mlc8.com

dns3.hichina.com, dns4.hichina.com, ns1.alidns.com, ns2.alidns.com

Found

Parent zone

com

Delegation from

a.gtld-servers.net (192.5.6.30)

NS at the parent

dns3.hichina.com, dns4.hichina.com, ns1.alidns.com, ns2.alidns.com

NS in the zone

dns3.hichina.com, dns4.hichina.com

Checks

• ✓ 4 nameservers #6

  Delegated to dns3.hichina.com, dns4.hichina.com, ns1.alidns.com, ns2.alidns.com.
• !

  NS sets differ

  The nameservers at the parent and in the zone should be the same. Only at the parent: ns1.alidns.com, ns2.alidns.com. dns3.hichina.com, dns4.hichina.com, ns1.alidns.com, ns2.alidns.com report NS dns3.hichina.com dns4.hichina.com.

  #7
• ✓ No glue needed #8

  All nameservers are outside the zone, so no glue records are needed.
• ✓ All names resolve #9

  Every nameserver name has an address and is not an alias.
• i

  One address family in one network

  all IPv6 addresses are in 2408:4009:501::/48, while the other address family is spread over several networks.

  #10
• i

  All nameservers in one AS

  All nameserver addresses are announced by one network operator (AS37963 (ALIBABA-CN-NET - Hangzhou Alibaba Advertising Co.,Ltd., CN): 36 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.

  #11
• i

  All nameserver names under .com

  All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

  #12
• ✓ All reachable over IPv6 #13

  Every nameserver has an IPv6 address.

serial 2026082616 · primary dns3.hichina.com

Found

Primary (MNAME)

dns3.hichina.com

Contact (RNAME)

hostmaster.hichina.com

Serial

2026082616

Refresh / retry

3600 s / 1200 s

Expire

86400 s

Negative TTL

600 s

Serial per nameserver

Checks

• !

  Serials differ

  The nameservers serve different versions of the zone: 2023072720 on dns3.hichina.com (139.224.142.123), dns4.hichina.com (139.224.142.124), ns2.alidns.com (139.224.142.116); 2026081813 on dns3.hichina.com (120.76.107.43), dns4.hichina.com (120.76.107.54), dns4.hichina.com (2408:4009:501::12), ns1.alidns.com (2408:4009:501::1), ns2.alidns.com (2408:4009:501::2); 2026082509 on dns3.hichina.com (2408:4009:501::11), ns1.alidns.com (120.76.107.45), ns2.alidns.com (120.76.107.46); 2026082616 on dns3.hichina.com (39.96.153.63), dns3.hichina.com (120.76.107.63), dns3.hichina.com (139.224.142.113), dns3.hichina.com (39.96.153.43), dns3.hichina.com (47.118.199.203), dns4.hichina.com (39.96.153.54), dns4.hichina.com (139.224.142.114), dns4.hichina.com (39.96.153.44), dns4.hichina.com (47.118.199.204), ns1.alidns.com (120.76.107.55), ns1.alidns.com (39.96.153.45), ns1.alidns.com (139.224.142.125), ns2.alidns.com (139.224.142.126), ns2.alidns.com (39.96.153.46), ns2.alidns.com (47.118.199.206), ns2.alidns.com (39.96.153.56), ns2.alidns.com (120.76.107.56); 2026082617 on dns4.hichina.com (120.76.107.44), ns1.alidns.com (39.96.153.55); 2026082709 on ns1.alidns.com (139.224.142.115); 2026082815 on dns3.hichina.com (47.118.199.213), dns4.hichina.com (47.118.199.214), ns1.alidns.com (47.118.199.215), ns1.alidns.com (47.118.199.205), ns2.alidns.com (47.118.199.216). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

  #22
• !

  Unusual SOA timers

  expire 1d is shorter than 7d; secondaries stop answering too soon when the primary is down. Current values: refresh 1h, retry 20m, expire 1d, negative TTL 10m.

  #23
• ✓ Primary is a public nameserver #24

  The primary nameserver dns3.hichina.com is one of the listed nameservers.
• ✓ Contact hostmaster@hichina.com #25

  The SOA RNAME hostmaster.hichina.com means hostmaster@hichina.com.
• ✓ Date-based serial #26

  The serial 2026082616 follows the YYYYMMDDnn convention (2026-08-26).

Not signed

Found

Validated by resolver

no

Checks

• !

  Not signed

  The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

  #27