jybczy.com

ns13.xincache.com, ns14.xincache.com

Found

Parent zone

com

Delegation from

a.gtld-servers.net (192.5.6.30)

NS at the parent

ns13.xincache.com, ns14.xincache.com

NS in the zone

ns13.xincache.com, ns14.xincache.com

Checks

• i

  2 nameservers

  Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: ns13.xincache.com, ns14.xincache.com.

  #6
• ✓ Parent and zone agree #7

  The parent delegation and the zone's NS records list the same nameservers.
• !

  Glue differs from the zone

  The addresses at the parent (glue) differ from the addresses in the zone: ns13.xincache.com (glue 1.12.0.4, 112.80.181.45, 117.89.178.173, 129.211.176.209, 2402:4e00:1470:2::e, 36.155.149.180, zone 1.12.0.4, 36.155.149.180, 129.211.176.209, 112.80.181.45, 125.94.59.210, 117.89.178.173, 2402:4e00:1470:2::e, 2402:4e00:1730::e); ns14.xincache.com (glue 1.12.0.1, 112.80.181.111, 117.89.178.184, 129.211.176.239, 2402:4e00:111:fff::c, 36.155.149.176, zone 163.177.5.23, 112.80.181.111, 1.12.0.1, 129.211.176.239, 117.89.178.184, 36.155.149.176, 2402:4e00:111:fff::c). Update the glue at your registrar.

  #8
• ✓ All names resolve #9

  Every nameserver name has an address and is not an alias.
• ✓ Nameservers in different networks #10

  The nameservers are spread over 7 IPv4 /24s and 3 IPv6 /48s.
• ✓ 7 autonomous systems #11

  The nameservers are spread over: AS132203 (TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue, CN): 1 address; AS134756 (ChinaNet-NANJING-JISHAN-IDC - CHINANET Nanjing Jishan IDC network, CN): 2 addresses; AS136958 (UNICOM-GuangZhou-IDC - China Unicom Guangdong IP network, CN): 1 address; AS4134 (CHINANET-BACKBONE - No.31,Jin-rong Street, CN): 1 address; AS45090 (TENCENT-NET-AP - Shenzhen Tencent Computer Systems Company Limited, CN): 6 addresses; AS4837 (CHINA169-Backbone - CHINA UNICOM China169 Backbone, CN): 2 addresses; AS56046 (CMNET-Jiangsu-AP - China Mobile communications corporation, CN): 2 addresses.
• i

  All nameserver names under .com

  All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

  #12
• ✓ All reachable over IPv6 #13

  Every nameserver has an IPv6 address.

15 of 15 addresses answer authoritatively

Found

Checks

• ✓ All respond #14

  All 15 nameserver addresses answered.
• ✓ All authoritative #15

  Every responding nameserver answers authoritatively for the zone.
• ✓ No recursion #16

  The nameservers do not answer recursive queries for other domains.
• !

  Software version disclosed

  These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: ns13.xincache.com: "DNSPod AUTHORITY DNS 7.3.2512.01"; ns14.xincache.com: "DNSPod AUTHORITY DNS 7.3.2512.01". Hide or replace the version string.

  #17
• ✓ Zone transfers refused #18

  No nameserver allows a zone transfer to the public.
• ✓ TCP supported #19

  All nameservers answer over TCP.
• ✓ EDNS supported #20

  All nameservers support EDNS(0).
• ✓ Public addresses #21

  All nameserver addresses are publicly routable.

serial 1705649948 · primary ns11.xincache.com

Found

Primary (MNAME)

ns11.xincache.com

Contact (RNAME)

ns12.xincache.com

Serial

1705649948

Refresh / retry

3600 s / 180 s

Expire

1209600 s

Negative TTL

180 s

Serial per nameserver

Checks

• ✓ Serial 1705649948 everywhere #22

  All nameservers serve the same version of the zone.
• !

  Unusual SOA timers

  negative caching TTL (minimum) 3m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 1h, retry 3m, expire 14d, negative TTL 3m.

  #23
• i

  Hidden master

  The primary nameserver ns11.xincache.com is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.

  #24
• ✓ Contact ns12@xincache.com #25

  The SOA RNAME ns12.xincache.com means ns12@xincache.com.
• ✓ Timestamp serial #26

  The serial 1705649948 is a Unix timestamp (2024-01-19 07:39 UTC).

Not signed

Found

Validated by resolver

no

Checks

• !

  Not signed

  The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

  #27