weqct.com

vip1.alidns.com, vip2.alidns.com

Found

Parent zone

com

Delegation from

a.gtld-servers.net (192.5.6.30)

NS at the parent

vip1.alidns.com, vip2.alidns.com

NS in the zone

vip1.alidns.com, vip2.alidns.com

Checks

• i

  2 nameservers

  Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: vip1.alidns.com, vip2.alidns.com.

  #6
• ✓ Parent and zone agree #7

  The parent delegation and the zone's NS records list the same nameservers.
• !

  Glue differs from the zone

  The addresses at the parent (glue) differ from the addresses in the zone: vip1.alidns.com (glue 121.40.6.161, 140.205.1.1, 170.33.32.208, 170.33.73.24, 170.33.80.8, 2408:4009:500::1, 39.103.26.210, 47.116.84.176, 8.129.152.243, 8.212.93.1, zone 170.33.73.24, 170.33.32.208, 170.33.80.8, 140.205.1.1, 8.212.93.1, 2408:4009:500::1); vip2.alidns.com (glue 121.40.6.162, 140.205.1.2, 170.33.32.209, 170.33.73.25, 170.33.80.9, 2408:4009:500::2, 39.103.26.211, 47.116.84.177, 8.129.152.244, 8.212.93.2, zone 170.33.73.25, 170.33.80.9, 8.212.93.2, 140.205.1.2, 170.33.32.209, 2408:4009:500::2). Update the glue at your registrar.

  #8
• ✓ All names resolve #9

  Every nameserver name has an address and is not an alias.
• i

  One address family in one network

  all IPv6 addresses are in 2408:4009:500::/48, while the other address family is spread over several networks.

  #10
• ✓ 3 autonomous systems #11

  The nameservers are spread over: AS134963 (ASEPL-AS-AP - Alibaba Cloud (Singapore) Private Limited, SG): 1 address; AS37963 (ALIBABA-CN-NET - Hangzhou Alibaba Advertising Co.,Ltd., CN): 2 addresses; AS45102 (ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd., CN): 9 addresses.
• i

  All nameserver names under .com

  All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

  #12
• ✓ All reachable over IPv6 #13

  Every nameserver has an IPv6 address.

serial 2018040919 · primary vip1.alidns.com

Found

Primary (MNAME)

vip1.alidns.com

Contact (RNAME)

hostmaster.hichina.com

Serial

2018040919

Refresh / retry

3600 s / 1200 s

Expire

86400 s

Negative TTL

600 s

Serial per nameserver

Checks

• !

  Serials differ

  The nameservers serve different versions of the zone: 2018040919 on vip1.alidns.com (170.33.73.24), vip1.alidns.com (170.33.80.8); 2026081316 on vip1.alidns.com (8.212.93.1); 2026081716 on vip1.alidns.com (170.33.32.208), vip2.alidns.com (170.33.32.209); 2026081810 on vip1.alidns.com (140.205.1.1), vip1.alidns.com (2408:4009:500::1); 2026082415 on vip2.alidns.com (140.205.1.2), vip2.alidns.com (2408:4009:500::2); 2026082516 on vip2.alidns.com (170.33.73.25), vip2.alidns.com (170.33.80.9), vip2.alidns.com (8.212.93.2). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

  #22
• !

  Unusual SOA timers

  expire 1d is shorter than 7d; secondaries stop answering too soon when the primary is down. Current values: refresh 1h, retry 20m, expire 1d, negative TTL 10m.

  #23
• ✓ Primary is a public nameserver #24

  The primary nameserver vip1.alidns.com is one of the listed nameservers.
• ✓ Contact hostmaster@hichina.com #25

  The SOA RNAME hostmaster.hichina.com means hostmaster@hichina.com.
• ✓ Date-based serial #26

  The serial 2018040919 follows the YYYYMMDDnn convention (2018-04-09).

Signed, but no DS at parent

Found

Validated by resolver

no

Denial of existence

NSEC

Signatures valid until

23 October 2026

DNSKEY in the zone

Checks

• !

  Signed but not delegated securely

  The zone is signed but the parent has no DS record, so the signatures are not used. Publish the DS record at your registrar.

  #27
• ✓ Modern algorithms #29

  Key algorithms: ECDSAP256SHA256 (13).
• ✓ Short-lived signatures (online signing) #30

  Signatures are valid for 50h0m0s and created on demand; the current one was made at 2026-10-21 10:30 UTC and expires at 2026-10-23 12:30 UTC.
• i

  NSEC

  The zone uses NSEC, so its full contents can be listed by walking the NSEC chain. That is fine unless the names are sensitive.

  #31