elpais.com

What the registry for .com publishes about your domain.

• OK

  Parent name servers

  The .com registry answered from a.gtld-servers.net (192.5.6.30). explain

  a.gtld-servers.net  192.5.6.30
  b.gtld-servers.net  192.33.14.30
  c.gtld-servers.net  192.26.92.30
  d.gtld-servers.net  192.31.80.30
  

• OK

  Delegation at the registry

  The registry delegates the domain to 6 name server(s). explain

  a1-56.akam.net
  a18-65.akam.net
  a20-66.akam.net
  a24-67.akam.net
  a7-64.akam.net
  a9-65.akam.net
  

• OK

  Number of name servers

  6 name servers are delegated, which is a healthy number. explain

• Info

  Glue records

  All name servers are outside this zone, so no glue record is needed. explain

• OK

  Registry and zone agree

  The registry and your name servers publish exactly the same NS list. explain

• OK

  Registration (RDAP)

  Registration data was retrieved over RDAP. explain

  Registrar: Ascio Technologies, Inc. Danmark - Filial af Ascio technologies, Inc. USA
  Registered: 2001-03-05 11:32:34
  Expires: 2027-03-05 11:32:34
  Status: client transfer prohibited
  

Direct queries sent to every authoritative server of the zone.

• Info

  Answering servers

  6 authoritative servers were queried directly over UDP. explain

  Name server	Addresses	Response	Serial	Authoritative	Answers
  a1-56.akam.net	193.108.91.56, 2600:1401:2::38	1.3 ms	264	✓	✓
  a18-65.akam.net	95.101.36.65, 2600:1480:4800::41	4.2 ms	264	✓	✓
  a20-66.akam.net	95.100.175.66, 2a02:26f0:67::42	2.8 ms	264	✓	✓
  a24-67.akam.net	2.16.130.67, 2600:1480:9800::43	3.3 ms	264	✓	✓
  a7-64.akam.net	23.61.199.64, 2600:1406:32::40	31.7 ms	264	✓	✓
  a9-65.akam.net	184.85.248.65, 2a02:26f0:117::41	28.0 ms	264	✓	✓

• OK

  All name servers respond

  Every delegated name server answered a direct UDP query. explain

• OK

  Authoritative answers

  Every server answers authoritatively for the zone. explain

• OK

  SOA serial is in sync

  All name servers report the same serial number (264). explain

• OK

  NS records are identical

  Every server publishes the same NS record set. explain

• OK

  Recursion is disabled

  No name server offers open recursion to the internet. explain

• OK

  DNS over TCP

  Every name server also answers over TCP. explain

• OK

  EDNS(0) support

  Every name server understands EDNS(0). explain

• OK

  Network diversity

  Name servers are spread over 6 different networks. explain

• OK

  IPv6 reachable name servers

  6 of 6 name servers are reachable over IPv6. explain

• OK

  Response time

  Average response time 11.9 ms, slowest 31.7 ms. explain

• Info

  Reverse DNS of the name servers

  Reverse names resolved for the servers. explain

  a1-56.akam.net: a1-56.akam.net
  a18-65.akam.net: a18-65.akam.net
  a20-66.akam.net: a20-66.akam.net
  a24-67.akam.net: a24-67.akam.net
  a7-64.akam.net: a7-64.akam.net
  a9-65.akam.net: a9-65.akam.net
  

The Start Of Authority record and its timers.

• OK

  SOA record exists

  The zone publishes a SOA record. explain

  a1-56.akam.net. prisatecdnsmaster.t-prisa.com. 264 3600 600 604800 300
  

• OK

  Primary server (MNAME)

  The SOA points at a1-56.akam.net, which is one of the delegated name servers. explain

• OK

  Zone contact (RNAME)

  Zone contact: prisatecdnsmaster@t-prisa.com explain

• Info

  Serial number

  The serial is 264. The YYYYMMDDnn format (RFC 1912) makes it obvious when the zone was last edited. explain

• OK

  Refresh

  Refresh is 1h, inside the recommended range. explain

• OK

  Retry

  Retry is 10min, inside the recommended range. explain

• Warning

  Expire

  Expire is 7d, below the recommended minimum of 14d. explain

• OK

  Minimum TTL (negative caching)

  Minimum TTL (negative caching) is 5min, inside the recommended range. explain

• Warning

  TTL values

  Some records use a TTL below 60 seconds, which multiplies the query load and the latency for your visitors. explain

  Record	TTL (s)	Duration
  NS	86400	1d
  A	20	20s
  MX	300	5min
  SOA	300	5min

The records a browser needs to open your site.

