weldom.fr

SOA · The nameservers serve different versions of the zone: 2025120914 on ns-cloud-b1.googledomains.com (216.239.32.107), ns-cloud-b1.googledomains.com (2001:4860:4802:32::6b), ns-cloud-b2.googledomains.com (216.239.34.107), ns-cloud-b2.googledomains.com (2001:4860:4802:34::6b), ns-cloud-b3.googledomains.com (216.239.36.107), ns-cloud-b3.googledomains.com (2001:4860:4802:36::6b), ns-cloud-b4.googledomains.com (216.239.38.107), ns-cloud-b4.googledomains.com (2001:4860:4802:38::6b); 2026101716 on nsa.perf1.fr (81.92.94.100), nsa.perf1.fr (2a01:c8:100::100), nsb.perf1.com (81.92.95.100), nsb.perf1.com (2a01:c8:101::100), nsc.perf1.com (152.89.172.100), nsc.perf1.com (2a09:35c0:102::100). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

DNSSEC · The zone is signed but the parent has no DS record, so the signatures are not used. Publish the DS record at your registrar.

DNSSEC · NSEC3 uses 1 iteration and a 8-byte salt. RFC 9276 recommends 0 iterations and no salt: extra iterations cost resolvers CPU and add no real protection, and some validators treat high counts as insecure.

DNSSEC · The zone is signed (DNSKEY present) but the parent has no DS record, so the chain of trust is incomplete. Publish the DS record at your registrar.

MX · The following MX hosts could not be resolved to IPv6 addresses: mxa-004bb303.gslb.pphosted.com, mxb-004bb303.gslb.pphosted.com

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.