SurfaceMap › s › sj.qq.com

sj.qq.com

Checked 2026-10-22 10:43 UTC · first added 2026-10-21

!Check could not complete

Domain & DNS

error

22 passed 2 warn 3 failed 1 errors

lookups failed for dnssec; results are incomplete

Areas

!Registration iDelegation ✗Nameservers !SOA iDNSSEC ✗Records

Problems

✗

Nameservers not responding

Nameservers · These addresses did not answer, so resolvers waste time on timeouts: ns-cmn1.qq.com (43.140.54.204): read udp 46.225.38.91:34736->43.140.54.204:53: i/o timeout.

#14
✗

No DNS over TCP

Nameservers · DNS over TCP is required (RFC 7766); without it, large answers such as DNSSEC responses fail. Not answering over TCP: ns-cmn1.qq.com (2402:4e00:111:ff4::3): dial tcp [2402:4e00:111:ff4::3]:53: connect: connection refused; ns-cnc1.qq.com (157.255.6.102): read tcp 46.225.38.91:46554->157.255.6.102:53: i/o timeout; ns-cnc1.qq.com (240e:e1:aa00:2002::3): dial tcp [240e:e1:aa00:2002::3]:53: connect: connection refused; ns-os1.qq.com (2402:4e00:111:ff4::3): dial tcp [2402:4e00:111:ff4::3]:53: connect: connection refused; ns-tel1.qq.com (49.7.250.139): read tcp 46.225.38.91:44200->49.7.250.139:53: i/o timeout; ns-tel1.qq.com (240e:e1:aa00:2002::3): dial tcp [240e:e1:aa00:2002::3]:53: connect: connection refused.

#19
✗

CNAME at the apex

Records · The zone apex is a CNAME to sj.qq.com.eo.dnse2.com. A CNAME can't coexist with the SOA and NS records (RFC 1034); use your provider's ALIAS/flattening feature instead.

#33
!

Registry and delegation differ

Registration · Only at the registry: ns1.qq.com, ns2.qq.com, ns3.qq.com, ns4.qq.com; only in the parent zone: ns-cmn1.qq.com, ns-cnc1.qq.com, ns-os1.qq.com, ns-tel1.qq.com. The registry database and the published delegation should be identical; a pending change may not have been published yet.

#5
!

Unusual SOA timers

SOA · refresh 5m is outside 20m–1d; retry 10m should be shorter than refresh 5m; expire 1d is shorter than 7d; secondaries stop answering too soon when the primary is down; negative caching TTL (minimum) 3m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 5m, retry 10m, expire 1d, negative TTL 3m.

#23

Recent checks

Full report

Domain & DNS report for sj.qq.com ›

Mail

error

8 passed 5 warn 3 failed 1 errors

lookups failed for dnssec; results are incomplete

Areas

✗SPF ✗DMARC ✗DKIM iDNSSEC !MX !TLS iBIMI

Problems

✗

Policy: none (monitoring only)

DMARC · DMARC policy is set to 'none', which only monitors but doesn't protect against spoofing. Consider upgrading to 'quarantine' or ideally 'reject'.

#4
✗

No SPF record

SPF · No SPF record was found for this domain. SPF is important for preventing email spoofing. Add an SPF record to specify which servers are authorized to send email for your domain.

#6
✗

No DKIM keys published

DKIM · _domainkey.sj.qq.com does not exist (NXDOMAIN), so no DKIM keys are published. DKIM helps prevent email spoofing. Configure DKIM with your email service provider.

#7
!

Hosts without IPv6

MX · The following MX hosts could not be resolved to IPv6 addresses: mxbiz1.qq.com

#11
!

Single MX host, no backup

MX · Only one MX record found. For better email reliability, consider adding at least one backup MX server.

#12
!

No aggregate reports (rua)

DMARC · DMARC record has no rua tag, so you receive no aggregate reports about who sends mail as your domain. Add rua=mailto:...

#19
!

Addresses without reverse DNS

MX · These MX addresses have no PTR record, which many receivers treat as a spam signal: 103.86.78.2 (mxbiz1.qq.com), 103.86.78.3 (mxbiz1.qq.com). Ask your hosting provider to set one.

#30
!

Not configured

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.

#32

Recent checks

Full report

Mail report for sj.qq.com ›