SurfaceMap › z › zpkeji.com

zpkeji.com

Checked 2026-10-22 11:44 UTC · first added 2026-10-21

✗Problems found Score 13 of 100

Domain & DNS

fail

21 passed 3 warn 2 failed

Areas

iRegistration iDelegation ✗Nameservers ✓SOA !DNSSEC iRecords

Problems

✗

Nameservers not responding

Nameservers · These addresses did not answer, so resolvers waste time on timeouts: ns1.35.net (240e:d9:c200::2): read udp [2a01:4f8:1c1c:eebf::1]:49129->[240e:d9:c200::2]:53: i/o timeout; ns2.35.net (61.172.183.73): read udp 46.225.38.91:48365->61.172.183.73:53: i/o timeout.

#14
✗

No DNS over TCP

Nameservers · DNS over TCP is required (RFC 7766); without it, large answers such as DNSSEC responses fail. Not answering over TCP: ns1.35.net (118.123.249.114): dial tcp 118.123.249.114:53: i/o timeout; ns2.35.net (211.149.230.100): dial tcp 211.149.230.100:53: i/o timeout; ns2.35.net (240e:d9:c200:1::2): dial tcp [240e:d9:c200:1::2]:53: i/o timeout; ns3.35.net (61.172.183.77): dial tcp 61.172.183.77:53: i/o timeout; ns3.35.net (118.123.249.114): dial tcp 118.123.249.114:53: i/o timeout; ns3.35.net (240e:d9:c200::2): dial tcp [240e:d9:c200::2]:53: i/o timeout; ns4.35.net (211.149.230.100): dial tcp 211.149.230.100:53: i/o timeout; ns4.35.net (240e:d9:c200:1::2): dial tcp [240e:d9:c200:1::2]:53: i/o timeout.

#19
!

Software version disclosed

Nameservers · These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: ns1.35.net: "v1.1"; ns2.35.net: "v1.1"; ns3.35.net: "v1.1"; ns4.35.net: "v1.1". Hide or replace the version string.

#17
!

No EDNS

Nameservers · These nameservers don't support EDNS(0), needed for DNSSEC and answers larger than 512 bytes: ns3.35.net (61.172.183.77).

#20
!

Not signed

DNSSEC · The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Recent checks

✗

Full report

Domain & DNS report for zpkeji.com ›

Mail

fail

11 passed 6 warn 4 failed

Areas

✗SPF ✗DMARC ✗DKIM !DNSSEC !MX !TLS iBIMI

Problems

✗

No 'all' mechanism

SPF · SPF record doesn't have an 'all' mechanism. Add -all or ~all at the end of your SPF record.

#3
✗

No DMARC record

DMARC · No DMARC record was found for this domain. DMARC is essential for preventing email spoofing. Add a DMARC record with p=reject or at least p=quarantine.

#5
✗

No DKIM keys published

DKIM · _domainkey.zpkeji.com does not exist (NXDOMAIN), so no DKIM keys are published. DKIM helps prevent email spoofing. Configure DKIM with your email service provider.

#7
✗

Syntax errors

SPF · Receivers reject the whole SPF record (permerror) because of: unknown mechanism "-a11".

#25
!

1 of 10 DNS lookups, with problems

SPF · SPF record needs 1 DNS lookups (limit is 10). Problems found: include:spf.giye.aliyun.com does not exist or has no records.

#2
!

Not enabled

DNSSEC · DNSSEC is not enabled for this domain. Consider enabling DNSSEC to protect against DNS spoofing attacks.

#8
!

Hosts without IPv6

MX · The following MX hosts could not be resolved to IPv6 addresses: mx1.qiye.aliyun.com, mx2.qiye.aliyun.com, mx3.qiye.aliyun.com

#11
!

1 void lookup

SPF · 1 include/redirect target does not exist or has no records (limit is 2). This usually is a stale include; remove it.

#26
!

Addresses without reverse DNS

MX · These MX addresses have no PTR record, which many receivers treat as a spam signal: 47.246.167.188 (mx1.qiye.aliyun.com), 47.246.146.255 (mx2.qiye.aliyun.com), 47.246.137.47 (mx3.qiye.aliyun.com). Ask your hosting provider to set one.

#30
!

Not configured

TLS · MTA-STS is not configured, so other mail servers fall back to unencrypted delivery when TLS fails or is stripped by an attacker. Publish a _mta-sts TXT record and a policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.

#32

Recent checks

✗

Full report

Mail report for zpkeji.com ›