villeneuvelesmaguelone.fr

SOA · The nameservers serve different versions of the zone: 2026101501 on ns2.ovea.com (79.143.240.9), ns2.ovea.com (2a01:678::9), ns3.ovea.com (79.143.240.10), ns3.ovea.com (2a01:678::10); 2026102201 on ns1.ovea.com (79.143.240.8), ns1.ovea.com (2a01:678::8), ns4.ovea.com (79.143.245.187), ns4.ovea.com (2a01:67a:0:1::187). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

SOA · negative caching TTL (minimum) 2d is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 1d, retry 2h, expire 1000h, negative TTL 2d.

Records · These records have a TTL below 5m, causing extra queries and slower lookups: MX (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 1h and in the zone 2d; resolvers may use either.

DMARC · DMARC policy is set to 'quarantine'. Consider upgrading to 'reject' for stronger protection once you've verified legitimate emails are passing authentication.

MX · The following MX hosts could not be resolved to IPv6 addresses: france.security-mail.net, europe.security-mail.net

DNSSEC · DNSKEY signatures expire at 2026-10-29T00:00:00Z (in 162h0m0s). Check that re-signing works.

DKIM · 1024-bit RSA keys are the minimum and are considered weak today: mail (1024 bits). Rotate to a 2048-bit key.

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.

TLS · MTA-STS or DANE is used without TLS-RPT, so you get no reports when senders fail to deliver because of TLS problems. Publish _smtp._tls TXT "v=TLSRPTv1; rua=mailto:...".