backup.zip

What the registry for .zip publishes about your domain.

• OK

  Parent name servers

  The .zip registry answered from ns-tld1.charlestonroadregistry.com (216.239.32.105). explain

  ns-tld1.charlestonroadregistry.com  216.239.32.105
  ns-tld2.charlestonroadregistry.com  216.239.34.105
  ns-tld3.charlestonroadregistry.com  216.239.36.105
  ns-tld4.charlestonroadregistry.com  216.239.38.105
  

• OK

  Delegation at the registry

  The registry delegates the domain to 2 name server(s). explain

  brett.ns.cloudflare.com
  donna.ns.cloudflare.com
  

• OK

  Number of name servers

  2 name servers are delegated, which is a healthy number. explain

• Info

  Glue records

  All name servers are outside this zone, so no glue record is needed. explain

• OK

  Registry and zone agree

  The registry and your name servers publish exactly the same NS list. explain

• OK

  Registration (RDAP)

  Registration data was retrieved over RDAP. explain

  Registrar: Spaceship, Inc.
  Registered: 2023-05-10 20:00:36
  Expires: 2027-05-10 20:00:36
  Status: client transfer prohibited
  

Direct queries sent to every authoritative server of the zone.

• Info

  Answering servers

  2 authoritative servers were queried directly over UDP. explain

  Name server	Addresses	Response	Serial	Authoritative	Answers
  brett.ns.cloudflare.com	108.162.193.76, 172.64.33.76, 173.245.59.76, 2606:4700:58::adf5:3b4c, 2803:f800:50::6ca2:c14c, 2a06:98c1:50::ac40:214c	6.4 ms	2414877165	✓	✓
  donna.ns.cloudflare.com	108.162.192.151, 172.64.32.151, 173.245.58.151, 2606:4700:50::adf5:3a97, 2803:f800:50::6ca2:c097, 2a06:98c1:50::ac40:2097	3.3 ms	2414877165	✓	✓

• OK

  All name servers respond

  Every delegated name server answered a direct UDP query. explain

• OK

  Authoritative answers

  Every server answers authoritatively for the zone. explain

• OK

  SOA serial is in sync

  All name servers report the same serial number (2414877165). explain

• OK

  NS records are identical

  Every server publishes the same NS record set. explain

• OK

  Recursion is disabled

  No name server offers open recursion to the internet. explain

• OK

  DNS over TCP

  Every name server also answers over TCP. explain

• OK

  EDNS(0) support

  Every name server understands EDNS(0). explain

• OK

  Network diversity

  Name servers are spread over 6 different networks. explain

• OK

  IPv6 reachable name servers

  2 of 2 name servers are reachable over IPv6. explain

• OK

  Response time

  Average response time 4.8 ms, slowest 6.4 ms. explain

• Info

  Reverse DNS of the name servers

  Reverse names resolved for the servers. explain

  brett.ns.cloudflare.com: brett.ns.cloudflare.com
  donna.ns.cloudflare.com: donna.ns.cloudflare.com
  

The Start Of Authority record and its timers.

• OK

  SOA record exists

  The zone publishes a SOA record. explain

  brett.ns.cloudflare.com. dns.cloudflare.com. 2414877165 10000 2400 604800 1800
  

• OK

  Primary server (MNAME)

  The SOA points at brett.ns.cloudflare.com, which is one of the delegated name servers. explain

• OK

  Zone contact (RNAME)

  Zone contact: dns@cloudflare.com explain

• Warning

  Serial number

  The serial 2414877165 looks like a date but is not a valid one. explain

• OK

  Refresh

  Refresh is 10000s, inside the recommended range. explain

• OK

  Retry

  Retry is 40min, inside the recommended range. explain

• Warning

  Expire

  Expire is 7d, below the recommended minimum of 14d. explain

• OK

  Minimum TTL (negative caching)

  Minimum TTL (negative caching) is 30min, inside the recommended range. explain

• OK

  TTL values

  Record TTLs are in a sensible range. explain

  Record	TTL (s)	Duration
  NS	86400	1d
  A	300	5min
  MX	300	5min
  SOA	1800	30min

The records a browser needs to open your site.

