facebook.com — DNS Report

Scan ID: facebook.com-1786361763056402434 Scanned: Aug 10, 2026

B 86%

Rescan

40 Pass

1 Warnings

0 Failures

5 Info

46 Total

Processed in 0s

● 📋 Domain Registration

PASS

Registrar	RegistrarSafe, LLC
Registrar ID	3237
Registry	Verisign
Registry ID	2320948_DOMAIN_COM-VRSN
Created	Mar 29, 1997
Updated	Apr 23, 2025
Expires	Mar 30, 2034 (2788 days left)
DNSSEC	✗ Unsigned
Status	client delete prohibited client transfer prohibited client update prohibited server delete prohibited server transfer prohibited server update prohibited
RDAP Nameservers	a.ns.facebook.com b.ns.facebook.com c.ns.facebook.com d.ns.facebook.com

● 🌐 DNS Records

PASS

SOA Records (1)

Name	Value	TTL
facebook.com	a.ns.facebook.com dns.facebook.com 4207849484 14400 1800 604800 300	3600

NS Records (4)

Name	Value	TTL
facebook.com	d.ns.facebook.com	172800
facebook.com	c.ns.facebook.com	172800
facebook.com	a.ns.facebook.com	172800
facebook.com	b.ns.facebook.com	172800

A Records (1)

Name	Value	TTL
facebook.com	57.144.104.1	60

AAAA Records (1)

Name	Value	TTL
facebook.com	2a03:2880:f32b:9:face:b00c:0:25de	60

MX Records (1)

Name	Value	TTL
facebook.com	smtpin.vvv.facebook.com	3600

TXT Records (6)

Name	Value	TTL
facebook.com	v=spf1 redirect=_spf.facebook.com	86400
facebook.com	facebook-domain-verification=y7isfmi3kzyg1r4wophh9vyb6pgbda	3600
facebook.com	google-site-verification=sK6uY9x7eaMoEMfn3OILqwTFYgaNp4llmguKI-C3_iA	7200
facebook.com	google-site-verification=A2WZWCNQHrGV_TWwKh6KHY90tY0SHZo_RnyMJoDaG0s	7200
facebook.com	zoom-domain-verification=4b2ef4e1-6dee-4483-9869-9bef353fd147	3600
facebook.com	google-site-verification=wdH5DTJTc9AYNwVunSVFeK0hYDGUIEOGb-RReU6pJlY	7200

CAA Records (1)

Name	Value	TTL
facebook.com	0 issue "digicert.com; account=271b0beda0771d006aa3a6c11b05187d456d6c239b46cb5241196095b09c92af"	3600

● 🔗 Parent Nameservers

PASS

Nameserver	IPv4	IPv6	Glue
c.ns.facebook.com	185.89.218.12	2a03:2880:f1fc:c:face:b00c:0:35	Yes
a.ns.facebook.com	129.134.30.12	2a03:2880:f0fc:c:face:b00c:0:35	Yes
d.ns.facebook.com	185.89.219.12	2a03:2880:f1fd:c:face:b00c:0:35	Yes
b.ns.facebook.com	129.134.31.12	2a03:2880:f0fd:c:face:b00c:0:35	Yes

✓	Nameservers Listed at Parent	The parent TLD nameserver has 4 nameserver(s) listed for facebook.com. a.ns.facebook.com b.ns.facebook.com c.ns.facebook.com d.ns.facebook.com
✓	Minimum Nameserver Count	4 nameservers found. Good redundancy.
✓	Glue Record: c.ns.facebook.com	Glue record found for c.ns.facebook.com: 185.89.218.12, 2a03:2880:f1fc:c:face:b00c:0:35
✓	Public IP: c.ns.facebook.com	Nameserver c.ns.facebook.com has a public IP address.
✓	Glue Record: a.ns.facebook.com	Glue record found for a.ns.facebook.com: 129.134.30.12, 2a03:2880:f0fc:c:face:b00c:0:35
✓	Public IP: a.ns.facebook.com	Nameserver a.ns.facebook.com has a public IP address.
✓	Glue Record: d.ns.facebook.com	Glue record found for d.ns.facebook.com: 185.89.219.12, 2a03:2880:f1fd:c:face:b00c:0:35
✓	Public IP: d.ns.facebook.com	Nameserver d.ns.facebook.com has a public IP address.
✓	Glue Record: b.ns.facebook.com	Glue record found for b.ns.facebook.com: 129.134.31.12, 2a03:2880:f0fd:c:face:b00c:0:35
✓	Public IP: b.ns.facebook.com	Nameserver b.ns.facebook.com has a public IP address.
✓	Parent/Auth NS Consistency	The nameservers listed at the parent match those returned by the authoritative nameservers.