• OK

  Address of the domain

  elpais.com resolves to 4 address(es). explain

  23.219.3.197
  23.219.3.209
  2600:1403:9c00:18::1732:70d6
  2600:1403:9c00:18::1732:70d9
  

• OK

  No CNAME at the zone apex

  The zone apex correctly has no CNAME record. explain

• OK

  www subdomain

  www.elpais.com resolves. explain

  prisa-us-eu.map.fastly.net.
  199.232.194.133
  199.232.198.133
  

• OK

  IPv6 (AAAA)

  The site publishes AAAA records and is reachable over IPv6. explain

  2600:1403:9c00:18::1732:70d6
  2600:1403:9c00:18::1732:70d9
  

• Info

  HTTPS (SVCB) record

  No HTTPS resource record. It is optional, but it removes the initial HTTP redirect and advertises HTTP/3 (ECH also relies on it). explain

• OK

  Wildcard record

  Non-existent names correctly return NXDOMAIN (no wildcard). explain

• OK

  Web server answers

  The web server replied with HTTP 200 over HTTPS. explain

  Final URL: https://elpais.com/us/
  

MX records and everything a receiving server checks before accepting your mail.

• OK

  MX records

  4 mail server(s) are published. explain

  Priority	Mail server	Addresses	Reverse DNS
  10	poster1i.iberlayer.com	130.117.89.21, 130.117.89.26, 130.117.89.30, 130.117.89.4, 130.117.89.5, 130.117.89.6	mercurio.iberlayer.com, mercurio2.iberlayer.com, orcus.iberlayer.com, pluton2.iberlayer.com
  20	poster4i.iberlayer.com	80.169.225.36, 80.169.225.37, 80.169.225.38, 80.169.225.56, 80.169.225.57	deimos.iberlayer.com, fobos.iberlayer.com, luna.iberlayer.com, luna2.iberlayer.com
  30	poster2i.iberlayer.com	185.136.219.26	palas.iberlayer.com
  40	poster3i.iberlayer.com	185.136.218.5	hebe.iberlayer.com

• OK

  Mail server redundancy

  4 mail servers provide redundancy. explain

• OK

  MX hosts resolve

  Every mail server resolves to at least one address. explain

• OK

  Reverse DNS of the mail servers

  Every mail server address has a PTR record. explain

  130.117.89.21 -> pluton2.iberlayer.com
  130.117.89.26 -> orcus.iberlayer.com
  130.117.89.30 -> mercurio2.iberlayer.com
  130.117.89.4 -> mercurio.iberlayer.com
  80.169.225.36 -> luna.iberlayer.com
  80.169.225.37 -> fobos.iberlayer.com
  80.169.225.38 -> deimos.iberlayer.com
  80.169.225.56 -> luna2.iberlayer.com
  185.136.219.26 -> palas.iberlayer.com
  185.136.218.5 -> hebe.iberlayer.com
  

• Info

  DANE / TLSA

  No TLSA record. DANE is optional and requires DNSSEC, but it is the strongest protection against downgrade attacks on SMTP. explain

• OK

  Blocklists (DNSBL)

  No mail or web address of this domain is listed on the public blocklists we query. explain

SPF, DKIM, DMARC and the modern transport policies.

• OK

  SPF

  The SPF record ends in -all, so unauthorised senders are rejected or marked. explain

  v=spf1 include:_u.elpais.com._spf.smart.ondmarc.com -all
  DNS lookups used: 2 of 10
  

• OK

  DMARC

  DMARC is enforced with p=reject, the strongest policy. explain

  v=DMARC1; p=reject; pct=100; sp=reject; rua=mailto:4a542fa6@inbox.ondmarc.com; ruf=mailto:4a542fa6@inbox.ondmarc.com; adkim=r; aspf=r; fo=1; rf=afrf; ri=43200
  Aggregate reports go to mailto:4a542fa6@inbox.ondmarc.com
  

• OK

  DKIM

  DKIM keys were found on 1 common selector(s). Only selectors that are published in DNS can be discovered this way. explain

  selector1._domainkey: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvk7KKlxeSGT6ryB0k3nA6SHiD1PBe5JVYW21rpyCUncPnwT1B15Z9+ufEdcGjUv
  

• Info

  MTA-STS

  No MTA-STS policy. It stops attackers from stripping TLS between mail servers and is supported by the large providers. explain

• Info

  TLS-RPT

  No TLS-RPT record. It is the reporting half of MTA-STS and DANE. explain

• OK

  BIMI

  A BIMI record publishes your logo for inboxes that support it. explain

  v=BIMI1; l=https://vmc.digicert.com/0c53a6a8-379a-4295-add5-03d8b11fe871.svg; a=https://vmc.digicert.com/0c53a6a8-379a-4295-add5-03d8b11fe871.pem
  

DNSSEC, certificate authorisation and exposure of the zone.

• Warning

  DNSSEC

  DNSSEC is not enabled. Without it, answers for your domain can be forged on the way to the resolver. explain

• Warning

  CAA

  No CAA record. Any certificate authority in the world may issue a certificate for your domain; a CAA record limits that to the ones you choose. explain

• OK

  Zone transfer (AXFR)

  No name server allows an anonymous zone transfer. explain

• Warning

  Software version disclosure

  The name servers reveal their software version, which tells an attacker exactly which vulnerabilities to try. explain

  a1-56.akam.net: 53811.35
  a18-65.akam.net: 48359.114
  a20-66.akam.net: 48359.116
  a24-67.akam.net: 48359.125
  a7-64.akam.net: 49801.110
  a9-65.akam.net: 23094.199