SurfaceMap › i › ipk-gatersleben.de

ipk-gatersleben.de

Checked 2026-10-21 23:00 UTC · first added 2026-10-21
✗Problems found Score 46 of 100

Domain & DNS

fail

24 passed 3 warn 1 failed

Areas

iRegistration !Delegation ✗Nameservers !SOA !DNSSEC ✓Records

Problems

  • ✗
    Nameservers not responding
    Nameservers · These addresses did not answer, so resolvers waste time on timeouts: mendel.ipk-gatersleben.de (2001:638:913:d360::1): read udp [2a01:4f8:1c1c:eebf::1]:43488->[2001:638:913:d360::1]:53: i/o timeout.
    #14
  • !
    Glue differs from the zone
    Delegation · The addresses at the parent (glue) differ from the addresses in the zone: mendel.ipk-gatersleben.de (glue 194.94.136.1, zone 194.94.136.1, 2001:638:913:d360::1). Update the glue at your registrar.
    #8
  • !
    Unusual SOA timers
    SOA · negative caching TTL (minimum) 2d is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 1d, retry 2h, expire 1000h, negative TTL 2d.
    #23
  • !
    Signatures expire soon
    DNSSEC · The earliest signature expires at 2026-10-27 08:23 UTC (in 129h0m0s). Check that automatic re-signing works.
    #30

Recent checks

✗

Full report

Domain & DNS report for ipk-gatersleben.de ›

Mail

fail

23 passed 5 warn 2 failed

Areas

✓SPF ✗DMARC !DKIM !DNSSEC !MX ✗TLS iBIMI

Problems

  • ✗
    Policy: none (monitoring only)
    DMARC · DMARC policy is set to 'none', which only monitors but doesn't protect against spoofing. Consider upgrading to 'quarantine' or ideally 'reject'.
    #4
  • ✗
    Policy not reachable
    TLS · The MTA-STS record exists but the policy could not be fetched, so senders ignore MTA-STS: https://mta-sts.ipk-gatersleben.de/.well-known/mta-sts.txt returned HTTP 503.
    #33
  • !
    Hosts without IPv6
    MX · The following MX hosts could not be resolved to IPv6 addresses: a1191.mx.srv.dfn.de, b1191.mx.srv.dfn.de, c1191.mx.srv.dfn.de
    #11
  • !
    No aggregate reports (rua)
    DMARC · DMARC record has no rua tag, so you receive no aggregate reports about who sends mail as your domain. Add rua=mailto:...
    #19
  • !
    Signatures expire in 129h0m0s
    DNSSEC · DNSKEY signatures expire at 2026-10-27T08:23:19Z (in 129h0m0s). Check that re-signing works.
    #21
  • !
    1024-bit DKIM key
    DKIM · 1024-bit RSA keys are the minimum and are considered weak today: s1 (1024 bits). Rotate to a 2048-bit key.
    #23
  • !
    Not configured
    TLS · MTA-STS or DANE is used without TLS-RPT, so you get no reports when senders fail to deliver because of TLS problems. Publish _smtp._tls TXT "v=TLSRPTv1; rua=mailto:...".
    #35

Recent checks

✗

Full report

Mail report for ipk-gatersleben.de ›