mrsskin.fr

cruz.ns.cloudflare.com, roman.ns.cloudflare.com

Found

Parent zone

fr

Delegation from

d.nic.fr (194.0.9.1)

NS at the parent

cruz.ns.cloudflare.com, roman.ns.cloudflare.com

NS in the zone

cruz.ns.cloudflare.com, ns1020.ui-dns.org, ns1038.ui-dns.com, ns1064.ui-dns.de, ns1071.ui-dns.org, ns1104.ui-dns.biz, ns1112.ui-dns.com, ns1120.ui-dns.de, ns1124.ui-dns.biz, roman.ns.cloudflare.com

Checks

• i

  2 nameservers

  Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: cruz.ns.cloudflare.com, roman.ns.cloudflare.com.

  #6
• !

  NS sets differ

  The nameservers at the parent and in the zone should be the same. Only in the zone: ns1020.ui-dns.org, ns1038.ui-dns.com, ns1064.ui-dns.de, ns1071.ui-dns.org, ns1104.ui-dns.biz, ns1112.ui-dns.com, ns1120.ui-dns.de, ns1124.ui-dns.biz. cruz.ns.cloudflare.com, roman.ns.cloudflare.com report NS cruz.ns.cloudflare.com ns1020.ui-dns.org ns1038.ui-dns.com ns1064.ui-dns.de ns1071.ui-dns.org ns1104.ui-dns.biz ns1112.ui-dns.com ns1120.ui-dns.de ns1124.ui-dns.biz roman.ns.cloudflare.com.

  #7
• ✓ No glue needed #8

  All nameservers are outside the zone, so no glue records are needed.
• ✓ All names resolve #9

  Every nameserver name has an address and is not an alias.
• ✓ Nameservers in different networks #10

  The nameservers are spread over 10 IPv4 /24s and 5 IPv6 /48s.
• ✓ 2 autonomous systems #11

  The nameservers are spread over: AS13335 (CLOUDFLARENET - Cloudflare, Inc., US): 12 addresses; AS15418 (IONOS-ANYCAST - Fasthosts Internet Limited, GB): 16 addresses.
• i

  All nameserver names under .com

  All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

  #12
• ✓ All reachable over IPv6 #13

  Every nameserver has an IPv6 address.

28 of 28 addresses answer authoritatively

Found

Checks

• ✓ All respond #14

  All 28 nameserver addresses answered.
• ✓ All authoritative #15

  Every responding nameserver answers authoritatively for the zone.
• ✓ No recursion #16

  The nameservers do not answer recursive queries for other domains.
• !

  Software version disclosed

  These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: cruz.ns.cloudflare.com: "2026.10.2"; roman.ns.cloudflare.com: "2026.10.2". Hide or replace the version string.

  #17
• ✓ Zone transfers refused #18

  No nameserver allows a zone transfer to the public.
• ✓ TCP supported #19

  All nameservers answer over TCP.
• ✓ EDNS supported #20

  All nameservers support EDNS(0).
• ✓ Public addresses #21

  All nameserver addresses are publicly routable.

serial 2418012621 · primary cruz.ns.cloudflare.com

Found

Primary (MNAME)

cruz.ns.cloudflare.com

Contact (RNAME)

dns.cloudflare.com

Serial

2418012621

Refresh / retry

10000 s / 2400 s

Expire

604800 s

Negative TTL

1800 s

Serial per nameserver

Checks

• !

  Serials differ

  The nameservers serve different versions of the zone: 2017060152 on ns1020.ui-dns.org (185.132.35.20), ns1020.ui-dns.org (2607:f1c0:fe:53:185:132:35:20), ns1038.ui-dns.com (185.132.34.38), ns1038.ui-dns.com (2607:f1c0:fe:53:185:132:34:38), ns1064.ui-dns.de (185.132.32.64), ns1064.ui-dns.de (2607:f1c0:fe:53:185:132:32:64), ns1071.ui-dns.org (185.132.35.71), ns1071.ui-dns.org (2607:f1c0:fe:53:185:132:35:71), ns1104.ui-dns.biz (185.132.33.104), ns1104.ui-dns.biz (2607:f1c0:fe:53:185:132:33:104), ns1112.ui-dns.com (185.132.34.112), ns1112.ui-dns.com (2607:f1c0:fe:53:185:132:34:112), ns1120.ui-dns.de (185.132.32.120), ns1120.ui-dns.de (2607:f1c0:fe:53:185:132:32:120), ns1124.ui-dns.biz (185.132.33.124), ns1124.ui-dns.biz (2607:f1c0:fe:53:185:132:33:124); 2418012621 on cruz.ns.cloudflare.com (108.162.192.88), cruz.ns.cloudflare.com (173.245.58.88), cruz.ns.cloudflare.com (172.64.32.88), cruz.ns.cloudflare.com (2606:4700:50::adf5:3a58), cruz.ns.cloudflare.com (2a06:98c1:50::ac40:2058), cruz.ns.cloudflare.com (2803:f800:50::6ca2:c058), roman.ns.cloudflare.com (172.64.35.103), roman.ns.cloudflare.com (108.162.195.103), roman.ns.cloudflare.com (162.159.44.103), roman.ns.cloudflare.com (2803:f800:50::6ca2:c367), roman.ns.cloudflare.com (2a06:98c1:50::ac40:2367), roman.ns.cloudflare.com (2606:4700:58::a29f:2c67). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

  #22
• ✓ Timers within recommendations #23

  SOA refresh 2h46m40s, retry 40m, expire 7d, negative TTL 30m.
• ✓ Primary is a public nameserver #24

  The primary nameserver cruz.ns.cloudflare.com is one of the listed nameservers.
• ✓ Contact dns@cloudflare.com #25

  The SOA RNAME dns.cloudflare.com means dns@cloudflare.com.
• ✓ Timestamp serial #26

  The serial 2418012621 is a Unix timestamp (2046-08-16 06:10 UTC).

Signed, but no DS at parent

Found

Validated by resolver

no

Denial of existence

NSEC

Signatures valid until

23 October 2026

DNSKEY in the zone

Checks

• !

  Signed but not delegated securely

  The zone is signed but the parent has no DS record, so the signatures are not used. Publish the DS record at your registrar.

  #27
• ✓ Modern algorithms #29

  Key algorithms: ECDSAP256SHA256 (13).
• ✓ Short-lived signatures (online signing) #30

  Signatures are valid for 50h0m0s and created on demand; the current one was made at 2026-10-21 03:26 UTC and expires at 2026-10-23 05:26 UTC.
• i

  NSEC

  The zone uses NSEC, so its full contents can be listed by walking the NSEC chain. That is fine unless the names are sensitive.

  #31