universalpictures.com

ns1.nbcuni.com, ns2.nbcuni.com, ns3.nbcuni.com, ns4.nbcuni.com, ns5.nbcuni.com, ns6.nbcuni.com

Found

Parent zone

com

Delegation from

a.gtld-servers.net (192.5.6.30)

NS at the parent

ns1.nbcuni.com, ns2.nbcuni.com, ns3.nbcuni.com, ns4.nbcuni.com, ns5.nbcuni.com, ns6.nbcuni.com

NS in the zone

ns1.nbcuni.com, ns2.nbcuni.com, ns3.nbcuni.com, ns4.nbcuni.com, ns5.nbcuni.com, ns6.nbcuni.com

Checks

• ✓ 6 nameservers #6

  Delegated to ns1.nbcuni.com, ns2.nbcuni.com, ns3.nbcuni.com, ns4.nbcuni.com, ns5.nbcuni.com, ns6.nbcuni.com.
• ✓ Parent and zone agree #7

  The parent delegation and the zone's NS records list the same nameservers.
• !

  Glue differs from the zone

  The addresses at the parent (glue) differ from the addresses in the zone: ns1.nbcuni.com (glue 156.154.64.31, zone 156.154.64.31, 2001:502:f3ff::31); ns2.nbcuni.com (glue 156.154.65.31, zone 156.154.65.31, 2610:a1:1014::31); ns3.nbcuni.com (glue 156.154.66.31, zone 156.154.66.31, 2610:a1:1015::31); ns4.nbcuni.com (glue 156.154.67.31, zone 156.154.67.31, 2001:502:4612::31); ns5.nbcuni.com (glue 156.154.68.31, zone 156.154.68.31, 2610:a1:1016::31); ns6.nbcuni.com (glue 156.154.69.31, zone 156.154.69.31, 2610:a1:1017::31). Update the glue at your registrar.

  #8
• ✓ All names resolve #9

  Every nameserver name has an address and is not an alias.
• ✓ Nameservers in different networks #10

  The nameservers are spread over 6 IPv4 /24s and 6 IPv6 /48s.
• i

  All nameservers in one AS

  All nameserver addresses are announced by one network operator (AS12008 (VERCARA - Vercara, LLC, US): 12 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.

  #11
• i

  All nameserver names under .com

  All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

  #12
• ✓ All reachable over IPv6 #13

  Every nameserver has an IPv6 address.

serial 2014020643 · primary ns1.nbcuni.com

Found

Primary (MNAME)

ns1.nbcuni.com

Contact (RNAME)

domain\.admin.nbcuni.com

Serial

2014020643

Refresh / retry

900 s / 3600 s

Expire

2592000 s

Negative TTL

900 s

Serial per nameserver

Checks

• ✓ Serial 2014020643 everywhere #22

  All nameservers serve the same version of the zone.
• !

  Unusual SOA timers

  refresh 15m is outside 20m–1d; retry 1h should be shorter than refresh 15m. Current values: refresh 15m, retry 1h, expire 30d, negative TTL 15m.

  #23
• ✓ Primary is a public nameserver #24

  The primary nameserver ns1.nbcuni.com is one of the listed nameservers.
• ✓ Contact domain.admin@nbcuni.com #25

  The SOA RNAME domain\.admin.nbcuni.com means domain.admin@nbcuni.com.
• ✓ Date-based serial #26

  The serial 2014020643 follows the YYYYMMDDnn convention (2014-02-06).

Not signed

Found

Validated by resolver

no

Checks

• !

  Not signed

  The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

  #27

17 records at the apex

Found

Read from

156.154.64.31:53

Checks

• !

  Very low TTLs

  These records have a TTL below 5m, causing extra queries and slower lookups: A (1m39s), MX (1m39s), NS (1m39s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1m39s; resolvers may use either.

  #32
• ✓ No CNAME at the apex #33

  The zone apex has no CNAME record.
• ✓ No wildcard #34

  Names that don't exist return NXDOMAIN.
• i

  No CAA records

  Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

  #35