google.com

What the registry for .com publishes about your domain.

• OK

  Parent name servers

  The .com registry answered from a.gtld-servers.net (192.5.6.30). explain

  a.gtld-servers.net  192.5.6.30
  b.gtld-servers.net  192.33.14.30
  c.gtld-servers.net  192.26.92.30
  d.gtld-servers.net  192.31.80.30
  

• OK

  Delegation at the registry

  The registry delegates the domain to 4 name server(s). explain

  ns1.google.com
  ns2.google.com
  ns3.google.com
  ns4.google.com
  

• OK

  Number of name servers

  4 name servers are delegated, which is a healthy number. explain

• OK

  Glue records

  The registry sends glue records for every in-zone name server. explain

  ns1.google.com  2001:4860:4802:32::a, 216.239.32.10
  ns2.google.com  2001:4860:4802:34::a, 216.239.34.10
  ns3.google.com  2001:4860:4802:36::a, 216.239.36.10
  ns4.google.com  2001:4860:4802:38::a, 216.239.38.10
  

• OK

  Registry and zone agree

  The registry and your name servers publish exactly the same NS list. explain

• OK

  Registration (RDAP)

  Registration data was retrieved over RDAP. explain

  Registrar: MarkMonitor Inc.
  Registered: 1997-09-15 04:00:00
  Expires: 2028-09-14 04:00:00
  Status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited
  

Direct queries sent to every authoritative server of the zone.

• Info

  Answering servers

  4 authoritative servers were queried directly over UDP. explain

  Name server	Addresses	Response	Serial	Authoritative	Answers
  ns1.google.com	216.239.32.10, 2001:4860:4802:32::a	15.0 ms	978447258	✓	✓
  ns2.google.com	216.239.34.10, 2001:4860:4802:34::a	13.4 ms	978447258	✓	✓
  ns3.google.com	216.239.36.10, 2001:4860:4802:36::a	12.9 ms	978447258	✓	✓
  ns4.google.com	216.239.38.10, 2001:4860:4802:38::a	13.2 ms	978447258	✓	✓

• OK

  All name servers respond

  Every delegated name server answered a direct UDP query. explain

• OK

  Authoritative answers

  Every server answers authoritatively for the zone. explain

• OK

  SOA serial is in sync

  All name servers report the same serial number (978447258). explain

• OK

  NS records are identical

  Every server publishes the same NS record set. explain

• OK

  Recursion is disabled

  No name server offers open recursion to the internet. explain

• OK

  DNS over TCP

  Every name server also answers over TCP. explain

• OK

  EDNS(0) support

  Every name server understands EDNS(0). explain

• OK

  Network diversity

  Name servers are spread over 4 different networks. explain

• OK

  IPv6 reachable name servers

  4 of 4 name servers are reachable over IPv6. explain

• OK

  Response time

  Average response time 13.6 ms, slowest 15.0 ms. explain

• Info

  Reverse DNS of the name servers

  Reverse names resolved for the servers. explain

  ns1.google.com: ns1.google.com
  ns2.google.com: ns2.google.com
  ns3.google.com: ns3.google.com
  ns4.google.com: ns4.google.com
  

The Start Of Authority record and its timers.

• OK

  SOA record exists

  The zone publishes a SOA record. explain

  ns1.google.com. dns-admin.google.com. 978447258 900 900 1800 60
  

• OK

  Primary server (MNAME)

  The SOA points at ns1.google.com, which is one of the delegated name servers. explain

• OK

  Zone contact (RNAME)

  Zone contact: dns-admin@google.com explain

• Info

  Serial number

  The serial is 978447258. The YYYYMMDDnn format (RFC 1912) makes it obvious when the zone was last edited. explain

• Warning

  Refresh

  Refresh is 15min, below the recommended minimum of 20min. explain

• OK

  Retry

  Retry is 15min, inside the recommended range. explain

• Warning

  Expire

  Expire is 30min, below the recommended minimum of 14d. explain

• Warning

  Minimum TTL (negative caching)

  Minimum TTL (negative caching) is 1min, below the recommended minimum of 5min. explain

• Warning

  Retry is lower than refresh

  Retry (15min) should be clearly smaller than refresh (15min). explain

• Warning

  Expire is far above refresh

  Expire (30min) should be much larger than refresh (15min), otherwise a short outage of the primary takes the zone down. explain

• Warning

  TTL values

  Some records use a TTL below 60 seconds, which multiplies the query load and the latency for your visitors. explain

  Record	TTL (s)	Duration
  NS	345530	345530s
  A	4	4s
  MX	149	149s
  SOA	58	58s

The records a browser needs to open your site.

