ksk-koeln.de

Delegation · The nameservers at the parent and in the zone should be the same. Only in the zone: ns5.s-fg-net.com. ns1.s-fg-net.de, ns2.s-fg-net.com, ns3.s-fg-net.eu, ns4.s-fg-net.de, ns5.s-fg-net.com report NS ns1.s-fg-net.de ns2.s-fg-net.com ns3.s-fg-net.eu ns4.s-fg-net.de ns5.s-fg-net.com.

Delegation · None of the nameservers has an IPv6 address, so IPv6-only resolvers can't reach them.

DNSSEC · NSEC3 uses 10 iterations and a 8-byte salt. RFC 9276 recommends 0 iterations and no salt: extra iterations cost resolvers CPU and add no real protection, and some validators treat high counts as insecure.

DKIM · The _domainkey name exists but no DKIM key was found under the common selectors. Selectors are provider-specific; check yours with -selector.

MX · The following MX hosts could not be resolved to IPv6 addresses: kkb01.mail.s-web.de, kkb02.mail.s-web.de

DNSSEC · DNSKEY signatures expire at 2026-10-25T19:30:42Z (in 92h0m0s). Check that re-signing works.

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.