wsls.com

ns1.grahamdigital.com, ns2.grahamdigital.com, ns3.grahamdigital.com, ns4.grahamdigital.com, ns5.grahamdigital.com, ns6.grahamdigital.com

Found

Parent zone

com

Delegation from

a.gtld-servers.net (192.5.6.30)

NS at the parent

ns1.grahamdigital.com, ns2.grahamdigital.com, ns3.grahamdigital.com, ns4.grahamdigital.com, ns5.grahamdigital.com, ns6.grahamdigital.com

NS in the zone

ns1.grahamdigital.com, ns2.grahamdigital.com, ns3.grahamdigital.com, ns4.grahamdigital.com, ns5.grahamdigital.com, ns6.grahamdigital.com

Checks

• ✓ 6 nameservers #6

  Delegated to ns1.grahamdigital.com, ns2.grahamdigital.com, ns3.grahamdigital.com, ns4.grahamdigital.com, ns5.grahamdigital.com, ns6.grahamdigital.com.
• ✓ Parent and zone agree #7

  The parent delegation and the zone's NS records list the same nameservers.
• !

  Glue differs from the zone

  The addresses at the parent (glue) differ from the addresses in the zone: ns1.grahamdigital.com (glue 208.94.148.4, zone 208.94.148.4, 2600:1800:10::1); ns2.grahamdigital.com (glue 208.80.124.4, zone 208.80.124.4, 2600:1801:11::1); ns3.grahamdigital.com (glue 208.80.126.4, zone 208.80.126.4, 2600:1802:12::1); ns4.grahamdigital.com (glue 208.80.125.4, zone 208.80.125.4, 2600:1801:13::1); ns5.grahamdigital.com (glue 208.80.127.4, zone 208.80.127.4, 2600:1802:14::1); ns6.grahamdigital.com (glue 208.94.149.4, zone 208.94.149.4, 2600:1800:15::1). Update the glue at your registrar.

  #8
• ✓ All names resolve #9

  Every nameserver name has an address and is not an alias.
• ✓ Nameservers in different networks #10

  The nameservers are spread over 6 IPv4 /24s and 6 IPv6 /48s.
• i

  All nameservers in one AS

  All nameserver addresses are announced by one network operator (AS16552 (DIGICERT - Tiggee LLC, US): 12 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.

  #11
• i

  All nameserver names under .com

  All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

  #12
• ✓ All reachable over IPv6 #13

  Every nameserver has an IPv6 address.

serial 2009176067 · primary ns20.digicertdns.com

Found

Primary (MNAME)

ns20.digicertdns.com

Contact (RNAME)

dns.digicertdns.com

Serial

2009176067

Refresh / retry

43200 s / 3600 s

Expire

1209600 s

Negative TTL

180 s

Serial per nameserver

Checks

• ✓ Serial 2009176067 everywhere #22

  All nameservers serve the same version of the zone.
• !

  Unusual SOA timers

  negative caching TTL (minimum) 3m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 12h, retry 1h, expire 14d, negative TTL 3m.

  #23
• i

  Hidden master

  The primary nameserver ns20.digicertdns.com is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.

  #24
• ✓ Contact dns@digicertdns.com #25

  The SOA RNAME dns.digicertdns.com means dns@digicertdns.com.
• ✓ Timestamp serial #26

  The serial 2009176067 is a Unix timestamp (2033-09-01 08:27 UTC).

Not signed

Found

Validated by resolver

no

Checks

• !

  Not signed

  The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

  #27

31 records at the apex

Found

Read from

208.94.148.4:53

Checks

• !

  Very low TTLs

  These records have a TTL below 5m, causing extra queries and slower lookups: MX (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.

  #32
• ✓ No CNAME at the apex #33

  The zone apex has no CNAME record.
• ✓ No wildcard #34

  Names that don't exist return NXDOMAIN.
• i

  No CAA records

  Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

  #35