ac-dijon.fr

Delegation · all IPv4 addresses are in 194.167.18.0/24. A single network failure takes all nameservers down; RFC 2182 recommends topologically separate networks (anycast setups are an exception).

Delegation · None of the nameservers has an IPv6 address, so IPv6-only resolvers can't reach them.

SOA · The nameservers serve different versions of the zone: 2026091267 on ns2.ac-dijon.fr (194.167.18.4); 2026091268 on ns.ac-dijon.fr (194.167.18.10). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

DMARC · DMARC policy is set to 'quarantine'. Consider upgrading to 'reject' for stronger protection once you've verified legitimate emails are passing authentication.

DKIM · The _domainkey name exists but no DKIM key was found under the common selectors. Selectors are provider-specific; check yours with -selector.

MX · The following MX hosts could not be resolved to IPv6 addresses: msg-a85.education.gouv.fr, msg-b85.education.gouv.fr

DMARC · DMARC policy only applies to 50% of failing mail (pct=50). Raise pct to 100 once you are confident in your setup.

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.