Resolver coverage

The resolver turns domain names from certificates into IP addresses. Most tracked SANs resolve successfully; the remainder are test entries, typos, defunct domains, or names that no longer exist in DNS. This page shows how complete the dataset is — what fraction of tracked domains have been resolved at least once. loading…

—

Total tracked SANs —

Resolved SANs —

Waiting for first resolve —

IP addresses found —

Tombstoned SANs —

In cooldown —

Progress

Coverage = resolved ÷ tracked. One SAN can resolve to multiple IPs, so the IP count is often higher.
Tombstoned — failed permanently (NXDOMAIN, invalid name). Won't be retried unless a new certificate references them.
In cooldown — transient DNS error. Will be re-checked when the cooldown expires (1–24 h).