theatlantic.com

SOA · The nameservers serve different versions of the zone: 1 on ns-1221.awsdns-24.org (205.251.196.197), ns-1221.awsdns-24.org (2600:9000:5304:c500::1), ns-1930.awsdns-49.co.uk (205.251.199.138), ns-1930.awsdns-49.co.uk (2600:9000:5307:8a00::1), ns-332.awsdns-41.com (205.251.193.76), ns-332.awsdns-41.com (2600:9000:5301:4c00::1), ns-930.awsdns-52.net (205.251.195.162), ns-930.awsdns-52.net (2600:9000:5303:a200::1); 112 on ns-cloud-b1.googledomains.com (216.239.32.107), ns-cloud-b1.googledomains.com (2001:4860:4802:32::6b), ns-cloud-b2.googledomains.com (216.239.34.107), ns-cloud-b2.googledomains.com (2001:4860:4802:34::6b), ns-cloud-b3.googledomains.com (216.239.36.107), ns-cloud-b3.googledomains.com (2001:4860:4802:36::6b), ns-cloud-b4.googledomains.com (216.239.38.107), ns-cloud-b4.googledomains.com (2001:4860:4802:38::6b). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

DNSSEC · The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

DNSSEC · DNSSEC is not enabled for this domain. Consider enabling DNSSEC to protect against DNS spoofing attacks.

DKIM · 1024-bit RSA keys are the minimum and are considered weak today: google (1024 bits), s2 (1024 bits). Rotate to a 2048-bit key.

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.