SurfaceMap › d › dhm.de

dhm.de

Checked 2026-10-21 22:14 UTC · first added 2026-10-21

✗Problems found Score 72 of 100

Domain & DNS

fail

18 passed 3 warn 1 failed

Areas

iRegistration iDelegation ✗Nameservers !SOA !DNSSEC iRecords

Problems

✗

No DNS over TCP

Nameservers · DNS over TCP is required (RFC 7766); without it, large answers such as DNSSEC responses fail. Not answering over TCP: srvns01.dhm.de (194.94.40.81): dial tcp 194.94.40.81:53: i/o timeout; srvns02.dhm.de (194.94.40.82): dial tcp 194.94.40.82:53: i/o timeout; srvns03.dhm.de (194.94.40.83): dial tcp 194.94.40.83:53: i/o timeout; srvns04.dhm.de (194.94.40.84): dial tcp 194.94.40.84:53: i/o timeout.

#19
!

Software version disclosed

Nameservers · These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: srvns01.dhm.de: "9.16.50-Debian"; srvns02.dhm.de: "9.16.50-Debian"; srvns03.dhm.de: "9.16.48-Debian"; srvns04.dhm.de: "9.20.15-1~deb13u1-Debian". Hide or replace the version string.

#17
!

Unusual SOA timers

SOA · retry 2h should be shorter than refresh 30m. Current values: refresh 30m, retry 2h, expire 7d, negative TTL 10m.

#23
!

Not signed

DNSSEC · The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Recent checks

✗

Full report

Domain & DNS report for dhm.de ›

Mail

warn

30 passed 3 warn 0 failed

Areas

✓SPF ✓DMARC !DKIM !DNSSEC !MX ✓TLS iBIMI

Problems

!

Not enabled

DNSSEC · DNSSEC is not enabled for this domain. Consider enabling DNSSEC to protect against DNS spoofing attacks.

#8
!

Hosts without IPv6

MX · The following MX hosts could not be resolved to IPv6 addresses: a1761.mx.srv.dfn.de, b1761.mx.srv.dfn.de, c1761.mx.srv.dfn.de

#11
!

1024-bit DKIM key

DKIM · 1024-bit RSA keys are the minimum and are considered weak today: mail (1024 bits). Rotate to a 2048-bit key.

#23

Recent checks

!

Full report

Mail report for dhm.de ›