wikipedia.org

What the registry for .org publishes about your domain.

• OK

  Parent name servers

  The .org registry answered from a0.org.afilias-nst.info (199.19.56.1). explain

  a0.org.afilias-nst.info  199.19.56.1
  a2.org.afilias-nst.info  199.249.112.1
  b0.org.afilias-nst.org  199.19.54.1
  b2.org.afilias-nst.org  199.249.120.1
  

• OK

  Delegation at the registry

  The registry delegates the domain to 3 name server(s). explain

  ns0.wikimedia.org
  ns1.wikimedia.org
  ns2.wikimedia.org
  

• OK

  Number of name servers

  3 name servers are delegated, which is a healthy number. explain

• Info

  Glue records

  All name servers are outside this zone, so no glue record is needed. explain

• OK

  Registry and zone agree

  The registry and your name servers publish exactly the same NS list. explain

• OK

  Registration (RDAP)

  Registration data was retrieved over RDAP. explain

  Registrar: MarkMonitor Inc.
  Registered: 2001-01-13 00:12:14
  Expires: 2027-01-13 00:12:14
  Status: client delete prohibited, client transfer prohibited, client update prohibited
  

Direct queries sent to every authoritative server of the zone.

• Info

  Answering servers

  3 authoritative servers were queried directly over UDP. explain

  Name server	Addresses	Response	Serial	Authoritative	Answers
  ns0.wikimedia.org	208.80.154.238, 2620:0:861:53::1	28.0 ms	2026060420	✓	✓
  ns1.wikimedia.org	208.80.153.231, 2620:0:860:53::1	36.0 ms	2026060420	✓	✓
  ns2.wikimedia.org	198.35.27.27, 2a02:ec80:53::1	105.3 ms	2026060420	✓	✓

• OK

  All name servers respond

  Every delegated name server answered a direct UDP query. explain

• OK

  Authoritative answers

  Every server answers authoritatively for the zone. explain

• OK

  SOA serial is in sync

  All name servers report the same serial number (2026060420). explain

• OK

  NS records are identical

  Every server publishes the same NS record set. explain

• OK

  Recursion is disabled

  No name server offers open recursion to the internet. explain

• OK

  DNS over TCP

  Every name server also answers over TCP. explain

• OK

  EDNS(0) support

  Every name server understands EDNS(0). explain

• OK

  Network diversity

  Name servers are spread over 3 different networks. explain

• OK

  IPv6 reachable name servers

  3 of 3 name servers are reachable over IPv6. explain

• OK

  Response time

  Average response time 56.4 ms, slowest 105.3 ms. explain

• Info

  Reverse DNS of the name servers

  Reverse names resolved for the servers. explain

  ns0.wikimedia.org: ns0.wikimedia.org
  ns1.wikimedia.org: ns1.wikimedia.org
  ns2.wikimedia.org: ns2.wikimedia.org
  

The Start Of Authority record and its timers.

• OK

  SOA record exists

  The zone publishes a SOA record. explain

  ns0.wikimedia.org. hostmaster.wikimedia.org. 2026060420 43200 7200 1209600 3600
  

• OK

  Primary server (MNAME)

  The SOA points at ns0.wikimedia.org, which is one of the delegated name servers. explain

• OK

  Zone contact (RNAME)

  Zone contact: hostmaster@wikimedia.org explain

• OK

  Serial number

  The serial 2026060420 follows the recommended YYYYMMDDnn format. explain

• OK

  Refresh

  Refresh is 12h, inside the recommended range. explain

• OK

  Retry

  Retry is 2h, inside the recommended range. explain

• OK

  Expire

  Expire is 14d, inside the recommended range. explain

• OK

  Minimum TTL (negative caching)

  Minimum TTL (negative caching) is 1h, inside the recommended range. explain

• Warning

  TTL values

  Some records use a TTL below 60 seconds, which multiplies the query load and the latency for your visitors. explain

  Record	TTL (s)	Duration
  NS	163069	163069s
  A	12	12s
  MX	300	5min
  SOA	3600	1h

The records a browser needs to open your site.

