In order for the availability rate of DNS servers to be at its highest, it is vital and recommended by the RFC to have at least 2 servers.

0.000s

Every DNS servers should be accessible and accept public query.

0.003s

It's important that all servers returned a "success" code.

0.003s

The answers should not be a CNAME or A type.

0.003s

IPs for DNS servers must be different in order to have high availability.

0.000s

The class C of each IP must be different so that the servers are not found on the same bay and therefore there is a risk of unavailability.

0.000s

The SOA answered by the DNS servers must be identical for each servers. The most important information is the master server and the contact email address.

0.000s

An email address must respect some conditions to be valid, accordding to the RFC 5322.

0.000s

The refresh value be must between 1200 and 43200.

0.000s

The Retry, Refresh and Expire values musth follow this path : retry < refresh < expire.

0.000s

DNS resolvers that allow queries from all IP addresses and are exposed to the Internet can be attacked and used to conduct Denial of Service (DoS) attacks on behalf of the hacker.

0.244s

An attacker can use a zone transfer that contains a malicious code or an inappropriate format that crashes a DNS server vulnerable to this type of attack, which results in a DoS that destabilizes the DNS services. It is possible to test it manually with this commands: #host -T axfr or #dig axfr.

0.731s

Having a dns server that allow recursive queries is a security risk, DDOS attack can be performed.

0.247s

It is strictly forbidden to have private IP in DNS

0.000s

It is extremely important that each DNS return the same MX records in order to avoid contacting an SMTP server that no longer exists.

0.269s

A domain must not be blacklisted or it will be penalized for referencing and deliverability of emails.

0.000s

Google safe browsing categorizes a domain as bad if something suspicious is detected.

0.000s

Virus Total analyze your domain or IP address with 66 antivirus.

0.000s

Web Of Trust rates thousands of websites and find threats if they exist.

0.000s

Smtp servers that are listed in DNS area must be accessible, otherwise, there is a risk that emails may be lost

0.000s

When a sending server makes a connection to the recipient server, the recipient server notes the sending IP address and performs a reverse lookup, called a PTR lookup, named after the type of DNS record used. If the result of the reverse lookup matches the result of a forward DNS Lookup, then it's much more likely that the message is legitimate. If the IP address doesn't match, it's much more likely that the sending address was spoofed and therefore much more likely that it's unwanted and could be considered spam.

0.000s

According to the RFC 2181, smtp server should accept HELO command

0.000s

According to the RFC 2181, smtp server should accept EHLO command

0.000s

STARTTLS turns an unencrypted connection into a secure connection. Note: You can use a service like altospam to solve this problem. Click on the link below to learn more

0.000s

EXPN command is now considered to be a security risk, spammers being able to harvest valid e-mail addresses via each mailing list.

0.000s

As the EXPN command, VRFY is used by spammers to verify an address.

0.000s

The banner must return (2xx) a valid (4xx) or temporary code.

0.000s

MX must be a domain, not an IP.

0.000s

According to the RFC 1034 and 2181 CNAME records should not be used with NS and MX

0.041s

To avoid identity theft, it is strongly recommended to configure SPF.

0.000s

SPF record is no longer used, SPF must be into TXT record because many servers do not support SPF record. If SPF record exist, it should be the same as TXT

0.000s

To avoid issue with SPF, it is strongly recommended to configure only one.

0.000s

According to the RFC, the SPF version must be specified.

0.000s

SPF has to start with version's tag.

0.000s

According to the RFC, the mecanism "all" must be specified in the SPF record, except if there is a Redirect tag.

0.000s

The mecanism "All" has to be the last tag in SPF record. Be sure you don't have any dupplicates entry in your field.

0.000s

IPs must be valid, otherwise the SPF will be useless.

0.000s

PTR has become obselete in SPF, should not be found in it.

0.000s

The mecanism "Redirect" has to be the last tag in SPF record. Be sure you don't have any dupplicates entry in your field.

0.000s

SPF record has become obselete, if it is configured then it must be the same as the one present in the TXT record

0.000s

The mecanism "PTR" has to be the last tag in SPF record. Be sure you don't have any dupplicates entry in your field.

0.000s

To avoid identity theft, it is strongly recommended to configure DMARC.

0.000s

To avoid issue with DMARC, it is strongly recommended to configure only one.

0.000s

According to the RFC 7489 section 6.3, the DMARC version is required.

0.000s

According to the RFC 7489 section 6.3, the DMARC version must be the first tag in the list.

0.000s

According to the RFC 7489 section 6.3, the procedure is required.

0.000s

According to the RFC 7489 section 6.3, the procedure value must be none, quarantine or reject.

0.000s

According to the RFC 7489 section 6.3, the subdomain procedure value must be none, quarantine or reject.

0.000s

According to the RFC 7489 section 6.3, the percentage's value must be between 0 and 100.

0.000s

According to the RFC 7489 section 6.3, the adkim tag value must be the letter R or S.

0.000s

According to the RFC 7489 section 6.3, the aspf tag value must be the letter R or S.

0.000s

According to the RFC 7489 section 6.3, the RF tag's value must be afrf or iodef.

0.000s

According to the RFC 7489 section 6.3, the RI tag's value must be an integer.

0.000s

According to the RFC 7489 section 6.3, the RUF tag's value must be a valid email.

0.000s

According to the RFC 7489 section 6.3, the RUA tag's value must be a valid email.

0.000s

The domain must have an A field in order for the website to be accessible.

0.000s

WWW host is not required for a website, but it's better to have one.

0.000s

This test verifies the presence of a website for the given IP or domain. Then scans port 80.
If the domain or IP is pointing to a website then port 80 must be open so that it can be accessed from a browser.
Otherwise port 80 must be closed.

0.000s

This test verifies the presence of a website for the given IP or domain. Then scans port 443.
If the domain or IP is pointing to a website then port 443 must be open so that it can be accessed from a browser.
Otherwise port 443 must be closed.

0.000s

To avoid giving details to malicious people, the version of the server should not be visible.

0.000s

To avoid giving details to malicious people, the technology that supports the application should not be visible.

0.000s

The HTTP X-XSS-Protection response header is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks.

0.000s

The only defined value, "nosniff", prevents Internet Explorer from MIME-sniffing a response away from the declared content-type. This also applies to Google Chrome, when downloading extensions.

0.000s