Initializing diagnostics...

⚡ Live Data: Report generated fresh from authoritative registries. 🔄 Force Refresh
🤖 AI Intelligence Summary

The domain cloudflare.com is registered with Cloudflare, Inc., first registered on 2009-02-17 and expires on 2033-02-17 (domain age: 17 years, 7 months). It resolves to IP address 104.16.132.229, hosted by Cloudflare, Inc.. Email delivery is handled by Self-hosted or Custom. SPF authentication is published and valid. DMARC policy is published. Web traffic is secured with an SSL certificate issued by WE1.

Domain Overview: cloudflare.com

Domain Registration 🌐
Active 17 years, 7 months

Expires in 6 years, 4 months, 22 days · DNSSEC: Signed

Email Security 🛡️
SPF: Pass DKIM: Detected DMARC: Reject

Self-hosted or Custom (4 MX)

SSL Certificate 🔒
Valid Chain 70 Days Left

Issuer: WE1 (5 SANs)

Server & Hosting 🖥️
200 cloudflare

Toronto, Ontario, Canada (CA)

🌐 Domain & Registration Identity View Full Whois Details →

Domaincloudflare.com
Website TitleFavicon Cloudflare: Build for the agent era
Registered2009-02-17
Expires2033-02-17
Remaining Validity6 years, 4 months, 22 days
Domain Age17 years, 7 months
RegistrarCloudflare, Inc.
Domain Statusclient delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited i
DNSSEC Delegation Signed · Cryptographically signed DNS zone i
Authoritative Nameservers ns4.cloudflare.com, ns3.cloudflare.com, ns6.cloudflare.com, ns7.cloudflare.com, ns5.cloudflare.com i

🛡️ Email Security & Deliverability (SPF, DKIM, DMARC) View Complete Email Security Diagnostics →

Detected Email Provider 📬 Self-hosted or Custom
Primary Mail Server (MX) mxa-canary.global.inbound.cf-emailsecurity.net (Priority: 5) · 4 MX servers configured i
SPF Record (Sender Policy) Pass · 6/10 DNS Lookups · Policy: -all i
v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all
DKIM Authentication Detected · Discovered: Twilio SendGrid (Key 1) (s1), Mailchimp (Key 1) (k1), Mandrill (mandrill) i
DMARC Policy Pass (Reject) · Subdomain Policy: sp=reject · Reports: mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com i
v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100; rua=mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com
SMTP Port 25 Status Online (14ms) · Inbound mail server handshake response

🖥️ Web Server, Hosting & Network View Full Server & Tech Details →

Web Server Software cloudflare i
HTTP Status Code 200 i
Server IP (IPv4) 104.16.132.229 View Geo Details →
IPv6 Address (AAAA) 2606:4700::6810:85e5
Reverse DNS (PTR) None Detected (No PTR Record)
Server Location 📍 Toronto, Ontario, Canada (CA)
ASN Network & ISP AS13335 (Cloudflare, Inc.)
Hosting Provider Cloudflare, Inc. i
Control Panel Not Detected i
Technology Stack Cloudflare Google Tag Manager
HTTP Security Headers 6 / 6 Active (HSTS, CSP, X-Frame, X-Content, Referrer-Policy, Permissions-Policy) Audit Details →
DNSBL Blacklist Reputation Clean (0/5 lists)

🔒 SSL/TLS Certificate Summary View Full SSL Certificate & Chain →

Primary Hostname (CN) cloudflare.com · Multi-Domain SAN (Covers 5 hostnames)
SSL IssuerWE1
SSL Valid Till2026-12-05
Remaining Validity70 Days
Chain Status Valid Trusted Chain
Signature Algorithmecdsa-with-SHA256

Whois Ownership & Registration for cloudflare.com

📄 View Raw Registry Response ↓

Domain Information i

Domain NameCLOUDFLARE.COM
Registration Date2009-02-17 22:07:54 Z
Expiration Date2033-02-17 22:07:54 Z
Last Changed Date2024-01-09 16:45:28 Z

Domain Status i

  • client delete prohibited
  • client transfer prohibited
  • client update prohibited
  • server delete prohibited
  • server transfer prohibited
  • server update prohibited

Registrar Information i

NameCloudflare, Inc.
Abuse Emailregistrar-abuse@cloudflare.com

Registrant Contact i

Contact information for this role is not provided or redacted.

