monday.com

Delegation · The nameservers at the parent and in the zone should be the same. Only at the parent: ns11.constellix.com; only in the zone: constellix.monday.com. constellix.monday.com, dns1.p07.nsone.net, dns2.p07.nsone.net, dns3.p07.nsone.net, dns4.p07.nsone.net, ns11.constellix.com report NS constellix.monday.com dns1.p07.nsone.net dns2.p07.nsone.net dns3.p07.nsone.net dns4.p07.nsone.net.

SOA · The nameservers serve different versions of the zone: 1653391920 on dns1.p07.nsone.net (198.51.44.7), dns1.p07.nsone.net (2620:4d:4000:6259:7:7:0:1), dns2.p07.nsone.net (198.51.45.7), dns2.p07.nsone.net (2a00:edc0:6259:7:7::2), dns3.p07.nsone.net (198.51.44.71), dns3.p07.nsone.net (2620:4d:4000:6259:7:7:0:3), dns4.p07.nsone.net (198.51.45.71), dns4.p07.nsone.net (2a00:edc0:6259:7:7::4); 2015016059 on constellix.monday.com (96.45.80.1), ns11.constellix.com (96.45.80.1), ns11.constellix.com (2600:180a:1001::1). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

SOA · negative caching TTL (minimum) 3m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 12h, retry 1h, expire 14d, negative TTL 3m.

DNSSEC · The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

DNSSEC · DNSSEC is not enabled for this domain. Consider enabling DNSSEC to protect against DNS spoofing attacks.

DKIM · 1024-bit RSA keys are the minimum and are considered weak today: k1 (1024 bits), s2 (1024 bits). Rotate to a 2048-bit key.

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.