SurfaceMap › k › kuaishou.com

kuaishou.com

Checked 2026-10-22 09:33 UTC · first added 2026-10-21
✗Problems found Score 60 of 100

Domain & DNS

warn

20 passed 6 warn 0 failed

Areas

iRegistration !Delegation !Nameservers !SOA !DNSSEC !Records

Problems

  • !
    Glue differs from the zone
    Delegation · The addresses at the parent (glue) differ from the addresses in the zone: ns3.dnsv5.com (glue 1.12.0.17, 1.12.0.18, 1.12.14.17, 1.12.14.18, 101.227.168.52, 108.136.87.44, 163.177.5.52, 220.196.136.52, 2402:4e00:1470:2::f, 35.165.107.227, zone 1.12.14.17, 15.160.102.38, 18.134.75.163, 13.37.58.163, 1.12.0.17, 163.177.5.52, 1.12.14.18, 162.62.49.74, 1.12.0.18, 240d:c000:3011::10); ns4.dnsv5.com (glue 1.12.0.16, 1.12.0.19, 1.12.14.16, 1.12.14.19, 117.135.128.152, 124.64.205.152, 13.37.58.163, 2402:4e00:111:fff::8, 49.7.107.152, zone 63.34.1.181, 162.62.49.12, 1.12.14.19, 18.194.2.137, 13.48.202.4, 1.12.14.16, 1.12.0.19, 1.12.0.16, 240d:c000:3011::f). Update the glue at your registrar.
    #8
  • !
    Software version disclosed
    Nameservers · These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: ns3.dnsv5.com: "DNSPod AUTHORITY DNS 7.3.2512.01"; ns4.dnsv5.com: "DNSPod AUTHORITY DNS 7.3.2512.01". Hide or replace the version string.
    #17
  • !
    Serials differ
    SOA · The nameservers serve different versions of the zone: 1792661418 on ns3.dnsv5.com (240d:c000:3011::10), ns4.dnsv5.com (240d:c000:3011::f); 1792661540 on ns3.dnsv5.com (1.12.14.17), ns3.dnsv5.com (15.160.102.38), ns3.dnsv5.com (18.134.75.163), ns3.dnsv5.com (13.37.58.163), ns3.dnsv5.com (1.12.0.17), ns3.dnsv5.com (163.177.5.52), ns3.dnsv5.com (1.12.14.18), ns3.dnsv5.com (162.62.49.74), ns3.dnsv5.com (1.12.0.18), ns4.dnsv5.com (63.34.1.181), ns4.dnsv5.com (162.62.49.12), ns4.dnsv5.com (1.12.14.19), ns4.dnsv5.com (18.194.2.137), ns4.dnsv5.com (13.48.202.4), ns4.dnsv5.com (1.12.14.16), ns4.dnsv5.com (1.12.0.19), ns4.dnsv5.com (1.12.0.16). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.
    #22
  • !
    Unusual SOA timers
    SOA · negative caching TTL (minimum) 3m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 1h, retry 3m, expire 14d, negative TTL 3m.
    #23
  • !
    Not signed
    DNSSEC · The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27
  • !
    Very low TTLs
    Records · These records have a TTL below 5m, causing extra queries and slower lookups: A (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.
    #32

Recent checks

!

Full report

Domain & DNS report for kuaishou.com ›

Mail

fail

22 passed 4 warn 1 failed

Areas

✓SPF ✗DMARC !DKIM !DNSSEC !MX !TLS iBIMI

Problems

  • ✗
    Policy: none (monitoring only)
    DMARC · DMARC policy is set to 'none', which only monitors but doesn't protect against spoofing. Consider upgrading to 'quarantine' or ideally 'reject'.
    #4
  • !
    Not enabled
    DNSSEC · DNSSEC is not enabled for this domain. Consider enabling DNSSEC to protect against DNS spoofing attacks.
    #8
  • !
    Hosts without IPv6
    MX · The following MX hosts could not be resolved to IPv6 addresses: mxhk.kuaishou.com, mxmy.kuaishou.com
    #11
  • !
    1024-bit DKIM key
    DKIM · 1024-bit RSA keys are the minimum and are considered weak today: dkim (1024 bits). Rotate to a 2048-bit key.
    #23
  • !
    Not configured
    TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.
    #32

Recent checks

✗

Full report

Mail report for kuaishou.com ›