segye.com

a1-190.akam.net, a26-65.akam.net, a4-67.akam.net, ns1-1.ns-ncloud.com, ns1-2.ns-ncloud.com

Found

Parent zone

com

Delegation from

a.gtld-servers.net (192.5.6.30)

NS at the parent

a1-190.akam.net, a26-65.akam.net, a4-67.akam.net, ns1-1.ns-ncloud.com, ns1-2.ns-ncloud.com

NS in the zone

a1-190.akam.net, a13-67.akam.net, a20-67.akam.net, a26-65.akam.net, a4-67.akam.net, a7-64.akam.net

Checks

• ✓ 5 nameservers #6

  Delegated to a1-190.akam.net, a26-65.akam.net, a4-67.akam.net, ns1-1.ns-ncloud.com, ns1-2.ns-ncloud.com.
• !

  NS sets differ

  The nameservers at the parent and in the zone should be the same. Only at the parent: ns1-1.ns-ncloud.com, ns1-2.ns-ncloud.com; only in the zone: a13-67.akam.net, a20-67.akam.net, a7-64.akam.net. a1-190.akam.net, a13-67.akam.net, a20-67.akam.net, a26-65.akam.net, a4-67.akam.net, a7-64.akam.net report NS a1-190.akam.net a13-67.akam.net a20-67.akam.net a26-65.akam.net a4-67.akam.net a7-64.akam.net. ns1-1.ns-ncloud.com, ns1-2.ns-ncloud.com report NS ns1-1.ns-ncloud.com ns1-2.ns-ncloud.com.

  #7
• ✓ No glue needed #8

  All nameservers are outside the zone, so no glue records are needed.
• ✓ All names resolve #9

  Every nameserver name has an address and is not an alias.
• ✓ Nameservers in different networks #10

  The nameservers are spread over 8 IPv4 /24s and 6 IPv6 /48s.
• ✓ 3 autonomous systems #11

  The nameservers are spread over: AS135354 (NBPAP-AS-AP - NAVER BUSINESS PLATFORM ASIA PACIFIC PTE. LTD., SG): 2 addresses; AS20940 (AKAMAI-ASN1 - Akamai International B.V., NL): 1 address; AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 11 addresses.
• ✓ Nameserver names under 2 TLDs #12

  Nameserver names use the TLDs .com, .net.
• i

  Partly IPv6

  These nameservers have no IPv6 address: ns1-1.ns-ncloud.com, ns1-2.ns-ncloud.com.

  #13

14 of 14 addresses answer authoritatively

Found

Checks

• ✓ All respond #14

  All 14 nameserver addresses answered.
• ✓ All authoritative #15

  Every responding nameserver answers authoritatively for the zone.
• ✓ No recursion #16

  The nameservers do not answer recursive queries for other domains.
• !

  Software version disclosed

  These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: a1-190.akam.net: "41824.6"; a1-190.akam.net: "41824.11"; a13-67.akam.net: "41824.6"; a20-67.akam.net: "48878.30"; a20-67.akam.net: "48878.33"; a26-65.akam.net: "48878.32"; a26-65.akam.net: "48878.31"; a4-67.akam.net: "48878.27"; a4-67.akam.net: "48878.33"; a7-64.akam.net: "41824.4"; a7-64.akam.net: "41824.8". Hide or replace the version string.

  #17
• ✓ Zone transfers refused #18

  No nameserver allows a zone transfer to the public.
• ✓ TCP supported #19

  All nameservers answer over TCP.
• ✓ EDNS supported #20

  All nameservers support EDNS(0).
• ✓ Public addresses #21

  All nameserver addresses are publicly routable.

serial 2025022553 · primary a1-190.akam.net

Found

Primary (MNAME)

a1-190.akam.net

Contact (RNAME)

hostmaster.segye.com

Serial

2025022553

Refresh / retry

3600 s / 600 s

Expire

604800 s

Negative TTL

300 s

Serial per nameserver

Checks

• !

  Serials differ

  The nameservers serve different versions of the zone: 2025022553 on a1-190.akam.net (193.108.91.190), a1-190.akam.net (2600:1401:2::be), a13-67.akam.net (2.22.230.67), a13-67.akam.net (2600:1480:800::43), a20-67.akam.net (95.100.175.67), a20-67.akam.net (2a02:26f0:67::43), a26-65.akam.net (23.74.25.65), a26-65.akam.net (2600:1480:b800::41), a4-67.akam.net (72.246.46.67), a4-67.akam.net (2600:1480:9000::43), a7-64.akam.net (23.61.199.64), a7-64.akam.net (2600:1406:32::40); 243 on ns1-1.ns-ncloud.com (49.236.156.6), ns1-2.ns-ncloud.com (49.236.157.6). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

  #22
• ✓ Timers within recommendations #23

  SOA refresh 1h, retry 10m, expire 7d, negative TTL 5m.
• ✓ Primary is a public nameserver #24

  The primary nameserver a1-190.akam.net is one of the listed nameservers.
• ✓ Contact hostmaster@segye.com #25

  The SOA RNAME hostmaster.segye.com means hostmaster@segye.com.
• ✓ Date-based serial #26

  The serial 2025022553 follows the YYYYMMDDnn convention (2025-02-25).

Not signed

Found

Validated by resolver

no

Checks

• !

  Not signed

  The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

  #27

12 records at the apex

Found

Read from

193.108.91.190:53

Checks

• !

  Very low TTLs

  These records have a TTL below 5m, causing extra queries and slower lookups: A (1m), MX (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1h; resolvers may use either.

  #32
• ✓ No CNAME at the apex #33

  The zone apex has no CNAME record.
• ✓ No wildcard #34

  Names that don't exist return NXDOMAIN.
• i

  No CAA records

  Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

  #35