example.com — DNS Report

Scan ID: example.com-1786320179254313262 Scanned: Aug 10, 2026

B 82%

Rescan

42 Pass

2 Warnings

1 Failures

4 Info

49 Total

Processed in 0s

● 📋 Domain Registration

PASS

Registrar	RESERVED-Internet Assigned Numbers Authority
Registrar ID	376
Registry	Verisign
Registry ID	2336799_DOMAIN_COM-VRSN
Created	Aug 14, 1995
Updated	Jan 16, 2026
Expires	Aug 13, 2026 (3 days left)
DNSSEC	✓ Signed
Status	client delete prohibited client transfer prohibited client update prohibited
RDAP Nameservers	elliott.ns.cloudflare.com hera.ns.cloudflare.com

● 🌐 DNS Records

PASS

SOA Records (1)

Name	Value	TTL
example.com	elliott.ns.cloudflare.com dns.cloudflare.com 2411783310 10000 2400 604800 1800	1800

NS Records (2)

Name	Value	TTL
example.com	elliott.ns.cloudflare.com	86400
example.com	hera.ns.cloudflare.com	86400

A Records (2)

Name	Value	TTL
example.com	104.20.23.154	300
example.com	172.66.147.243	300

AAAA Records (2)

Name	Value	TTL
example.com	2606:4700:10::6814:179a	300
example.com	2606:4700:10::ac42:93f3	300

MX Records (1)

Name	Value	TTL
example.com		300

TXT Records (2)

Name	Value	TTL
example.com	v=spf1 -all	300
example.com	_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9	300

DNSKEY Records (4)

Name	Value	TTL
example.com	Flags=256 Protocol=3 Alg=13 KeyTag=9776	3600
example.com	Flags=257 Protocol=3 Alg=13 KeyTag=2371	3600
example.com	Flags=256 Protocol=3 Alg=13 KeyTag=34505	3600
example.com	Flags=256 Protocol=3 Alg=13 KeyTag=36315	3600

● 🔗 Parent Nameservers

PASS

Nameserver	IPv4	IPv6	Glue
elliott.ns.cloudflare.com	162.159.44.228, 108.162.195.228, 172.64.35.228	2606:4700:58::a29f:2ce4, 2a06:98c1:50::ac40:23e4, 2803:f800:50::6ca2:c3e4	Yes
hera.ns.cloudflare.com	172.64.32.162, 108.162.192.162, 173.245.58.162	2a06:98c1:50::ac40:20a2, 2606:4700:50::adf5:3aa2, 2803:f800:50::6ca2:c0a2	Yes

✓	Nameservers Listed at Parent	The parent TLD nameserver has 2 nameserver(s) listed for example.com. hera.ns.cloudflare.com elliott.ns.cloudflare.com
✓	Minimum Nameserver Count	2 nameservers found. Good redundancy.
✓	Glue Record: elliott.ns.cloudflare.com	Glue record found for elliott.ns.cloudflare.com: 108.162.195.228, 162.159.44.228, 172.64.35.228, 2606:4700:58::a29f:2ce4, 2803:f800:50::6ca2:c3e4, 2a06:98c1:50::ac40:23e4
✓	Public IP: elliott.ns.cloudflare.com	Nameserver elliott.ns.cloudflare.com has a public IP address.
✓	Glue Record: hera.ns.cloudflare.com	Glue record found for hera.ns.cloudflare.com: 108.162.192.162, 172.64.32.162, 173.245.58.162, 2606:4700:50::adf5:3aa2, 2803:f800:50::6ca2:c0a2, 2a06:98c1:50::ac40:20a2
✓	Public IP: hera.ns.cloudflare.com	Nameserver hera.ns.cloudflare.com has a public IP address.
✓	Parent/Auth NS Consistency	The nameservers listed at the parent match those returned by the authoritative nameservers.

