service-now.com

Nameservers · These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: aus1.akam.net: "41824.8"; eur6.akam.net: "41824.7"; ns1-234.akam.net: "41824.9"; ns1-234.akam.net: "41824.10"; ns1-98.akam.net: "41824.11"; ns1-98.akam.net: "41824.5"; usc4.akam.net: "48878.30"; use1.akam.net: "48878.29"; use3.akam.net: "41824.7"; usw1.akam.net: "41824.7". Hide or replace the version string.

SOA · The nameservers serve different versions of the zone: 6348579 on aus1.akam.net (184.85.248.65), eur6.akam.net (2.22.230.64), ns1-234.akam.net (193.108.91.234), ns1-234.akam.net (2600:1401:2::ea), ns1-98.akam.net (193.108.91.98), ns1-98.akam.net (2600:1401:2::62), use3.akam.net (96.7.49.65), usw1.akam.net (23.61.199.66); 6348581 on usc4.akam.net (184.26.160.65), use1.akam.net (72.246.46.64); 6348582 on edns140.ultradns.biz (204.74.67.140), edns140.ultradns.biz (2610:a1:1015::28c), edns140.ultradns.com (204.74.66.140), edns140.ultradns.com (2001:502:f3ff::28c), edns140.ultradns.net (204.74.110.140), edns140.ultradns.net (2610:a1:1014::28c), edns140.ultradns.org (204.74.111.140), edns140.ultradns.org (2001:502:4612::28c). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

SOA · refresh 15m is outside 20m–1d; retry 30m should be shorter than refresh 15m. Current values: refresh 15m, retry 30m, expire 365d, negative TTL 1h.

Records · These records have a TTL below 5m, causing extra queries and slower lookups: A (1m), MX (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1h; resolvers may use either.

DKIM · The _domainkey name exists but no DKIM key was found under the common selectors. Selectors are provider-specific; check yours with -selector.

MX · The following MX hosts could not be resolved to IPv6 addresses: mx01.service-now.com, mx02.service-now.com, mx03.service-now.com, mx04.service-now.com

MX · These MX addresses have no PTR record, which many receivers treat as a spam signal: 148.139.29.74 (mx01.service-now.com), 148.139.28.75 (mx02.service-now.com), 149.96.6.75 (mx03.service-now.com), 149.96.5.74 (mx04.service-now.com). Ask your hosting provider to set one.

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.