● 🖥️ Authoritative Nameservers

PASS

Nameserver	UDP	TCP	Auth	Recursion	IPv6	Latency
a.ns.facebook.com	✓	✗ Down	✓	Closed	✓	63ms
b.ns.facebook.com	✓	✗ Down	✓	Closed	✓	37ms
c.ns.facebook.com	✓	✗ Down	✓	Closed	✓	20ms
d.ns.facebook.com	✓	✓	✓	Closed	✓	41ms

✓	Authoritative Nameservers Found	Found 4 authoritative nameserver(s): c.ns.facebook.com, d.ns.facebook.com, a.ns.facebook.com, b.ns.facebook.com
✓	All Nameservers Respond	All authoritative nameservers are responding to DNS queries.
✓	UDP DNS (Port 53)	At least one nameserver is responding to UDP DNS queries on port 53.
✓	TCP DNS (Port 53)	TCP DNS queries are supported. Required for large responses and DNSSEC.
✓	Authoritative Response	At least one nameserver returns an authoritative (AA) response for the zone.
✓	Open Recursion	Nameservers do not appear to answer recursive queries from outside. Good.
✓	Public IP Addresses	All nameservers have publicly routable IP addresses.
✓	IPv6 Support	At least one nameserver has an IPv6 (AAAA) address.
✓	NS Record Consistency	All authoritative nameservers return identical NS records.
✓	Multiple Network Diversity	Nameservers appear to be on different subnets/networks. Good resilience.

● 📄 SOA Record

INFO

Primary NS (MNAME)	a.ns.facebook.com
Email (RNAME)	dns.facebook.com
Serial	4207849484
Refresh	14400 (4 hours)
Retry	1800 (30 min)
Expire	604800 (7 days)
Minimum TTL	300 (5 min)

✓	SOA Record Exists	SOA record found for facebook.com.
✓	SOA MNAME	SOA MNAME (a.ns.facebook.com) is listed as an authoritative nameserver.
✓	SOA RNAME	SOA contact email: dns@facebook.com
ℹ	SOA Serial Format	SOA serial is 4207849484. The recommended format is YYYYMMDDNN (e.g., 2024010101).
✓	SOA Serial Consistency	All authoritative nameservers return the same SOA serial number.
✓	SOA Refresh	SOA Refresh is 14400 seconds (4h). Reasonable value.
✓	SOA Retry	SOA Retry is 1800 seconds.
✓	SOA Expire	SOA Expire is 604800 seconds (7 days). Reasonable value.
✓	SOA Minimum TTL	SOA Minimum TTL (negative caching) is 300 seconds.

● 📧 Mail Servers (MX)

WARNING

Priority	Hostname	IPv4	IPv6	PTR
10	smtpin.vvv.facebook.com	66.220.149.251	2a03:2880:18ff:fffc:face:b00c:0:686e	msgin-regional-shv-01-rprn0.facebook.com

✓	MX Records Exist	Found 1 MX record(s) for facebook.com.
⚠	MX Redundancy	Only one MX record found. A single mail server is a single point of failure. Consider adding a backup MX.
✓	MX Reverse DNS (PTR)	MX server(s) have PTR (reverse DNS) records. Many mail servers require rDNS for anti-spam.
✓	MX Consistency	All authoritative nameservers return consistent MX records.

● 🌍 WWW / Web

INFO

Target	Type	IPs
www.facebook.com	CNAME	57.144.104.1, 2a03:2880:f32b:9:face:b00c:0:25de CNAME chain: www.facebook.com → star-mini.c10r.facebook.com

✓	WWW CNAME	www.facebook.com is a CNAME pointing to star-mini.c10r.facebook.com, which resolves to 57.144.104.1, 2a03:2880:f32b:9:face:b00c:0:25de. CNAME chain: www.facebook.com → star-mini.c10r.facebook.com
ℹ	WWW vs Apex IP	www.facebook.com and facebook.com resolve to different IP addresses. This is normal if they are intentionally served differently.

