ac-strasbourg.fr

Checked 22 October 2026, 01:23 UTC · via 8.8.8.8
✗Problems found
26 passed 1 warning 1 failed 7 info

Registration

info

.fr country-code · GIP RENATER · expires 2027-05-23

Found

TLD
.fr (country-code)
ICANN policies apply
no
Registrar
GIP RENATER
Registered
23 May 1996
Last changed
30 June 2026
Expires
23 May 2027
Status
active
Registry nameservers
ns1.ac-reims.fr, ns1.ac-strasbourg.fr, ns2.ac-strasbourg.fr
RDAP server
https://rdap.nic.fr/

Checks

  • i
    .fr is a country-code TLD (ccTLD)
    Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.
    #1
  • ✓ TLD delegated and signed #2
    .fr is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-05-23 #3
    The registration is valid until 2027-05-23 (213 days).
  • i
    No transfer lock
    The domain has no transfer lock (status: active). A registrar lock protects against unauthorized transfers.
    #4
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

ns1.ac-reims.fr, ns1.ac-strasbourg.fr, ns2.ac-strasbourg.fr

Found

Parent zone
fr
Delegation from
d.nic.fr (194.0.9.1)
NS at the parent
ns1.ac-reims.fr, ns1.ac-strasbourg.fr, ns2.ac-strasbourg.fr
NS in the zone
ns1.ac-reims.fr, ns1.ac-strasbourg.fr, ns2.ac-strasbourg.fr
NameserverAddressesNetwork (AS)Glue
ns1.ac-reims.fr195.98.229.2AS2200 FR-RENATER - Renater, FR195.98.229.2
ns1.ac-strasbourg.fr194.254.4.10 2001:660:470f::1AS2200 FR-RENATER - Renater, FR AS2200 FR-RENATER - Renater, FR194.254.4.10 2001:660:470f::1
ns2.ac-strasbourg.fr194.254.4.11 2001:660:470f::2AS2200 FR-RENATER - Renater, FR AS2200 FR-RENATER - Renater, FR194.254.4.11 2001:660:470f::2

Checks

  • ✓ 3 nameservers #6
    Delegated to ns1.ac-reims.fr, ns1.ac-strasbourg.fr, ns2.ac-strasbourg.fr.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ Glue present and correct #8
    Glue is published for the nameservers inside the zone: ns1.ac-strasbourg.fr, ns2.ac-strasbourg.fr.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • i
    One address family in one network
    all IPv6 addresses are in 2001:660:470f::/48, while the other address family is spread over several networks.
    #10
  • i
    All nameservers in one AS
    All nameserver addresses are announced by one network operator (AS2200 (FR-RENATER - Renater, FR): 5 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.
    #11
  • i
    All nameserver names under .fr
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • i
    Partly IPv6
    These nameservers have no IPv6 address: ns1.ac-reims.fr.
    #13

Nameservers

fail

5 of 5 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns1.ac-reims.fr 195.98.229.2NOERROR, 25 ms, authoritativenoyes / yesrefused9.16.23-RH
ns1.ac-strasbourg.fr 194.254.4.10NOERROR, 29 ms, authoritativenoyes / yesrefusedDNS
ns1.ac-strasbourg.fr 2001:660:470f::1NOERROR, 25 ms, authoritativenoyes / yesALLOWED (3212 records)DNS
ns2.ac-strasbourg.fr 194.254.4.11NOERROR, 29 ms, authoritativenoyes / yesrefusedDNS
ns2.ac-strasbourg.fr 2001:660:470f::2NOERROR, 25 ms, authoritativenoyes / yesALLOWED (3212 records)DNS

