github.com

What the registry for .com publishes about your domain.

• OK

  Parent name servers

  The .com registry answered from a.gtld-servers.net (192.5.6.30). explain

  a.gtld-servers.net  192.5.6.30
  b.gtld-servers.net  192.33.14.30
  c.gtld-servers.net  192.26.92.30
  d.gtld-servers.net  192.31.80.30
  

• OK

  Delegation at the registry

  The registry delegates the domain to 8 name server(s). explain

  dns1.p08.nsone.net
  dns2.p08.nsone.net
  dns3.p08.nsone.net
  dns4.p08.nsone.net
  ns-1283.awsdns-32.org
  ns-1707.awsdns-21.co.uk
  ns-421.awsdns-52.com
  ns-520.awsdns-01.net
  

• Warning

  Number of name servers

  8 name servers are delegated. More than seven rarely helps and makes referral answers larger. explain

• Info

  Glue records

  All name servers are outside this zone, so no glue record is needed. explain

• OK

  Registry and zone agree

  The registry and your name servers publish exactly the same NS list. explain

• OK

  Registration (RDAP)

  Registration data was retrieved over RDAP. explain

  Registrar: MarkMonitor Inc.
  Registered: 2007-10-09 18:20:50
  Expires: 2028-10-09 18:20:50
  Status: client delete prohibited, client transfer prohibited, client update prohibited
  

Direct queries sent to every authoritative server of the zone.

• Info

  Answering servers

  8 authoritative servers were queried directly over UDP. explain

  Name server	Addresses	Response	Serial	Authoritative	Answers
  dns1.p08.nsone.net	198.51.44.8, 2620:4d:4000:6259:7:8:0:1	3.0 ms	1656468023	✓	✓
  dns2.p08.nsone.net	198.51.45.8, 2a00:edc0:6259:7:8::2	2.6 ms	1656468023	✓	✓
  dns3.p08.nsone.net	198.51.44.72, 2620:4d:4000:6259:7:8:0:3	2.3 ms	1656468023	✓	✓
  dns4.p08.nsone.net	198.51.45.72, 2a00:edc0:6259:7:8::4	2.8 ms	1656468023	✓	✓
  ns-1283.awsdns-32.org	205.251.197.3, 2600:9000:5305:300::1	64.9 ms	1	✓	✓
  ns-1707.awsdns-21.co.uk	205.251.198.171, 2600:9000:5306:ab00::1	1.7 ms	1	✓	✓
  ns-421.awsdns-52.com	205.251.193.165, 2600:9000:5301:a500::1	1.6 ms	1	✓	✓
  ns-520.awsdns-01.net	205.251.194.8, 2600:9000:5302:800::1	39.1 ms	1	✓	✓

• OK

  All name servers respond

  Every delegated name server answered a direct UDP query. explain

• OK

  Authoritative answers

  Every server answers authoritatively for the zone. explain

• Error

  SOA serial is in sync

  Your name servers do not agree on the SOA serial number, so at least one of them is serving stale data. explain

  dns1.p08.nsone.net: 1656468023
  dns2.p08.nsone.net: 1656468023
  dns3.p08.nsone.net: 1656468023
  dns4.p08.nsone.net: 1656468023
  ns-1283.awsdns-32.org: 1
  ns-1707.awsdns-21.co.uk: 1
  ns-421.awsdns-52.com: 1
  ns-520.awsdns-01.net: 1
  

• OK

  NS records are identical

  Every server publishes the same NS record set. explain

• OK

  Recursion is disabled

  No name server offers open recursion to the internet. explain

• OK

  DNS over TCP

  Every name server also answers over TCP. explain

• OK

  EDNS(0) support

  Every name server understands EDNS(0). explain

• OK

  Network diversity

  Name servers are spread over 6 different networks. explain

• OK

  IPv6 reachable name servers

  8 of 8 name servers are reachable over IPv6. explain

• OK

  Response time

  Average response time 14.8 ms, slowest 64.9 ms. explain

• Info

  Reverse DNS of the name servers

  Reverse names resolved for the servers. explain

  dns1.p08.nsone.net: dns1.p08.nsone.net
  dns2.p08.nsone.net: dns2.p08.nsone.net
  dns3.p08.nsone.net: dns3.p08.nsone.net
  dns4.p08.nsone.net: dns4.p08.nsone.net
  ns-1283.awsdns-32.org: ns-1283.awsdns-32.org
  ns-1707.awsdns-21.co.uk: ns-1707.awsdns-21.co.uk
  ns-421.awsdns-52.com: ns-421.awsdns-52.com
  ns-520.awsdns-01.net: ns-520.awsdns-01.net
  

The Start Of Authority record and its timers.

• OK

  SOA record exists

  The zone publishes a SOA record. explain

  ns-1707.awsdns-21.co.uk. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
  

• OK

  Primary server (MNAME)

  The SOA points at ns-1707.awsdns-21.co.uk, which is one of the delegated name servers. explain

• OK

  Zone contact (RNAME)

  Zone contact: awsdns-hostmaster@amazon.com explain

• Info

  Serial number

  The serial is 1. The YYYYMMDDnn format (RFC 1912) makes it obvious when the zone was last edited. explain

• OK

  Refresh

  Refresh is 2h, inside the recommended range. explain

• OK

  Retry

  Retry is 15min, inside the recommended range. explain

• OK

  Expire

  Expire is 14d, inside the recommended range. explain

• OK

  Minimum TTL (negative caching)

  Minimum TTL (negative caching) is 1d, inside the recommended range. explain

• Warning

  TTL values

  Some records use a TTL below 60 seconds, which multiplies the query load and the latency for your visitors. explain

  Record	TTL (s)	Duration
  NS	450	450s
  A	36	36s
  MX	300	5min
  SOA	900	15min

The records a browser needs to open your site.

