bricoman.fr

SOA · The nameservers serve different versions of the zone: 2025120212 on ns-cloud-d1.googledomains.com (216.239.32.109), ns-cloud-d1.googledomains.com (2001:4860:4802:32::6d), ns-cloud-d2.googledomains.com (216.239.34.109), ns-cloud-d2.googledomains.com (2001:4860:4802:34::6d), ns-cloud-d3.googledomains.com (216.239.36.109), ns-cloud-d3.googledomains.com (2001:4860:4802:36::6d), ns-cloud-d4.googledomains.com (216.239.38.109), ns-cloud-d4.googledomains.com (2001:4860:4802:38::6d); 2026092911 on nsa.perf1.fr (81.92.94.100), nsa.perf1.fr (2a01:c8:100::100), nsb.perf1.com (81.92.95.100), nsb.perf1.com (2a01:c8:101::100), nsc.perf1.com (152.89.172.100), nsc.perf1.com (2a09:35c0:102::100). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

DNSSEC · The zone is signed but the parent has no DS record, so the signatures are not used. Publish the DS record at your registrar.

DNSSEC · NSEC3 uses 1 iteration and a 8-byte salt. RFC 9276 recommends 0 iterations and no salt: extra iterations cost resolvers CPU and add no real protection, and some validators treat high counts as insecure.

DNSSEC · DNSSEC is not enabled for this domain. Consider enabling DNSSEC to protect against DNS spoofing attacks.

MX · The following MX hosts could not be resolved to IPv6 addresses: mxa-004bb303.gslb.pphosted.com, mxb-004bb303.gslb.pphosted.com

DKIM · 1024-bit RSA keys are the minimum and are considered weak today: s2 (1024 bits). Rotate to a 2048-bit key.

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.