kuaishou.com

ns3.dnsv5.com, ns4.dnsv5.com

Found

Parent zone

com

Delegation from

a.gtld-servers.net (192.5.6.30)

NS at the parent

ns3.dnsv5.com, ns4.dnsv5.com

NS in the zone

ns3.dnsv5.com, ns4.dnsv5.com

Checks

• i

  2 nameservers

  Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: ns3.dnsv5.com, ns4.dnsv5.com.

  #6
• ✓ Parent and zone agree #7

  The parent delegation and the zone's NS records list the same nameservers.
• !

  Glue differs from the zone

  The addresses at the parent (glue) differ from the addresses in the zone: ns3.dnsv5.com (glue 1.12.0.17, 1.12.0.18, 1.12.14.17, 1.12.14.18, 101.227.168.52, 108.136.87.44, 163.177.5.52, 220.196.136.52, 2402:4e00:1470:2::f, 35.165.107.227, zone 1.12.14.17, 15.160.102.38, 18.134.75.163, 13.37.58.163, 1.12.0.17, 163.177.5.52, 1.12.14.18, 162.62.49.74, 1.12.0.18, 240d:c000:3011::10); ns4.dnsv5.com (glue 1.12.0.16, 1.12.0.19, 1.12.14.16, 1.12.14.19, 117.135.128.152, 124.64.205.152, 13.37.58.163, 2402:4e00:111:fff::8, 49.7.107.152, zone 63.34.1.181, 162.62.49.12, 1.12.14.19, 18.194.2.137, 13.48.202.4, 1.12.14.16, 1.12.0.19, 1.12.0.16, 240d:c000:3011::f). Update the glue at your registrar.

  #8
• ✓ All names resolve #9

  Every nameserver name has an address and is not an alias.
• i

  One address family in one network

  all IPv6 addresses are in 240d:c000:3011::/48, while the other address family is spread over several networks.

  #10
• ✓ 4 autonomous systems #11

  The nameservers are spread over: AS132203 (TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue, CN): 10 addresses; AS136958 (UNICOM-GuangZhou-IDC - China Unicom Guangdong IP network, CN): 1 address; AS16509 (AMAZON-02 - Amazon.com, Inc., US): 6 addresses; AS45090 (TENCENT-NET-AP - Shenzhen Tencent Computer Systems Company Limited, CN): 2 addresses.
• i

  All nameserver names under .com

  All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

  #12
• ✓ All reachable over IPv6 #13

  Every nameserver has an IPv6 address.

19 of 19 addresses answer authoritatively

Found

Checks

• ✓ All respond #14

  All 19 nameserver addresses answered.
• ✓ All authoritative #15

  Every responding nameserver answers authoritatively for the zone.
• ✓ No recursion #16

  The nameservers do not answer recursive queries for other domains.
• !

  Software version disclosed

  These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: ns3.dnsv5.com: "DNSPod AUTHORITY DNS 7.3.2512.01"; ns4.dnsv5.com: "DNSPod AUTHORITY DNS 7.3.2512.01". Hide or replace the version string.

  #17
• ✓ Zone transfers refused #18

  No nameserver allows a zone transfer to the public.
• ✓ TCP supported #19

  All nameservers answer over TCP.
• ✓ EDNS supported #20

  All nameservers support EDNS(0).
• ✓ Public addresses #21

  All nameserver addresses are publicly routable.

serial 1792661540 · primary ns3.dnsv5.com

Found

Primary (MNAME)

ns3.dnsv5.com

Contact (RNAME)

enterprise3dnsadmin.dnspod.com

Serial

1792661540

Refresh / retry

3600 s / 180 s

Expire

1209600 s

Negative TTL

180 s

Serial per nameserver

Checks

• !

  Serials differ

  The nameservers serve different versions of the zone: 1792661418 on ns3.dnsv5.com (240d:c000:3011::10), ns4.dnsv5.com (240d:c000:3011::f); 1792661540 on ns3.dnsv5.com (1.12.14.17), ns3.dnsv5.com (15.160.102.38), ns3.dnsv5.com (18.134.75.163), ns3.dnsv5.com (13.37.58.163), ns3.dnsv5.com (1.12.0.17), ns3.dnsv5.com (163.177.5.52), ns3.dnsv5.com (1.12.14.18), ns3.dnsv5.com (162.62.49.74), ns3.dnsv5.com (1.12.0.18), ns4.dnsv5.com (63.34.1.181), ns4.dnsv5.com (162.62.49.12), ns4.dnsv5.com (1.12.14.19), ns4.dnsv5.com (18.194.2.137), ns4.dnsv5.com (13.48.202.4), ns4.dnsv5.com (1.12.14.16), ns4.dnsv5.com (1.12.0.19), ns4.dnsv5.com (1.12.0.16). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

  #22
• !

  Unusual SOA timers

  negative caching TTL (minimum) 3m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 1h, retry 3m, expire 14d, negative TTL 3m.

  #23
• ✓ Primary is a public nameserver #24

  The primary nameserver ns3.dnsv5.com is one of the listed nameservers.
• ✓ Contact enterprise3dnsadmin@dnspod.com #25

  The SOA RNAME enterprise3dnsadmin.dnspod.com means enterprise3dnsadmin@dnspod.com.
• ✓ Timestamp serial #26

  The serial 1792661540 is a Unix timestamp (2026-10-22 09:32 UTC).

Not signed

Found

Validated by resolver

no

Checks

• !

  Not signed

  The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

  #27

17 records at the apex

Found

Read from

1.12.14.17:53

Checks

• !

  Very low TTLs

  These records have a TTL below 5m, causing extra queries and slower lookups: A (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.

  #32
• ✓ No CNAME at the apex #33

  The zone apex has no CNAME record.
• ✓ No wildcard #34

  Names that don't exist return NXDOMAIN.
• i

  No CAA records

  Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

  #35