• OK

  Address of the domain

  google.com resolves to 5 address(es). explain

  192.178.50.78
  2607:f8b0:400c:c15::65
  2607:f8b0:400c:c15::66
  2607:f8b0:400c:c15::71
  2607:f8b0:400c:c15::8b
  

• OK

  No CNAME at the zone apex

  The zone apex correctly has no CNAME record. explain

• OK

  www subdomain

  www.google.com resolves. explain

  142.251.150.119
  142.251.151.119
  142.251.152.119
  142.251.153.119
  142.251.154.119
  142.251.155.119
  142.251.156.119
  142.251.157.119
  2001:4860:4826:7700::
  2001:4860:4827:7700::
  2001:4860:4828:7700::
  2001:4860:4829:7700::
  2001:4860:482a:7700::
  2001:4860:482b:7700::
  2001:4860:482c:7700::
  2001:4860:482d:7700::
  

• OK

  IPv6 (AAAA)

  The site publishes AAAA records and is reachable over IPv6. explain

  2607:f8b0:400c:c15::65
  2607:f8b0:400c:c15::66
  2607:f8b0:400c:c15::71
  2607:f8b0:400c:c15::8b
  2001:4860:4826:7700::
  2001:4860:4827:7700::
  2001:4860:4828:7700::
  2001:4860:4829:7700::
  2001:4860:482a:7700::
  2001:4860:482b:7700::
  2001:4860:482c:7700::
  2001:4860:482d:7700::
  

• OK

  HTTPS (SVCB) record

  An HTTPS resource record is published, so browsers can upgrade the very first request and may use HTTP/3 immediately. explain

  1 . alpn="h2,h3"
  

• OK

  Wildcard record

  Non-existent names correctly return NXDOMAIN (no wildcard). explain

• OK

  Web server answers

  The web server replied with HTTP 200 over HTTPS. explain

  Final URL: https://www.google.com/
  

MX records and everything a receiving server checks before accepting your mail.

• OK

  MX records

  1 mail server(s) are published. explain

  Priority	Mail server	Addresses	Reverse DNS
  10	smtp.google.com	142.250.98.26, 172.217.203.26, 74.125.134.26, 74.125.26.26, 74.125.26.27, 2607:f8b0:400c:c01::1a, 2607:f8b0:400c:c13::1a, 2607:f8b0:400c:c13::1b, 2607:f8b0:400c:c28::1a	uc-in-f26.1e100.net, uf-in-f26.1e100.net, uh-in-f26.1e100.net, vj-in-f26.1e100.net

• Warning

  Mail server redundancy

  Only one MX record exists. A second server (or a backup MX at a different provider) keeps mail queued during an outage instead of bouncing it. explain

• OK

  MX hosts resolve

  Every mail server resolves to at least one address. explain

• OK

  Reverse DNS of the mail servers

  Every mail server address has a PTR record. explain

  142.250.98.26 -> uh-in-f26.1e100.net
  172.217.203.26 -> uf-in-f26.1e100.net
  74.125.134.26 -> vj-in-f26.1e100.net
  74.125.26.26 -> uc-in-f26.1e100.net
  

• Info

  DANE / TLSA

  No TLSA record. DANE is optional and requires DNSSEC, but it is the strongest protection against downgrade attacks on SMTP. explain

• OK

  Blocklists (DNSBL)

  No mail or web address of this domain is listed on the public blocklists we query. explain

SPF, DKIM, DMARC and the modern transport policies.

• OK

  SPF

  The SPF record ends in ~all, so unauthorised senders are rejected or marked. explain

  v=spf1 include:_spf.google.com ~all
  DNS lookups used: 1 of 10
  

• OK

  DMARC

  DMARC is enforced with p=reject, the strongest policy. explain

  v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com
  Aggregate reports go to mailto:mailauth-reports@google.com
  

• Warning

  DKIM

  No DKIM key was found on the selectors we probe. DKIM may still be active on a private selector, but without it DMARC survives no forwarding. explain

• OK

  MTA-STS

  MTA-STS is published, so senders require valid TLS for your mail servers. explain

  v=STSv1; id=20210803T010101;
  

• OK

  TLS-RPT

  TLS reporting is enabled, so you receive daily reports about failed TLS connections to your mail servers. explain

  v=TLSRPTv1;rua=mailto:sts-reports@google.com
  

• Info

  BIMI

  No BIMI record. It shows your brand logo next to authenticated mail and requires DMARC at p=quarantine or p=reject first. explain

DNSSEC, certificate authorisation and exposure of the zone.

• Warning

  DNSSEC

  DNSSEC is not enabled. Without it, answers for your domain can be forged on the way to the resolver. explain

• OK

  CAA

  1 CAA record(s) restrict which certificate authorities may issue certificates for this domain. explain

  0 issue "pki.goog"
  Tip: add an iodef= entry to be notified about violating requests.
  

• OK

  Zone transfer (AXFR)

  No name server allows an anonymous zone transfer. explain

• OK

  Software version disclosure

  The name servers do not disclose their software version. explain