Administrative Contact i

Contact information for this role is not provided or redacted.

Technical Contact i

Contact information for this role is not provided or redacted.

Nameservers i

  • NS3.CLOUDFLARE.COM
  • NS4.CLOUDFLARE.COM
  • NS5.CLOUDFLARE.COM
  • NS6.CLOUDFLARE.COM
  • NS7.CLOUDFLARE.COM
📄 View Raw Registry Response RDAP (Hybrid)
Domain Name: CLOUDFLARE.COM
   Registry Domain ID: 1542998887_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.cloudflare.com
   Registrar URL: http://www.cloudflare.com
   Updated Date: 2024-01-09T16:45:28Z
   Creation Date: 2009-02-17T22:07:54Z
   Registry Expiry Date: 2033-02-17T22:07:54Z
   Registrar: Cloudflare, Inc.
   Registrar IANA ID: 1910
   Registrar Abuse Contact Email: registrar-abuse@cloudflare.com
   Registrar Abuse Contact Phone: +1.6503198930
   Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
   Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
   Domain Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited
   Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
   Domain Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited
   Name Server: NS3.CLOUDFLARE.COM
   Name Server: NS4.CLOUDFLARE.COM
   Name Server: NS5.CLOUDFLARE.COM
   Name Server: NS6.CLOUDFLARE.COM
   Name Server: NS7.CLOUDFLARE.COM
   DNSSEC: signedDelegation
   DNSSEC DS Data: 2371 13 2 32996839A6D808AFE3EB4A795A0E6A7A39A76FC52FF228B22B76F6D63826F2B9
   URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2026-09-25T14:59:35Z <<<

For more information on Whois status codes, please visit https://icann.org/epp

NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar.  Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services' ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability.  VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time.

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.

DNS Records for cloudflare.com

NS Records i

NameDataCopy
cloudflare.com. ns4.cloudflare.com.
cloudflare.com. ns3.cloudflare.com.
cloudflare.com. ns6.cloudflare.com.
cloudflare.com. ns7.cloudflare.com.
cloudflare.com. ns5.cloudflare.com.

A Records i

NameDataCopy
cloudflare.com. 104.16.132.229
cloudflare.com. 104.16.133.229

AAAA Records i

NameDataCopy
cloudflare.com. 2606:4700::6810:85e5
cloudflare.com. 2606:4700::6810:84e5

WWW Records (www.cloudflare.com) i

TypeHostValueCopy
A www.cloudflare.com. 104.16.123.96
A www.cloudflare.com. 104.16.124.96

MX Records i

PriorityMail Server TargetCopy
10 mxb.global.inbound.cf-emailsecurity.net.
5 mxa-canary.global.inbound.cf-emailsecurity.net.
10 mxa.global.inbound.cf-emailsecurity.net.
5 mxb-canary.global.inbound.cf-emailsecurity.net.