● 🖥️ Authoritative Nameservers

PASS

Nameserver	UDP	TCP	Auth	Recursion	IPv6	Latency
elliott.ns.cloudflare.com	✓	✓	✓	Closed	✓	21ms
hera.ns.cloudflare.com	✓	✓	✓	Closed	✓	11ms

✓	Authoritative Nameservers Found	Found 2 authoritative nameserver(s): hera.ns.cloudflare.com, elliott.ns.cloudflare.com
✓	All Nameservers Respond	All authoritative nameservers are responding to DNS queries.
✓	UDP DNS (Port 53)	At least one nameserver is responding to UDP DNS queries on port 53.
✓	TCP DNS (Port 53)	TCP DNS queries are supported. Required for large responses and DNSSEC.
✓	Authoritative Response	At least one nameserver returns an authoritative (AA) response for the zone.
✓	Open Recursion	Nameservers do not appear to answer recursive queries from outside. Good.
✓	Public IP Addresses	All nameservers have publicly routable IP addresses.
✓	IPv6 Support	At least one nameserver has an IPv6 (AAAA) address.
✓	NS Record Consistency	All authoritative nameservers return identical NS records.
✓	Multiple Network Diversity	Nameservers appear to be on different subnets/networks. Good resilience.

● 📄 SOA Record

INFO

Primary NS (MNAME)	elliott.ns.cloudflare.com
Email (RNAME)	dns.cloudflare.com
Serial	2411783310
Refresh	10000 (2h 46m)
Retry	2400 (40 min)
Expire	604800 (7 days)
Minimum TTL	1800 (30 min)

✓	SOA Record Exists	SOA record found for example.com.
✓	SOA MNAME	SOA MNAME (elliott.ns.cloudflare.com) is listed as an authoritative nameserver.
✓	SOA RNAME	SOA contact email: dns@cloudflare.com
ℹ	SOA Serial Format	SOA serial is 2411783310. The recommended format is YYYYMMDDNN (e.g., 2024010101).
✓	SOA Serial Consistency	All authoritative nameservers return the same SOA serial number.
✓	SOA Refresh	SOA Refresh is 10000 seconds (2h). Reasonable value.
✓	SOA Retry	SOA Retry is 2400 seconds.
✓	SOA Expire	SOA Expire is 604800 seconds (7 days). Reasonable value.
✓	SOA Minimum TTL	SOA Minimum TTL (negative caching) is 1800 seconds.

● 📧 Mail Servers (MX)

FAIL

Priority	Hostname	IPv4	IPv6	PTR
0		-	-	-

✓	MX Records Exist	Found 1 MX record(s) for example.com.
⚠	MX Redundancy	Only one MX record found. A single mail server is a single point of failure. Consider adding a backup MX.
✗	MX Hostname:	MX record has an invalid hostname:
⚠	MX Reverse DNS (PTR)	No PTR records found for MX server IP(s). Many mail servers require rDNS for spam filtering.
✓	MX Consistency	All authoritative nameservers return consistent MX records.

● 🌍 WWW / Web

INFO

Target	Type	IPs
www.example.com	A	172.66.147.243, 104.20.23.154, 2606:4700:10::ac42:93f3, 2606:4700:10::6814:179a

✓	WWW Record	www.example.com resolves to: 172.66.147.243, 104.20.23.154, 2606:4700:10::ac42:93f3, 2606:4700:10::6814:179a
ℹ	WWW vs Apex IP	www.example.com and example.com resolve to different IP addresses. This is normal if they are intentionally served differently.

● 🔒 DNSSEC

PASS

Enabled	Yes
DS Records	KeyTag=2371 Alg=13 DigestType=2 Digest=C988EC423E3880EB8DD8A46FE06CA230EE23F35B578D64E78B29C3E1C83D245A
DNSKEY	KeyTag=2371 Alg=ECDSAP256SHA256 Flags=257, KeyTag=9776 Alg=ECDSAP256SHA256 Flags=256, KeyTag=34505 Alg=ECDSAP256SHA256 Flags=256, KeyTag=36315 Alg=ECDSAP256SHA256 Flags=256
Algorithms	ECDSAP256SHA256, ECDSAP256SHA256, ECDSAP256SHA256, ECDSAP256SHA256

