travelzoo.com

Delegation · The nameservers at the parent and in the zone should be the same. Only at the parent: use4.akam.net. asia4.akam.net, eur1.akam.net, eur4.akam.net, ns1-225.akam.net, ns1-245.akam.net, usc2.akam.net, use4.akam.net, use9.akam.net report NS asia4.akam.net eur1.akam.net eur4.akam.net ns1-225.akam.net ns1-245.akam.net usc2.akam.net use9.akam.net.

Nameservers · These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: asia4.akam.net: "41824.8"; eur1.akam.net: "48878.29"; eur4.akam.net: "41824.6"; ns1-225.akam.net: "41824.8"; ns1-225.akam.net: "41824.6"; ns1-245.akam.net: "41824.5"; ns1-245.akam.net: "41824.8"; usc2.akam.net: "48878.29"; use4.akam.net: "48878.31"; use9.akam.net: "48878.32". Hide or replace the version string.

SOA · refresh 1m30s is outside 20m–1d; retry 5m should be shorter than refresh 1m30s. Current values: refresh 1m30s, retry 5m, expire 7d, negative TTL 1h.

DNSSEC · The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

Records · These records have a TTL below 5m, causing extra queries and slower lookups: A (20s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 15m; resolvers may use either.

DNSSEC · DNSSEC is not enabled for this domain. Consider enabling DNSSEC to protect against DNS spoofing attacks.

MX · The following MX hosts could not be resolved to IPv6 addresses: us-smtp-inbound-1.mimecast.com, us-smtp-inbound-2.mimecast.com

DKIM · 1024-bit RSA keys are the minimum and are considered weak today: selector2 (1024 bits), google (1024 bits). Rotate to a 2048-bit key.

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.