TXT Records i

NameValueCopy
cloudflare.com. DirectFedAuthUrl=https://cloudflare-security.cloudflareaccess.com/cdn-cgi/access/sso/saml/dba6756ad312fc13c45f705cf7f5e87f4d658be016c41f950329aa4085b3abc1
cloudflare.com. canva-site-verification=oOyaVnHC-OiFoR1BPvetNA
cloudflare.com. creatopy-domain-verification=97d2ca50-9b6f-4a21-9bdb-fbb630e4cec7
cloudflare.com. facebook-domain-verification=h9mm6zopj6p2po54woa16m5bskm6oo
cloudflare.com. stripe-verification=5096d01ff2cf194285dd51cae18f24fa9c26dc928cebac3636d462b4c6925623
cloudflare.com. docker-verification=c578e21c-34fb-4474-9b90-d55ee4cba10c
cloudflare.com. _wkjc0fot0d7qrvrdt78bxkj2e2o67d2
cloudflare.com. miro-verification=bdd7dfa0a49adfb43ad6ddfaf797633246c07356
cloudflare.com. jamf-site-verification=c-eUvHBbhgFxMulFSY-QJQ
cloudflare.com. uber-domain-verification=58086039-150a-42a4-a4be-b4032921aa0f
cloudflare.com. liveramp-site-verification=EhH1MqgwbndTWl1AN64hOTKz7hc1s80yUpchLbgpfY0
cloudflare.com. cisco-ci-domain-verification=27e926884619804ef987ae4aa1c4168f6b152ada84f4c8bfc74eb2bd2912ad72
cloudflare.com. databank-domain-verification-hkehd2=fzgu4kmbZwMoW99zENgO4u8NL
cloudflare.com. MS=ms70274184
cloudflare.com. onetrust-domain-verification=bd5cd08a1e9644799fdb98ed7d60c9cb
cloudflare.com. apple-domain-verification=DNnWJoArJobFJKhJ
cloudflare.com. google-site-verification=C7thfNeXVahkVhniiqTI1iSVnElKR_kBBtnEHkeGDlo
cloudflare.com. DirectFedAuthUrl=https://cloudflare-security.cloudflareaccess.com/cdn-cgi/access/sso/saml/ebec933773c69c93420d13e6776adb8c4a190f6281f9d132bcebd7dcb0967bdd
cloudflare.com. drift-domain-verification=f037808a26ae8b25bc13b1f1f2b4c3e0f78c03e67f24cefdd4ec520efa8e719f
cloudflare.com. _saml-domain-challenge.2dc00405-79cd-457b-b288-a119c6f0c7b7.71996d53-d178-4ba9-bef4-7f7e46edab74.cloudflare.com=1c8736fd-84b2-4197-985f-3fb2852f2457
cloudflare.com. atlassian-domain-verification=WxxKyN9aLnjEsoOjUYI6T0bb5vcqmKzaIkC9Rx2QkNb751G3LL/cus8/ZDOgh8xB
cloudflare.com. _neqmkgaq1lq9it5s8qmetrhbnu121wb
cloudflare.com. stripe-verification=bf1a94e6b16ace2502a4a7fff574a25c8a45291054960c883c59be39d1788db9
cloudflare.com. logmein-verification-code=b3433c86-3823-4808-8a7e-58042469f654
cloudflare.com. google-site-verification=ZdlQZLBBAPkxeFTCM1rpiB_ibtGff_JF5KllNKwDR9I
cloudflare.com. asv=894f6d1f9f83bcf44e4b1bc40bc1c4aa
cloudflare.com. status-page-domain-verification=r14frwljwbxs
cloudflare.com. v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all
cloudflare.com. ZOOM_verify_7LFBvOO9SIigypFG2xRlMA

Email Security (MX, SPF, DKIM, DMARC, SMTP) for cloudflare.com

Detected Email Provider
📬 Self-hosted or Custom
✓ Active MX Routing (4 Servers)

Mail Exchange (MX) Routing Records i

Priority Mail Server Hostname Copy
5 mxa-canary.global.inbound.cf-emailsecurity.net
5 mxb-canary.global.inbound.cf-emailsecurity.net
10 mxb.global.inbound.cf-emailsecurity.net
10 mxa.global.inbound.cf-emailsecurity.net

SPF Record Validation i

v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all

Record Breakdown

PrefixMechanismValueDescription
+ v spf1 The SPF record version.
+ ip4 199.15.212.0/22 Match if the IP is in the given IPv4 range.
+ ip4 173.245.48.0/20 Match if the IP is in the given IPv4 range.
+ include _spf.google.com The specified domain is searched for a match.
+ include spf1.mcsv.net The specified domain is searched for a match.
+ include spf.mandrillapp.com The specified domain is searched for a match.
+ include mail.zendesk.com The specified domain is searched for a match.
+ include stspg-customer.com The specified domain is searched for a match.
+ include _spf.salesforce.com The specified domain is searched for a match.
- all Always matches. This should be the last mechanism.

Validation Summary

SPF Record Published Pass An SPF record was found.
Multiple SPF Records Pass Only one SPF record was found.
Included Lookups Pass The number of DNS lookups (6) is within the limit of 10.
Type PTR Check Pass The deprecated PTR mechanism was not found.
Characters After ALL Pass No mechanisms were found after the "all" mechanism.