Chain of Trust

Level	DS	DNSKEY	RRSIG	Status
.	—	✓	✓	PASS
com	✓	✓	✓	PASS
example.com	✓	✓	✓	PASS

✓	DNSSEC Enabled	DNSSEC appears to be enabled for example.com.
✓	DS Record	DS record(s) found at the parent zone. The delegation is signed. KeyTag=2371 Alg=13 DigestType=2 Digest=C988EC423E3880EB8DD8A46FE06CA230EE23F35B578D64E78B29C3E1C83D245A
✓	DNSKEY Record	DNSKEY record(s) found in the zone. KeyTag=2371 Alg=ECDSAP256SHA256 Flags=257 KeyTag=9776 Alg=ECDSAP256SHA256 Flags=256 KeyTag=34505 Alg=ECDSAP256SHA256 Flags=256 KeyTag=36315 Alg=ECDSAP256SHA256 Flags=256
✓	DNSSEC Algorithm	Algorithm ECDSAP256SHA256 is in use. This is a strong algorithm.
✓	DNSSEC Algorithm	Algorithm ECDSAP256SHA256 is in use. This is a strong algorithm.
✓	DNSSEC Algorithm	Algorithm ECDSAP256SHA256 is in use. This is a strong algorithm.
✓	DNSSEC Algorithm	Algorithm ECDSAP256SHA256 is in use. This is a strong algorithm.
✓	RRSIG Records	RRSIG (signature) records found. Zone records are signed. TypeCovered=DNSKEY Alg=13 KeyTag=2371 Signer=example.com TypeCovered=SOA Alg=13 KeyTag=34505 Signer=example.com TypeCovered=NS Alg=13 KeyTag=34505 Signer=example.com
✓	DNSSEC Chain	Chain of trust: ✓ . → ✓ com → ✓ example.com

● 🛡️ Email Security

INFO

SPF (Sender Policy Framework)

Record	v=spf1 -all
All Mechanism	-all
DNS Lookups	0 / 10 max

DMARC (Domain-based Message Authentication)

Record	v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s
Policy (p=)	reject
Subdomain Policy (sp=)	reject

CAA (Certificate Authority Authorization)

No CAA records found. Any certificate authority can issue SSL certificates for this domain.

✓	SPF Record	SPF record found. v=spf1 -all
✓	SPF All Mechanism	SPF record uses '-all' (fail). Non-listed senders will be rejected. Good.
✓	SPF DNS Lookup Count	SPF record uses approximately 0 DNS lookups (limit is 10).
✓	DMARC Record	DMARC record found. v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s
✓	DMARC Policy	DMARC policy is 'reject'. Failing emails will be rejected. Maximum protection.
ℹ	DMARC Reporting (rua)	No aggregate reporting (rua) address configured. Consider adding rua to receive DMARC reports.
ℹ	CAA Records	No CAA records found for example.com. CAA records specify which certificate authorities may issue SSL/TLS certificates for this domain.

● 📡 DNS Propagation

PASS

Status	Resolver	Location	Result	Latency
✓	Cloudflare 2 (1.0.0.1)	US (Cloudflare)	172.66.147.243, 104.20.23.154	11ms
✓	Cloudflare (1.1.1.1)	US (Cloudflare)	172.66.147.243, 104.20.23.154	12ms
✓	Comodo Secure (8.26.56.26)	US (Comodo)	104.20.23.154, 172.66.147.243	21ms
✓	Quad9 (9.9.9.9)	US (Quad9)	104.20.23.154, 172.66.147.243	21ms
✓	OpenDNS (208.67.222.222)	US (OpenDNS)	172.66.147.243, 104.20.23.154	17ms
✓	Google Public DNS 2 (8.8.4.4)	US (Google)	172.66.147.243, 104.20.23.154	29ms
✓	OpenDNS 2 (208.67.220.220)	US (OpenDNS)	172.66.147.243, 104.20.23.154	17ms
✓	Verisign (64.6.64.6)	US (Verisign)	172.66.147.243, 104.20.23.154	16ms
✓	Google Public DNS (8.8.8.8)	US (Google)	104.20.23.154, 172.66.147.243	29ms
✓	Yandex.DNS (77.88.8.8)	RU (Yandex)	8.6.112.0, 8.47.69.0	201ms