inquirer.com

SOA · The nameservers serve different versions of the zone: 1 on ns-1234.awsdns-26.org (205.251.196.210), ns-1234.awsdns-26.org (2600:9000:5304:d200::1), ns-1676.awsdns-17.co.uk (205.251.198.140), ns-1676.awsdns-17.co.uk (2600:9000:5306:8c00::1), ns-205.awsdns-25.com (205.251.192.205), ns-205.awsdns-25.com (2600:9000:5300:cd00::1), ns-792.awsdns-35.net (205.251.195.24), ns-792.awsdns-35.net (2600:9000:5303:1800::1); 1788976307 on dns1.p01.nsone.net (198.51.44.1), dns1.p01.nsone.net (2620:4d:4000:6259:7:1:0:1). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

DNSSEC · The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

DNSSEC · DNSSEC is not enabled for this domain. Consider enabling DNSSEC to protect against DNS spoofing attacks.

DKIM · 1024-bit RSA keys are the minimum and are considered weak today: default (1024 bits), k1 (1024 bits), google (1024 bits), s2 (1024 bits). Rotate to a 2048-bit key.

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.