Common DKIM Selectors i

Twilio SendGrid (Key 1) (s1)

NameDataCopy
s1._domainkey.cloudflare.com.s1.domainkey.u5338572.wl073.sendgrid.net.
s1.domainkey.u5338572.wl073.sendgrid.net.k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1m74n5R+xcz+ICbNBWRIlQeHI65Hjp67+P59XSe71jItafrcJ4/5y/UvU+uNg7KNeOcEsotGo7QvLN87hqZSZqfzVyyGnQuEUXoKPdKokD6Pa5KmJSqbA5Y/f977HpikU9Xtd7Orc7ctRLK6H5QFvGwRi+oC9NRkgNB55UUnLbbkKK+LGeTw4Ghmr5gupw7iYzFXZ1qlFNqV6s9Pmgb+b7oDv+OfQxB/MJyUzQ5eWdKlJWfmW3s77J3fHFfysUbKKUBxEXPxNiMFRG1ClllZ4+AYRh1jrFpjbvZ5j43kqahKXeHDNkF+Gpptd7ufWIevAPTQDSVdKB9vyJQN6wfcQQIDAQAB

Mailchimp (Key 1) (k1)

NameDataCopy
k1._domainkey.cloudflare.com.dkim.mcsv.net.
dkim.mcsv.net.k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNofhBVR+e6WHUoNyIR4Bn84LVcfZE20rmDeXQblIupNWBqLXM1Q+VieI/eZu/7k9/vOkLSaQQdml4Cv8lb3PcnluMVIhQIDAQAB;

Mandrill (mandrill)

NameDataCopy
mandrill._domainkey.cloudflare.com.v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrLHiExVd55zd/IQ/J/mRwSRMAocV/hMB3jXwaHH36d9NaVynQFYV8NaWi69c1veUtRzGt7yAioXqLj7Z4TeEUoOLgrKsn8YnckGs9i3B3tVFB+Ch/4mPhXWiNfNdynHWBcPcbJ8kjEQ2U8y78dHZj1YeRXXVvWob2OaKynO8/lQIDAQAB

🔍 Query Custom DKIM Selector

Live DNS Lookup

Using a custom or date-based selector (e.g. crm, newsletter, 2024)? Query its public key live on cloudflare.com:

DMARC Policy Validation i

v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100; rua=mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com

Tag Breakdown

TagValueDescription
v DMARC1 Version: Must be "DMARC1".
p reject Policy: The action to take for failed emails (none, quarantine, reject).
sp reject Subdomain Policy: The policy for subdomains (none, quarantine, reject).
adkim r DKIM Alignment: Specifies strict (s) or relaxed (r) alignment for DKIM.
aspf r SPF Alignment: Specifies strict (s) or relaxed (r) alignment for SPF.
pct 100 Percentage: The percentage of emails to apply the policy to.
rua mailto:a1c47f179bc04efd8ee4dcd4d85dfc65@dmarc-reports.cloudflare.net,mailto:rua@cloudflare.com Aggregate Reports: Email address(es) to send summary reports.

Validation Summary

DMARC Record Published Pass A DMARC record was found.
Syntax Check Pass The record has a valid version tag.
Policy Enforcement Pass The policy is "p=reject", which provides the strongest protection against spoofing.
Aggregate Reporting Pass An address for aggregate reports was found.

SMTP Connectivity Test (Port 25)

Mail ServerStatusLatencyBanner / Handshake Response
mxa-canary.global.inbound.cf-emailsecurity.net Success 14ms 220 mxa-canary.us.inbound.cf-emailsecurity.net ESMTP Postfix

Server IP Blacklist Check (104.16.132.229)

  • Spamhaus ZEN: Clean
  • SpamCop: Clean
  • Barracuda: Clean
  • GBUdb Truncate: Clean
  • DroneBL: Clean
  • SSL/TLS Certificate Details for cloudflare.com

    • Issuer: WE1
    • Expires In: 70 Days
    • Chain Status: Valid Chain

    🔒 SSL / TLS Protocol Support

    Warning
    TLS protocol versions
    TLS 1.3 Enabled
    TLS 1.2 Enabled
    TLS 1.1 (deprecated) Enabled
    TLS 1.0 (deprecated) Enabled
    SSL protocol versions
    SSLv3 (deprecated) Disabled
    SSLv2 (deprecated) Disabled