Checks

  • ✓ All respond #14
    All 5 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: ns1.ac-reims.fr: "9.16.23-RH". Hide or replace the version string.
    #17
  • ✗
    Zone transfer allowed
    These nameservers send the complete zone to anyone who asks (AXFR), exposing all host names: ns1.ac-strasbourg.fr (2001:660:470f::1): 3212 records; ns2.ac-strasbourg.fr (2001:660:470f::2): 3212 records. Restrict zone transfers to your secondary servers.
    #18
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 2026101672 · primary ns1.ac-strasbourg.fr

Found

Primary (MNAME)
ns1.ac-strasbourg.fr
Contact (RNAME)
dnsmaster.ac-strasbourg.fr
Serial
2026101672
Refresh / retry
28800 s / 3600 s
Expire
1209600 s
Negative TTL
1800 s

Serial per nameserver

NameserverSerial
ns1.ac-reims.fr (195.98.229.2)2026101672
ns1.ac-strasbourg.fr (194.254.4.10)2026101672
ns1.ac-strasbourg.fr (2001:660:470f::1)2026101672
ns2.ac-strasbourg.fr (194.254.4.11)2026101672
ns2.ac-strasbourg.fr (2001:660:470f::2)2026101672

Checks

  • ✓ Serial 2026101672 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 8h, retry 1h, expire 14d, negative TTL 30m.
  • ✓ Primary is a public nameserver #24
    The primary nameserver ns1.ac-strasbourg.fr is one of the listed nameservers.
  • ✓ Contact dnsmaster@ac-strasbourg.fr #25
    The SOA RNAME dnsmaster.ac-strasbourg.fr means dnsmaster@ac-strasbourg.fr.
  • ✓ Date-based serial #26
    The serial 2026101672 follows the YYYYMMDDnn convention (2026-10-16).

DNSSEC

info

Signed, DS published at parent

Found

Validated by resolver
yes
Denial of existence
NSEC
Signatures valid until
15 November 2026

DS at the parent

Key tagAlgorithmDigestMatches a key
22106ECDSAP256SHA256 (13)SHA256 0E6FC99C8353AE49…yes
22106ECDSAP256SHA256 (13)SHA1 126A80BDC9EB0DA5…yes

DNSKEY in the zone

Key tagRoleAlgorithm
22106KSK (257)ECDSAP256SHA256 (13)
4413ZSK (256)ECDSAP256SHA256 (13)

Checks

  • ✓ Signed and validated #27
    The zone is signed, the parent publishes a DS record, and the resolver validates the answers.
  • ✓ DS matches a key #28
    The DS record at the parent matches a key in the zone: key tag 22106 (SHA256), key tag 22106 (SHA1).
  • ✓ Modern algorithms #29
    Key algorithms: ECDSAP256SHA256 (13).
  • ✓ Signatures valid until 2026-11-15 #30
    The earliest DNSKEY/SOA signature expires at 2026-11-15 11:31 UTC.
  • i
    NSEC
    The zone uses NSEC, so its full contents can be listed by walking the NSEC chain. That is fine unless the names are sensitive.
    #31

Records

pass

10 records at the apex

Found

Read from
195.98.229.2:53
TypeValueTTL
SOAns1.ac-strasbourg.fr. dnsmaster.ac-strasbourg.fr. 2026101672 28800 3600 1209600 180086400
NSns1.ac-reims.fr.86400
NSns1.ac-strasbourg.fr.86400
NSns2.ac-strasbourg.fr.86400
MX10 msg-a85.education.gouv.fr.3600
MX15 msg-b85.education.gouv.fr.3600
TXT"HARICA-4Nz2qcYOLRSiv4hzLje"86400
TXT"v=spf1 mx include:_spf.ac-strasbourg.fr include:_spfacad.phm.education.gouv.fr -all"86400
CAA0 issue "harica.gr"3600
CAA0 issuewild "harica.gr"3600

Checks

  • ✓ TTLs within range #32
    TTLs: MX 1h, NS 1d. The NS TTL at the parent is 1h and in the zone 1d; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • ✓ CAA restricts issuance #35
    Certificates may be issued by: harica.gr.