pornhub.com

What the registry for .com publishes about your domain.

• OK

  Parent name servers

  The .com registry answered from a.gtld-servers.net (192.5.6.30). explain

  a.gtld-servers.net  192.5.6.30
  b.gtld-servers.net  192.33.14.30
  c.gtld-servers.net  192.26.92.30
  d.gtld-servers.net  192.31.80.30
  

• OK

  Delegation at the registry

  The registry delegates the domain to 8 name server(s). explain

  ns-1499.awsdns-59.org
  ns-1567.awsdns-03.co.uk
  ns-531.awsdns-02.net
  ns-92.awsdns-11.com
  sdns3.ultradns.biz
  sdns3.ultradns.com
  sdns3.ultradns.net
  sdns3.ultradns.org
  

• Warning

  Number of name servers

  8 name servers are delegated. More than seven rarely helps and makes referral answers larger. explain

• Info

  Glue records

  All name servers are outside this zone, so no glue record is needed. explain

• OK

  Registry and zone agree

  The registry and your name servers publish exactly the same NS list. explain

• OK

  Registration (RDAP)

  Registration data was retrieved over RDAP. explain

  Registrar: EuroDNS S.A.
  Registered: 2000-10-31 12:23:38
  Expires: 2027-10-31 11:23:38
  Status: client transfer prohibited
  

Direct queries sent to every authoritative server of the zone.

• Info

  Answering servers

  8 authoritative servers were queried directly over UDP. explain

  Name server	Addresses	Response	Serial	Authoritative	Answers
  ns-1499.awsdns-59.org	205.251.197.219, 2600:9000:5305:db00::1	65.6 ms	1	✓	✓
  ns-1567.awsdns-03.co.uk	205.251.198.31, 2600:9000:5306:1f00::1	1.4 ms	1	✓	✓
  ns-531.awsdns-02.net	205.251.194.19, 2600:9000:5302:1300::1	37.2 ms	1	✓	✓
  ns-92.awsdns-11.com	205.251.192.92, 2600:9000:5300:5c00::1	2.4 ms	1	✓	✓
  sdns3.ultradns.biz	156.154.142.3, 2610:a1:1003::3	5.1 ms	2014036769	✓	✓
  sdns3.ultradns.com	156.154.140.3, 2610:a1:1001::3	3.1 ms	2014036769	✓	✓
  sdns3.ultradns.net	156.154.141.3, 2610:a1:1002::3	2.6 ms	2014036769	✓	✓
  sdns3.ultradns.org	156.154.143.3, 2610:a1:1004::3	3.1 ms	2014036769	✓	✓

• OK

  All name servers respond

  Every delegated name server answered a direct UDP query. explain

• OK

  Authoritative answers

  Every server answers authoritatively for the zone. explain

• Error

  SOA serial is in sync

  Your name servers do not agree on the SOA serial number, so at least one of them is serving stale data. explain

  ns-1499.awsdns-59.org: 1
  ns-1567.awsdns-03.co.uk: 1
  ns-531.awsdns-02.net: 1
  ns-92.awsdns-11.com: 1
  sdns3.ultradns.biz: 2014036769
  sdns3.ultradns.com: 2014036769
  sdns3.ultradns.net: 2014036769
  sdns3.ultradns.org: 2014036769
  

• OK

  NS records are identical

  Every server publishes the same NS record set. explain

• OK

  Recursion is disabled

  No name server offers open recursion to the internet. explain

• OK

  DNS over TCP

  Every name server also answers over TCP. explain

• OK

  EDNS(0) support

  Every name server understands EDNS(0). explain

• OK

  Network diversity

  Name servers are spread over 8 different networks. explain

• OK

  IPv6 reachable name servers

  8 of 8 name servers are reachable over IPv6. explain

• OK

  Response time

  Average response time 15.1 ms, slowest 65.6 ms. explain

• Info

  Reverse DNS of the name servers

  Reverse names resolved for the servers. explain

  ns-1499.awsdns-59.org: ns-1499.awsdns-59.org
  ns-1567.awsdns-03.co.uk: ns-1567.awsdns-03.co.uk
  ns-531.awsdns-02.net: ns-531.awsdns-02.net
  ns-92.awsdns-11.com: ns-92.awsdns-11.com
  sdns3.ultradns.biz: sdns3.ultradns.biz
  sdns3.ultradns.com: sdns3.ultradns.com
  sdns3.ultradns.net: sdns3.ultradns.net
  sdns3.ultradns.org: sdns3.ultradns.org
  

The Start Of Authority record and its timers.

• OK

  SOA record exists

  The zone publishes a SOA record. explain

  sdns3.ultradns.net. dns.mindgeek.com. 2014036769 28800 7200 1209600 43200
  

• OK

  Primary server (MNAME)

  The SOA points at sdns3.ultradns.net, which is one of the delegated name servers. explain

• OK

  Zone contact (RNAME)

  Zone contact: dns@mindgeek.com explain

• Warning

  Serial number

  The serial 2014036769 looks like a date but is not a valid one. explain

• OK

  Refresh

  Refresh is 8h, inside the recommended range. explain

• OK

  Retry

  Retry is 2h, inside the recommended range. explain

• OK

  Expire

  Expire is 14d, inside the recommended range. explain

• OK

  Minimum TTL (negative caching)

  Minimum TTL (negative caching) is 12h, inside the recommended range. explain

• OK

  TTL values

  Record TTLs are in a sensible range. explain

  Record	TTL (s)	Duration
  NS	86400	1d
  A	7373	7373s
  MX	3600	1h
  SOA	28800	8h

The records a browser needs to open your site.