• OK

  Address of the domain

  wikipedia.org resolves to 2 address(es). explain

  208.80.154.224
  2620:0:861:ed1a::1
  

• OK

  No CNAME at the zone apex

  The zone apex correctly has no CNAME record. explain

• OK

  www subdomain

  www.wikipedia.org resolves. explain

  dyna.wikimedia.org.
  208.80.154.224
  2620:0:861:ed1a::1
  

• OK

  IPv6 (AAAA)

  The site publishes AAAA records and is reachable over IPv6. explain

  2620:0:861:ed1a::1
  2620:0:861:ed1a::1
  

• Info

  HTTPS (SVCB) record

  No HTTPS resource record. It is optional, but it removes the initial HTTP redirect and advertises HTTP/3 (ECH also relies on it). explain

• OK

  Wildcard record

  Non-existent names correctly return NXDOMAIN (no wildcard). explain

• OK

  Web server answers

  The web server replied with HTTP 200 over HTTPS. explain

  Final URL: https://www.wikipedia.org/
  

MX records and everything a receiving server checks before accepting your mail.

• OK

  MX records

  2 mail server(s) are published. explain

  Priority	Mail server	Addresses	Reverse DNS
  10	mx-in1001.wikimedia.org	208.80.155.102, 2620:0:861:4:208:80:155:102	mx-in1001.wikimedia.org
  10	mx-in2001.wikimedia.org	208.80.153.75, 2620:0:860:3:208:80:153:75	mx-in2001.wikimedia.org

• OK

  Mail server redundancy

  2 mail servers provide redundancy. explain

• OK

  MX hosts resolve

  Every mail server resolves to at least one address. explain

• OK

  Reverse DNS of the mail servers

  Every mail server address has a PTR record. explain

  208.80.155.102 -> mx-in1001.wikimedia.org
  208.80.153.75 -> mx-in2001.wikimedia.org
  

• Info

  DANE / TLSA

  No TLSA record. DANE is optional and requires DNSSEC, but it is the strongest protection against downgrade attacks on SMTP. explain

• OK

  Blocklists (DNSBL)

  No mail or web address of this domain is listed on the public blocklists we query. explain

SPF, DKIM, DMARC and the modern transport policies.

• OK

  SPF

  The SPF record ends in ~all, so unauthorised senders are rejected or marked. explain

  v=spf1 include:_cidrs.wikimedia.org ~all
  DNS lookups used: 1 of 10
  

• OK

  DMARC

  DMARC is enforced with p=reject, the strongest policy. explain

  v=DMARC1; p=reject; rua=mailto:dmarc-rua@wikimedia.org;
  Aggregate reports go to mailto:dmarc-rua@wikimedia.org
  

• Warning

  DKIM

  No DKIM key was found on the selectors we probe. DKIM may still be active on a private selector, but without it DMARC survives no forwarding. explain

• Info

  MTA-STS

  No MTA-STS policy. It stops attackers from stripping TLS between mail servers and is supported by the large providers. explain

• Info

  TLS-RPT

  No TLS-RPT record. It is the reporting half of MTA-STS and DANE. explain

• Info

  BIMI

  No BIMI record. It shows your brand logo next to authenticated mail and requires DMARC at p=quarantine or p=reject first. explain

DNSSEC, certificate authorisation and exposure of the zone.

• Warning

  DNSSEC

  DNSSEC is not enabled. Without it, answers for your domain can be forged on the way to the resolver. explain

• OK

  CAA

  2 CAA record(s) restrict which certificate authorities may issue certificates for this domain. explain

  0 iodef "mailto:dns-admin@wikimedia.org"
  0 issue "letsencrypt.org"
  0 issue "pki.goog"
  

• OK

  Zone transfer (AXFR)

  No name server allows an anonymous zone transfer. explain

• Warning

  Software version disclosure

  The name servers reveal their software version, which tells an attacker exactly which vulnerabilities to try. explain

  ns0.wikimedia.org: gdnsd/X
  ns1.wikimedia.org: gdnsd/X
  ns2.wikimedia.org: gdnsd/X