• OK

  Address of the domain

  github.com resolves to 1 address(es). explain

  140.82.113.4
  

• OK

  No CNAME at the zone apex

  The zone apex correctly has no CNAME record. explain

• OK

  www subdomain

  www.github.com resolves. explain

  github.com.
  140.82.112.3
  

• Warning

  IPv6 (AAAA)

  No AAAA record was found. IPv6-only mobile networks reach your site only through a carrier translator, which adds latency. explain

• Info

  HTTPS (SVCB) record

  No HTTPS resource record. It is optional, but it removes the initial HTTP redirect and advertises HTTP/3 (ECH also relies on it). explain

• OK

  Wildcard record

  Non-existent names correctly return NXDOMAIN (no wildcard). explain

• OK

  Web server answers

  The web server replied with HTTP 200 over HTTPS. explain

  Final URL: https://github.com/
  

MX records and everything a receiving server checks before accepting your mail.

• OK

  MX records

  1 mail server(s) are published. explain

  Priority	Mail server	Addresses	Reverse DNS
  0	github-com.mail.protection.outlook.com	52.101.41.125, 52.101.60.185, 52.101.9.20, 52.101.9.24, 2a01:111:f403:c801::, 2a01:111:f403:c918::5, 2a01:111:f403:f803::, 2a01:111:f403:f909::6	mail-bl0pr02cu00604.inbound.protection.outlook.com, mail-bl2pr02cu00400.inbound.protection.outlook.com, mail-bnypr03cu00201.inbound.protection.outlook.com, mail-byapr05cu00605.inbound.protection.outlook.com

• Warning

  Mail server redundancy

  Only one MX record exists. A second server (or a backup MX at a different provider) keeps mail queued during an outage instead of bouncing it. explain

• OK

  MX hosts resolve

  Every mail server resolves to at least one address. explain

• OK

  Reverse DNS of the mail servers

  Every mail server address has a PTR record. explain

  52.101.41.125 -> mail-byapr05cu00605.inbound.protection.outlook.com
  52.101.60.185 -> mail-bnypr03cu00201.inbound.protection.outlook.com
  52.101.9.20 -> mail-bl0pr02cu00604.inbound.protection.outlook.com
  52.101.9.24 -> mail-bl2pr02cu00400.inbound.protection.outlook.com
  

• Info

  DANE / TLSA

  No TLSA record. DANE is optional and requires DNSSEC, but it is the strongest protection against downgrade attacks on SMTP. explain

• OK

  Blocklists (DNSBL)

  No mail or web address of this domain is listed on the public blocklists we query. explain

SPF, DKIM, DMARC and the modern transport policies.

• OK

  SPF

  The SPF record ends in ~all, so unauthorised senders are rejected or marked. explain

  v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all
  DNS lookups used: 10 of 10
  

• OK

  DMARC

  DMARC is enforced with p=quarantine. Move to p=reject once the reports are clean. explain

  v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1
  Aggregate reports go to mailto:dmarc@github.com
  

• OK

  DKIM

  DKIM keys were found on 6 common selector(s). Only selectors that are published in DNS can be discovered this way. explain

  google._domainkey: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj6T5sl/RwdSqGoYWaWaFbS2UAeyPrEmd0gogocmRfS441qwR8/0KB81Hw8
  k1._domainkey: k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41Vw
  k2._domainkey: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBXR9r7OAU6U8/zn92ivImI75naUujWbI
  s1._domainkey: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyn3fMCVpb7ryIRKOGXhXVGYmsWUitNlSckqGHOwNFZgFadplOrD+Qzf1XQkP7M
  s2._domainkey: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNt2/H6bKs99C6DAaokPp62KN9mKaD20D1PBakkObejkJvzM6Un/fKHPeI2/qX
  selector1._domainkey: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxZC/z2cK+2s1f/ktzSDSeFzkfIHrjwtGFsfKMAYvKaXjPVNzKykpbXBkX5nB7dV
  

• Info

  MTA-STS

  No MTA-STS policy. It stops attackers from stripping TLS between mail servers and is supported by the large providers. explain

• Info

  TLS-RPT

  No TLS-RPT record. It is the reporting half of MTA-STS and DANE. explain

• Info

  BIMI

  No BIMI record. It shows your brand logo next to authenticated mail and requires DMARC at p=quarantine or p=reject first. explain

DNSSEC, certificate authorisation and exposure of the zone.

• Warning

  DNSSEC

  DNSSEC is not enabled. Without it, answers for your domain can be forged on the way to the resolver. explain

• OK

  CAA

  7 CAA record(s) restrict which certificate authorities may issue certificates for this domain. explain

  0 issue "digicert.com"
  0 issue "globalsign.com"
  0 issue "letsencrypt.org"
  0 issue "sectigo.com"
  0 issuewild "digicert.com"
  0 issuewild "letsencrypt.org"
  0 issuewild "sectigo.com"
  Tip: add an iodef= entry to be notified about violating requests.
  

• OK

  Zone transfer (AXFR)

  No name server allows an anonymous zone transfer. explain

• Warning

  Software version disclosure

  The name servers reveal their software version, which tells an attacker exactly which vulnerabilities to try. explain

  dns1.p08.nsone.net: 19dd46e347df36b70933bf2be8023258586586a9
  dns2.p08.nsone.net: 19dd46e347df36b70933bf2be8023258586586a9
  dns3.p08.nsone.net: 19dd46e347df36b70933bf2be8023258586586a9
  dns4.p08.nsone.net: 19dd46e347df36b70933bf2be8023258586586a9
  

• Warning

  TXT records

  The apex publishes 24 TXT records. Old verification tokens make answers larger and eventually force truncation. explain