optum.com

Delegation · The nameservers at the parent and in the zone should be the same. Only at the parent: edns4.ultradns.biz, edns4.ultradns.com, edns4.ultradns.net, edns4.ultradns.org. edns4.ultradns.biz, edns4.ultradns.com, edns4.ultradns.net, edns4.ultradns.org, epla1.corpnamesvcs.com, epla2.corpnamesvcs.com report NS epla1.corpnamesvcs.com epla2.corpnamesvcs.com.

SOA · The nameservers serve different versions of the zone: 2958403 on edns4.ultradns.biz (204.74.67.4), edns4.ultradns.biz (2610:a1:1015::204), edns4.ultradns.com (204.74.66.4), edns4.ultradns.com (2001:502:f3ff::204), edns4.ultradns.net (204.74.110.4), edns4.ultradns.net (2610:a1:1014::204), edns4.ultradns.org (204.74.111.4), edns4.ultradns.org (2001:502:4612::204); 2958406 on epla1.corpnamesvcs.com (149.111.128.204), epla2.corpnamesvcs.com (168.183.36.43). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

SOA · refresh 5m is outside 20m–1d. Current values: refresh 5m, retry 30s, expire 7d, negative TTL 15m.

MX · The following MX hosts could not be resolved to IPv6 addresses: mxa-0077b904.gslb.pphosted.com, mxb-0077b904.gslb.pphosted.com

DNSSEC · DNSKEY signatures expire at 2026-10-26T07:17:15Z (in 93h0m0s). Check that re-signing works.

DKIM · 1024-bit RSA keys are the minimum and are considered weak today: selector1 (1024 bits), s2 (1024 bits). Rotate to a 2048-bit key.

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.