• OK

  Address of the domain

  pornhub.com resolves to 1 address(es). explain

  66.254.114.41
  

• OK

  No CNAME at the zone apex

  The zone apex correctly has no CNAME record. explain

• OK

  www subdomain

  www.pornhub.com resolves. explain

  pornhub.com.
  66.254.114.41
  

• Warning

  IPv6 (AAAA)

  No AAAA record was found. IPv6-only mobile networks reach your site only through a carrier translator, which adds latency. explain

• Info

  HTTPS (SVCB) record

  No HTTPS resource record. It is optional, but it removes the initial HTTP redirect and advertises HTTP/3 (ECH also relies on it). explain

• OK

  Wildcard record

  Non-existent names correctly return NXDOMAIN (no wildcard). explain

• OK

  Web server answers

  The web server replied with HTTP 200 over HTTPS. explain

  Final URL: https://www.pornhub.com/
  

MX records and everything a receiving server checks before accepting your mail.

• OK

  MX records

  2 mail server(s) are published. explain

  Priority	Mail server	Addresses	Reverse DNS
  10	mxa-002a0701.gslb.pphosted.com	67.231.151.26	mx0d-002a0701.pphosted.com
  10	mxb-002a0701.gslb.pphosted.com	67.231.158.156	mx0c-002a0701.pphosted.com

• OK

  Mail server redundancy

  2 mail servers provide redundancy. explain

• OK

  MX hosts resolve

  Every mail server resolves to at least one address. explain

• OK

  Reverse DNS of the mail servers

  Every mail server address has a PTR record. explain

  67.231.151.26 -> mx0d-002a0701.pphosted.com
  67.231.158.156 -> mx0c-002a0701.pphosted.com
  

• Info

  DANE / TLSA

  No TLSA record. DANE is optional and requires DNSSEC, but it is the strongest protection against downgrade attacks on SMTP. explain

• OK

  Blocklists (DNSBL)

  No mail or web address of this domain is listed on the public blocklists we query. explain

SPF, DKIM, DMARC and the modern transport policies.

• OK

  SPF

  The SPF record ends in -all, so unauthorised senders are rejected or marked. explain

  v=spf1 include:_spf.mlsend.com include:sender.zohobooks.com include:mail.zendesk.com ip4:94.199.255.10/32 ip4:208.91.206.64/26 ip4:66.254.113.78/32 ip4:66.254.119.174 ip4:66.254.113.78 ip4:66.254.112.72/30 ip4:162.211.96.66 ip4:162.211.96.67 ip4:67.231.151.26 ip4:67.231.158.156 a:smtp-out.reflected.net a:devilrays-out.reflected.net include:spf.protection.outlook.com -all
  DNS lookups used: 7 of 10
  

• Warning

  DMARC

  DMARC is in monitoring mode (p=none): failures are reported but nothing is blocked. explain

  v=DMARC1; p=none; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:postmaster@pornhub.com,mailto:dmarc_agg@vali.email; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:postmaster@pornhub.com;
  Aggregate reports go to mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:postmaster@pornhub.com,mailto:dmarc_agg@vali.email
  

• OK

  DKIM

  DKIM keys were found on 2 common selector(s). Only selectors that are published in DNS can be discovered this way. explain

  default._domainkey: v=DKIM1; g=*; k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCx54GnEDw9Sb2UClRujHinozkp+HKJyJ5Gtn+pDVV+qTi54SgUSF3dECcM2H
  mail._domainkey: v=DKIM1; g=*; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDTr4Bi9CxCWraRxngxPu2OYp8rv01JFlxcp+0Z1tVVBxqHa1lfQQ6JorXZG
  

• Info

  MTA-STS

  No MTA-STS policy. It stops attackers from stripping TLS between mail servers and is supported by the large providers. explain

• Info

  TLS-RPT

  No TLS-RPT record. It is the reporting half of MTA-STS and DANE. explain

• Info

  BIMI

  No BIMI record. It shows your brand logo next to authenticated mail and requires DMARC at p=quarantine or p=reject first. explain

DNSSEC, certificate authorisation and exposure of the zone.

• Warning

  DNSSEC

  DNSSEC is not enabled. Without it, answers for your domain can be forged on the way to the resolver. explain

• Warning

  CAA

  No CAA record. Any certificate authority in the world may issue a certificate for your domain; a CAA record limits that to the ones you choose. explain

• OK

  Zone transfer (AXFR)

  No name server allows an anonymous zone transfer. explain

• Warning

  Software version disclosure

  The name servers reveal their software version, which tells an attacker exactly which vulnerabilities to try. explain

  sdns3.ultradns.biz: UltraDNS Nameserver
  sdns3.ultradns.com: UltraDNS Nameserver
  sdns3.ultradns.net: UltraDNS Nameserver
  sdns3.ultradns.org: UltraDNS Nameserver