mail.ru

What the registry for .ru publishes about your domain.

• OK

  Parent name servers

  The .ru registry answered from a.dns.ripn.net (193.232.128.6). explain

  a.dns.ripn.net  193.232.128.6
  b.dns.ripn.net  194.85.252.62
  c.tld-servers.ru  194.190.122.17
  d.dns.ripn.net  194.190.124.17
  

• OK

  Delegation at the registry

  The registry delegates the domain to 2 name server(s). explain

  ns1.mail.ru
  ns2.mail.ru
  

• OK

  Number of name servers

  2 name servers are delegated, which is a healthy number. explain

• OK

  Glue records

  The registry sends glue records for every in-zone name server. explain

  ns1.mail.ru  217.69.139.112
  ns2.mail.ru  94.100.180.138
  

• OK

  Registry and zone agree

  The registry and your name servers publish exactly the same NS list. explain

Direct queries sent to every authoritative server of the zone.

• Info

  Answering servers

  2 authoritative servers were queried directly over UDP. explain

  Name server	Addresses	Response	Serial	Authoritative	Answers
  ns1.mail.ru	217.69.139.112, 2a00:1148:db00::2	162.3 ms	3580147728	✓	✓
  ns2.mail.ru	94.100.180.138, 2a00:1148:db00::1	160.7 ms	3580147728	✓	✓

• OK

  All name servers respond

  Every delegated name server answered a direct UDP query. explain

• OK

  Authoritative answers

  Every server answers authoritatively for the zone. explain

• OK

  SOA serial is in sync

  All name servers report the same serial number (3580147728). explain

• OK

  NS records are identical

  Every server publishes the same NS record set. explain

• OK

  Recursion is disabled

  No name server offers open recursion to the internet. explain

• OK

  DNS over TCP

  Every name server also answers over TCP. explain

• OK

  EDNS(0) support

  Every name server understands EDNS(0). explain

• OK

  Network diversity

  Name servers are spread over 2 different networks. explain

• OK

  IPv6 reachable name servers

  2 of 2 name servers are reachable over IPv6. explain

• OK

  Response time

  Average response time 161.5 ms, slowest 162.3 ms. explain

• Info

  Reverse DNS of the name servers

  Reverse names resolved for the servers. explain

  ns1.mail.ru: ns1.mail.ru
  ns2.mail.ru: ns2.mail.ru
  

The Start Of Authority record and its timers.

• OK

  SOA record exists

  The zone publishes a SOA record. explain

  ns1.mail.ru. hostmaster.mail.ru. 3580147728 900 900 604800 60
  

• OK

  Primary server (MNAME)

  The SOA points at ns1.mail.ru, which is one of the delegated name servers. explain

• OK

  Zone contact (RNAME)

  Zone contact: hostmaster@mail.ru explain

• Warning

  Serial number

  The serial 3580147728 looks like a date but is not a valid one. explain

• Warning

  Refresh

  Refresh is 15min, below the recommended minimum of 20min. explain

• OK

  Retry

  Retry is 15min, inside the recommended range. explain

• Warning

  Expire

  Expire is 7d, below the recommended minimum of 14d. explain

• Warning

  Minimum TTL (negative caching)

  Minimum TTL (negative caching) is 1min, below the recommended minimum of 5min. explain

• Warning

  Retry is lower than refresh

  Retry (15min) should be clearly smaller than refresh (15min). explain

• Warning

  TTL values

  Some records use a TTL below 60 seconds, which multiplies the query load and the latency for your visitors. explain

  Record	TTL (s)	Duration
  NS	552	552s
  A	20	20s
  MX	600	10min
  SOA	600	10min

The records a browser needs to open your site.

