themepalace.com

Nameservers · These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: naomi.ns.cloudflare.com: "2026.10.2"; trey.ns.cloudflare.com: "2026.10.2". Hide or replace the version string.

DNSSEC · The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

DNSSEC · DNSSEC is not enabled for this domain. Consider enabling DNSSEC to protect against DNS spoofing attacks.

MX · The following MX hosts could not be resolved to IPv6 addresses: mx1.emailsrvr.com, mx2.emailsrvr.com

DKIM · 1024-bit RSA keys are the minimum and are considered weak today: default (1024 bits), dkim (1024 bits), mail (1024 bits), email (1024 bits), k1 (1024 bits), selector1 (1024 bits), selector2 (1024 bits), google (1024 bits), zoho (1024 bits), mx (1024 bits), key (1024 bits), mta (1024 bits), pm (1024 bits), dkim-smtp (1024 bits), s1 (1024 bits), s2 (1024 bits). Rotate to a 2048-bit key.

MX · The PTR name of these addresses does not resolve back to the same address: 184.106.54.1 -> mx1.emailsrvr.com, 108.166.43.2 -> mx2.emailsrvr.com.

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.