• OK

  Address of the domain

  backup.zip resolves to 4 address(es). explain

  104.21.41.225
  172.67.195.99
  2606:4700:3033::6815:29e1
  2606:4700:3034::ac43:c363
  

• OK

  No CNAME at the zone apex

  The zone apex correctly has no CNAME record. explain

• OK

  www subdomain

  www.backup.zip resolves. explain

  104.21.41.225
  172.67.195.99
  2606:4700:3033::6815:29e1
  2606:4700:3034::ac43:c363
  

• OK

  IPv6 (AAAA)

  The site publishes AAAA records and is reachable over IPv6. explain

  2606:4700:3033::6815:29e1
  2606:4700:3034::ac43:c363
  2606:4700:3033::6815:29e1
  2606:4700:3034::ac43:c363
  

• OK

  HTTPS (SVCB) record

  An HTTPS resource record is published, so browsers can upgrade the very first request and may use HTTP/3 immediately. explain

  1 . alpn="h3,h2" ipv4hint="104.21.41.225,172.67.195.99" ech="AEX+DQBBJQAgACCsB3Y/dhxnMnHJPyyoh+mudNUnoRo4qcrHlfJtIkevKQAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA=" ipv6hint="2606:4700:3033::6815:29e1,2606:4700:3034::ac43:c363"
  

• Info

  Wildcard record

  A random, non-existent subdomain answers with 104.21.41.225, 172.67.195.99, so the zone has a wildcard. This hides typos and prevents NXDOMAIN answers. explain

• Warning

  Web server answers

  The web server replied with HTTP 403 over HTTPS. explain

  Final URL: https://backup.zip/
  

MX records and everything a receiving server checks before accepting your mail.

• OK

  MX records

  1 mail server(s) are published. explain

  Priority	Mail server	Addresses	Reverse DNS
  65535	b.backup.zip	35.189.184.246	mail.inxsoft.net

• Warning

  Mail server redundancy

  Only one MX record exists. A second server (or a backup MX at a different provider) keeps mail queued during an outage instead of bouncing it. explain

• OK

  MX hosts resolve

  Every mail server resolves to at least one address. explain

• OK

  Reverse DNS of the mail servers

  Every mail server address has a PTR record. explain

  35.189.184.246 -> mail.inxsoft.net
  

• Info

  DANE / TLSA

  No TLSA record. DANE is optional and requires DNSSEC, but it is the strongest protection against downgrade attacks on SMTP. explain

• OK

  Blocklists (DNSBL)

  No mail or web address of this domain is listed on the public blocklists we query. explain

SPF, DKIM, DMARC and the modern transport policies.

• Error

  SPF

  No SPF record. Anybody can send mail using your domain as the envelope sender and most receivers will accept it. explain

• Error

  DMARC

  No DMARC record at _dmarc.backup.zip. Without it, SPF and DKIM failures have no consequence and you receive no reports about abuse of your domain. explain

• Warning

  DKIM

  No DKIM key was found on the selectors we probe. DKIM may still be active on a private selector, but without it DMARC survives no forwarding. explain

• Info

  MTA-STS

  No MTA-STS policy. It stops attackers from stripping TLS between mail servers and is supported by the large providers. explain

• Info

  TLS-RPT

  No TLS-RPT record. It is the reporting half of MTA-STS and DANE. explain

• Info

  BIMI

  No BIMI record. It shows your brand logo next to authenticated mail and requires DMARC at p=quarantine or p=reject first. explain

DNSSEC, certificate authorisation and exposure of the zone.

• Warning

  DNSSEC

  DNSSEC is not enabled. Without it, answers for your domain can be forged on the way to the resolver. explain

• Warning

  CAA

  No CAA record. Any certificate authority in the world may issue a certificate for your domain; a CAA record limits that to the ones you choose. explain

• OK

  Zone transfer (AXFR)

  No name server allows an anonymous zone transfer. explain

• Warning

  Software version disclosure

  The name servers reveal their software version, which tells an attacker exactly which vulnerabilities to try. explain

  brett.ns.cloudflare.com: 2026.9.4
  donna.ns.cloudflare.com: 2026.9.4