• OK

  Address of the domain

  mail.ru resolves to 6 address(es). explain

  185.180.201.1
  89.221.239.1
  90.156.232.4
  2a00:1148:9100:b000::1
  2a00:b4c0:9100:b000::1
  2a14:25c0:9100:b000::1
  

• OK

  No CNAME at the zone apex

  The zone apex correctly has no CNAME record. explain

• OK

  www subdomain

  www.mail.ru resolves. explain

  89.221.239.2
  90.156.232.41
  

• OK

  IPv6 (AAAA)

  The site publishes AAAA records and is reachable over IPv6. explain

  2a00:1148:9100:b000::1
  2a00:b4c0:9100:b000::1
  2a14:25c0:9100:b000::1
  

• Info

  HTTPS (SVCB) record

  No HTTPS resource record. It is optional, but it removes the initial HTTP redirect and advertises HTTP/3 (ECH also relies on it). explain

• Info

  Wildcard record

  A random, non-existent subdomain answers with 90.156.232.38, so the zone has a wildcard. This hides typos and prevents NXDOMAIN answers. explain

• OK

  Web server answers

  The web server replied with HTTP 200 over HTTPS. explain

  Final URL: https://mail.ru/
  

MX records and everything a receiving server checks before accepting your mail.

• OK

  MX records

  1 mail server(s) are published. explain

  Priority	Mail server	Addresses	Reverse DNS
  10	mxs.mail.ru	217.69.139.150, 94.100.180.31	mxs.mail.ru

• Warning

  Mail server redundancy

  Only one MX record exists. A second server (or a backup MX at a different provider) keeps mail queued during an outage instead of bouncing it. explain

• OK

  MX hosts resolve

  Every mail server resolves to at least one address. explain

• OK

  Reverse DNS of the mail servers

  Every mail server address has a PTR record. explain

  217.69.139.150 -> mxs.mail.ru
  94.100.180.31 -> mxs.mail.ru
  

• Info

  DANE / TLSA

  No TLSA record. DANE is optional and requires DNSSEC, but it is the strongest protection against downgrade attacks on SMTP. explain

• OK

  Blocklists (DNSBL)

  No mail or web address of this domain is listed on the public blocklists we query. explain

SPF, DKIM, DMARC and the modern transport policies.

• Warning

  SPF

  The SPF record has no 'all' mechanism, so the policy is undefined for everything you did not list. explain

  v=spf1 redirect=_spf.mail.ru
  DNS lookups used: 1 of 10
  

• OK

  DMARC

  DMARC is enforced with p=reject, the strongest policy. explain

  v=DMARC1;p=reject;rua=mailto:dmarc_rua@corp.mail.ru;
  Aggregate reports go to mailto:dmarc_rua@corp.mail.ru
  

• Warning

  DKIM

  No DKIM key was found on the selectors we probe. DKIM may still be active on a private selector, but without it DMARC survives no forwarding. explain

• OK

  MTA-STS

  MTA-STS is published, so senders require valid TLS for your mail servers. explain

  v=STSv1; id=20260715T120000;
  

• OK

  TLS-RPT

  TLS reporting is enabled, so you receive daily reports about failed TLS connections to your mail servers. explain

  v=TLSRPTv1;rua=mailto:tls-rpt@corp.mail.ru
  

• Info

  BIMI

  No BIMI record. It shows your brand logo next to authenticated mail and requires DMARC at p=quarantine or p=reject first. explain

DNSSEC, certificate authorisation and exposure of the zone.

• Warning

  DNSSEC

  DNSSEC is not enabled. Without it, answers for your domain can be forged on the way to the resolver. explain

• Warning

  CAA

  No CAA record. Any certificate authority in the world may issue a certificate for your domain; a CAA record limits that to the ones you choose. explain

• OK

  Zone transfer (AXFR)

  No name server allows an anonymous zone transfer. explain

• Warning

  Software version disclosure

  The name servers reveal their software version, which tells an attacker exactly which vulnerabilities to try. explain

  ns1.mail.ru: To be non-disclosed
  ns2.mail.ru: To be non-disclosed
  

The registry did not return RDAP data for this domain.