kwekerijdebelder.nl

Delegation · The nameservers at the parent and in the zone should be the same. Only in the zone: xmhvxw.ns3.nameshift.com. ns1.nameshift.com, ns2.nameshift.com, xmhvxw.ns3.nameshift.com report NS ns1.nameshift.com ns2.nameshift.com xmhvxw.ns3.nameshift.com.

Delegation · all IPv4 addresses are in 5.83.212.0/24; all IPv6 addresses are in 2a0e:4001:10::/48. A single network failure takes all nameservers down; RFC 2182 recommends topologically separate networks (anycast setups are an exception).

DNSSEC · The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

DMARC · DMARC policy is set to 'quarantine'. Consider upgrading to 'reject' for stronger protection once you've verified legitimate emails are passing authentication.

DKIM · The _domainkey name exists but no DKIM key was found under the common selectors. Selectors are provider-specific; check yours with -selector.

DNSSEC · DNSSEC is not enabled for this domain. Consider enabling DNSSEC to protect against DNS spoofing attacks.

DMARC · DMARC record has no rua tag, so you receive no aggregate reports about who sends mail as your domain. Add rua=mailto:...

MX · The domain publishes a null MX. If it does not send mail, publish DMARC p=reject so nobody can send mail as this domain.