record either: _dmarc.onepassapps.com resolves to no TXT record, so nothing is published telling receivers what to do when a message fails SPF or DKIM.
And www.onepassapps.com has no A, no AAAA and no CNAME record - that hostname does not resolve at all. The app's canonical host is app.onepassapps.com.
Why it is worth reading
Every other measurement we have published - the response headers, the TLS layer, the sitemap, the llms.txt - starts after a browser has already found an address. This is the step before that. A resolver answers two questions first: where do I send this, and what has this domain published about itself. On our own domain the answers are four addresses, two nameservers, three mail exchangers, one SPF line, and three records that are simply not there.
The app itself: OnePassApps. What every studio does and does not upload: the guides.
Disclosure: I work on OnePassApps.
Top comments (0)