sunjets.be

udns1.cscdns.net, udns2.cscdns.net

Found

Parent zone

be

Delegation from

a.nsset.be (194.0.6.1)

NS at the parent

udns1.cscdns.net, udns2.cscdns.net

NS in the zone

a1-174.akam.net, a20-67.akam.net, a3-64.akam.net, a4-65.akam.net, a5-66.akam.net, a8-67.akam.net, udns1.cscdns.net, udns2.cscdns.uk

Checks

• i

  2 nameservers

  Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: udns1.cscdns.net, udns2.cscdns.net.

  #6
• !

  NS sets differ

  The nameservers at the parent and in the zone should be the same. Only at the parent: udns2.cscdns.net; only in the zone: a1-174.akam.net, a20-67.akam.net, a3-64.akam.net, a4-65.akam.net, a5-66.akam.net, a8-67.akam.net, udns2.cscdns.uk. a1-174.akam.net, a20-67.akam.net, a3-64.akam.net, a4-65.akam.net, a5-66.akam.net, a8-67.akam.net report NS a1-174.akam.net a20-67.akam.net a3-64.akam.net a4-65.akam.net a5-66.akam.net a8-67.akam.net. udns1.cscdns.net, udns2.cscdns.net, udns2.cscdns.uk report NS a1-174.akam.net a20-67.akam.net a3-64.akam.net a4-65.akam.net a5-66.akam.net a8-67.akam.net udns1.cscdns.net udns2.cscdns.uk.

  #7
• ✓ No glue needed #8

  All nameservers are outside the zone, so no glue records are needed.
• ✓ All names resolve #9

  Every nameserver name has an address and is not an alias.
• ✓ Nameservers in different networks #10

  The nameservers are spread over 8 IPv4 /24s and 8 IPv6 /48s.
• ✓ 2 autonomous systems #11

  The nameservers are spread over: AS12008 (VERCARA - Vercara, LLC, US): 6 addresses; AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 12 addresses.
• i

  All nameserver names under .net

  All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

  #12
• ✓ All reachable over IPv6 #13

  Every nameserver has an IPv6 address.

18 of 18 addresses answer authoritatively

Found

Checks

• ✓ All respond #14

  All 18 nameserver addresses answered.
• ✓ All authoritative #15

  Every responding nameserver answers authoritatively for the zone.
• ✓ No recursion #16

  The nameservers do not answer recursive queries for other domains.
• !

  Software version disclosed

  These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: a1-174.akam.net: "41824.6"; a1-174.akam.net: "41824.5"; a20-67.akam.net: "48878.26"; a20-67.akam.net: "48878.27"; a3-64.akam.net: "41824.4"; a3-64.akam.net: "41824.5"; a4-65.akam.net: "48878.27"; a4-65.akam.net: "48878.30"; a5-66.akam.net: "41824.9"; a5-66.akam.net: "41824.7"; a8-67.akam.net: "48878.32"; a8-67.akam.net: "48878.26". Hide or replace the version string.

  #17
• ✓ Zone transfers refused #18

  No nameserver allows a zone transfer to the public.
• ✓ TCP supported #19

  All nameservers answer over TCP.
• ✓ EDNS supported #20

  All nameservers support EDNS(0).
• ✓ Public addresses #21

  All nameserver addresses are publicly routable.

serial 2021082001 · primary ns1.tui.nl

Found

Primary (MNAME)

ns1.tui.nl

Contact (RNAME)

noc.tui.nl

Serial

2021082001

Refresh / retry

300 s / 3600 s

Expire

604800 s

Negative TTL

300 s

Serial per nameserver

Checks

• !

  Serials differ

  The nameservers serve different versions of the zone: 2021082001 on a1-174.akam.net (193.108.91.174), a1-174.akam.net (2600:1401:2::ae), a20-67.akam.net (95.100.175.67), a20-67.akam.net (2a02:26f0:67::43), a3-64.akam.net (96.7.49.64), a3-64.akam.net (2600:1408:1c::40), a4-65.akam.net (72.246.46.65), a4-65.akam.net (2600:1480:9000::41), a5-66.akam.net (95.100.168.66), a5-66.akam.net (2600:1480:b000::42), a8-67.akam.net (2.16.40.67), a8-67.akam.net (2600:1403:a::43); 2021112516 on udns1.cscdns.net (204.74.66.1), udns1.cscdns.net (2001:502:f3ff::201), udns2.cscdns.net (204.74.111.1), udns2.cscdns.net (2001:502:4612::201), udns2.cscdns.uk (204.74.111.1), udns2.cscdns.uk (2001:502:4612::201). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

  #22
• !

  Unusual SOA timers

  refresh 5m is outside 20m–1d; retry 1h should be shorter than refresh 5m. Current values: refresh 5m, retry 1h, expire 7d, negative TTL 5m.

  #23
• i

  Hidden master

  The primary nameserver ns1.tui.nl is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.

  #24
• ✓ Contact noc@tui.nl #25

  The SOA RNAME noc.tui.nl means noc@tui.nl.
• ✓ Date-based serial #26

  The serial 2021082001 follows the YYYYMMDDnn convention (2021-08-20).

Not signed

Found

Validated by resolver

no

Checks

• !

  Not signed

  The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

  #27