ncl.com

Delegation · The nameservers at the parent and in the zone should be the same. Only at the parent: ns10.dnsmadeeasy.com, ns11.dnsmadeeasy.com, ns12.dnsmadeeasy.com; only in the zone: dns34.cloudns.net. dns31.cloudns.net, dns32.cloudns.net, dns33.cloudns.net, dns34.cloudns.net report NS dns31.cloudns.net dns32.cloudns.net dns33.cloudns.net dns34.cloudns.net. ns10.dnsmadeeasy.com, ns11.dnsmadeeasy.com, ns12.dnsmadeeasy.com report NS ns10.dnsmadeeasy.com ns11.dnsmadeeasy.com ns12.dnsmadeeasy.com ns13.dnsmadeeasy.com ns14.dnsmadeeasy.com ns15.dnsmadeeasy.com.

SOA · The nameservers serve different versions of the zone: 2009012214 on ns10.dnsmadeeasy.com (208.94.148.4), ns10.dnsmadeeasy.com (2600:1800:10::1), ns11.dnsmadeeasy.com (208.80.124.4), ns11.dnsmadeeasy.com (2600:1801:11::1), ns12.dnsmadeeasy.com (208.80.126.4), ns12.dnsmadeeasy.com (2600:1802:12::1); 2026100102 on dns31.cloudns.net (185.136.96.100), dns31.cloudns.net (2a06:fb00:1::1:100), dns32.cloudns.net (185.136.97.100), dns32.cloudns.net (2a06:fb00:1::2:100), dns33.cloudns.net (185.136.98.100), dns33.cloudns.net (2a06:fb00:1::3:100), dns34.cloudns.net (185.136.99.100), dns34.cloudns.net (2a06:fb00:1::4:100). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

DNSSEC · The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

DNSSEC · DNSSEC is not enabled for this domain. Consider enabling DNSSEC to protect against DNS spoofing attacks.

MX · The following MX hosts could not be resolved to IPv6 addresses: mx0a-0024dd01.pphosted.com, mx0b-0024dd01.pphosted.com

DKIM · 1024-bit RSA keys are the minimum and are considered weak today: k1 (1024 bits). Rotate to a 2048-bit key.

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.