● 🔒 DNSSEC

INFO

Enabled

No

Chain of Trust

Level	DS	DNSKEY	RRSIG	Status
.	—	✓	✓	PASS
com	✓	✓	✓	PASS
facebook.com	—	—	—	INFO

ℹ

DNSSEC Status

DNSSEC is not enabled for facebook.com. No DS or DNSKEY records found.

● 🛡️ Email Security

INFO

SPF (Sender Policy Framework)

Record	v=spf1 redirect=_spf.facebook.com
All Mechanism	redirect=_spf.facebook.com
Redirect Domain	_spf.facebook.com
Redirect Record	v=spf1 ip4:66.220.144.128/25 ip4:66.220.155.0/24 ip4:66.220.157.0/25 ip4:69.63.178.128/25 ip4:69.63.181.0/24 ip4:69.63.184.0/25 ip4:69.171.232.0/24 ip4:69.171.244.0/23 -all
DNS Lookups	1 / 10 max

DMARC (Domain-based Message Authentication)

Record	v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; ruf=mailto:fb-dmarc@datafeeds.phishlabs.com; pct=100
Policy (p=)	reject
Percentage (pct=)	100%
Aggregate Reports (rua)	mailto:a@dmarc.facebookmail.com
Forensic Reports (ruf)	mailto:fb-dmarc@datafeeds.phishlabs.com

CAA (Certificate Authority Authorization)

Flag	Tag	Value
0	issue	digicert.com; account=271b0beda0771d006aa3a6c11b05187d456d6c239b46cb5241196095b09c92af

✓	SPF Record	SPF record found. v=spf1 redirect=_spf.facebook.com
✓	SPF Redirect	SPF record uses redirect=_spf.facebook.com instead of an 'all' mechanism. This is valid per RFC 7208 — evaluation continues on the redirect domain. v=spf1 redirect=_spf.facebook.com Redirect target (_spf.facebook.com): v=spf1 ip4:66.220.144.128/25 ip4:66.220.155.0/24 ip4:66.220.157.0/25 ip4:69.63.178.128/25 ip4:69.63.181.0/24 ip4:69.63.184.0/25 ip4:69.171.232.0/24 ip4:69.171.244.0/23 -all
✓	SPF DNS Lookup Count	SPF record uses approximately 1 DNS lookups (limit is 10).
✓	DMARC Record	DMARC record found. v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; ruf=mailto:fb-dmarc@datafeeds.phishlabs.com; pct=100
✓	DMARC Policy	DMARC policy is 'reject'. Failing emails will be rejected. Maximum protection.
✓	DMARC Reporting (rua)	Aggregate reports (rua) will be sent to: mailto:a@dmarc.facebookmail.com
✓	CAA Records	CAA records found (1). Certificate issuance is restricted.
ℹ	CAA issuewild Tag	No 'issuewild' CAA tag. The 'issue' policy applies to wildcard certificates too, unless overridden.
ℹ	CAA iodef Tag	No 'iodef' CAA tag. Consider adding an iodef tag to receive reports of unauthorized certificate requests.

● 📡 DNS Propagation

PASS

Status	Resolver	Location	Result	Latency
✓	Verisign (64.6.64.6)	US (Verisign)	57.144.216.1	17ms
✓	OpenDNS (208.67.222.222)	US (OpenDNS)	57.144.104.1	35ms
✓	OpenDNS 2 (208.67.220.220)	US (OpenDNS)	57.144.104.1	43ms
✓	Google Public DNS (8.8.8.8)	US (Google)	57.144.104.1	27ms
✓	Cloudflare (1.1.1.1)	US (Cloudflare)	57.144.104.1	11ms
✓	Cloudflare 2 (1.0.0.1)	US (Cloudflare)	57.144.104.1	11ms
✓	Google Public DNS 2 (8.8.4.4)	US (Google)	57.144.104.1	25ms
✓	Quad9 (9.9.9.9)	US (Quad9)	57.144.4.1	21ms
✓	Comodo Secure (8.26.56.26)	US (Comodo)	57.144.134.1	80ms
✓	Yandex.DNS (77.88.8.8)	RU (Yandex)	157.240.253.35	189ms

● 🔄 Reverse DNS (PTR)

INFO

IP Address	PTR Record	Forward Match
66.220.149.251	msgin-regional-shv-01-rprn0.facebook.com	✗ No match