    Main Leaf Certificate

    • Common Name: cloudflare.com
    • SANs: DNS:cloudflare.com, DNS:ns.cloudflare.com, DNS:*.ns.cloudflare.com, DNS:*.secondary.cloudflare.com, DNS:secondary.cloudflare.com
    • Organization: N/A
    • Validity: Sep 06, 2026 to Dec 05, 2026
    • Algorithm: ecdsa-with-SHA256
    ↓ Intermediate CA Certificate ↓
    • Common Name: WE1
    • Organization: Google Trust Services
    • Valid Till: Feb 20, 2029
    • Issuer: GTS Root R4
    ↓ Intermediate CA Certificate ↓
    • Common Name: GTS Root R4
    • Organization: Google Trust Services LLC
    • Valid Till: Jan 28, 2028
    • Issuer: GlobalSign Root CA

    Website & Server Intelligence for cloudflare.com

    Website Identity

    TitleFavicon Cloudflare: Build for the agent era
    Meta DescriptionWelcome to Cloudflare - Powering the next generation of applications

    Hosting & Server Network

    IP Address104.16.132.229
    HTTP Status200 i
    Hosting ProviderCloudflare, Inc. i
    Web Servercloudflare i
    Control Panel Not Detected i

    Technology Profile

    • Cloudflare
    • Google Tag Manager

    HTTP Security Headers

    Strict-Transport-Security Present
    Content-Security-Policy Present
    X-Frame-Options Present
    X-Content-Type-Options Present
    Referrer-Policy Present
    Permissions-Policy Present

    IP Details & Geolocation

    IP Address 104.16.132.229
    Reverse DNS (PTR) None Detected (No PTR Record)
    CountryCanada (CA)
    RegionOntario
    CityToronto
    ZIP CodeN/A
    ASN13335
    Organization / ISPCloudflare, Inc.

    Understanding Diagnostic Terms for cloudflare.com

    Domain Status (EPP)

    EPP status codes (e.g., clientTransferProhibited, active) indicating if a domain is locked against unauthorized transfer, pending renewal, or active.

    Registrar Information

    The authorized or accredited organization managing the domain reservation and authoritative registry delegation.

    Nameservers (NS)

    Authoritative servers that translate domain names into IP addresses and direct web visitors and mail traffic globally.

    A & AAAA Records

    Primary address records mapping your domain name directly to standard IPv4 (e.g., 192.0.2.1) and newer IPv6 server network addresses.

    MX (Mail Exchange)

    Priority-ranked records pointing inbound emails to designated mail server hosts (e.g., Google Workspace, Microsoft 365, Zoho).

    SPF & DMARC Security

    Email authentication standards that verify authorized sender IPs (SPF) and instruct receiving servers how to enforce security policies (DMARC).

    DKIM Signatures

    Cryptographic public key in DNS used by receiving mail servers to verify digital signatures on your emails, ensuring messages were not tampered with.

    SSL Certificate & Chain

    Establishes encrypted HTTPS connections and authenticates domain ownership via an intermediate certificate authority chain.

    Hosting Provider & ASN

    The physical server infrastructure where website files reside and the autonomous system network (ASN) routing global traffic.

    Reverse DNS (PTR)

    Pointer (PTR) records that map a server's IP address back to its canonical hostname, verifying server identity and preventing email spam rejection.

    HTTP Security Headers

    Directives like HSTS, CSP, and X-Frame-Options instructed by the server to protect browser visitors against XSS, clickjacking, and packet sniffing.

    ⚠️ Report Limitations & Data Sources

    • Data Currency: This report uses cached registry and DNS data (freshened within 4 hours) for high-speed resolution. Click "🔄 Refresh Live" to query directly against authoritative registries.
    • DNS Resolution & Propagation: Records are queried via Google Public DNS-over-HTTPS. Global DNS propagation may take up to 24–48 hours across different regional ISP resolvers during recent DNS record changes.
    • Completeness & Scope: This diagnostic tool analyzes standard authoritative records (A, AAAA, MX, NS, TXT, CNAME, SOA). It does not perform invasive brute-force subdomain scans or unauthenticated DNS zone transfers.
    • Email Deliverability & Reputation: The security analysis (SPF, DKIM, DMARC, and Port 25 SMTP handshake) reflects public DNS policies and inbound connection states. Recipient spam filters evaluate internal headers that cannot be checked from outside.
    • Reverse Proxies & CDNs: If a website is behind Cloudflare, Fastly, or another CDN/reverse proxy, the detected IP, web server software, and SSL edge certificate reflect the proxy tier.