zazzle.com

Delegation · None of the nameservers has an IPv6 address, so IPv6-only resolvers can't reach them.

SOA · The nameservers serve different versions of the zone: 1644081915 on ns05.zazzle.net (198.51.44.6), ns06.zazzle.net (198.51.45.6), ns07.zazzle.net (198.51.44.70), ns08.zazzle.net (198.51.45.70); 2016101188 on ns01.zazzle.net (156.154.64.55), ns02.zazzle.net (156.154.65.55), ns03.zazzle.net (156.154.66.55), ns04.zazzle.net (156.154.67.55). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

SOA · expire 2d is shorter than 7d; secondaries stop answering too soon when the primary is down. Current values: refresh 8h, retry 30m, expire 2d, negative TTL 30m.

DNSSEC · The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

DKIM · The _domainkey name exists but no DKIM key was found under the common selectors. Selectors are provider-specific; check yours with -selector.

DNSSEC · DNSSEC is not enabled for this domain. Consider enabling DNSSEC to protect against DNS spoofing attacks.

MX · The following MX hosts could not be resolved to IPv6 addresses: mxa-001c4901.gslb.pphosted.com, mxb-001c4901.gslb.pphosted.com

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.