showlogin.cc

What the registry for .cc publishes about your domain.

• OK

  Parent name servers

  The .cc registry answered from ac1.nstld.com (192.42.173.30). explain

  ac1.nstld.com  192.42.173.30
  ac2.nstld.com  192.42.174.30
  ac3.nstld.com  192.42.175.30
  ac4.nstld.com  192.42.176.30
  

• OK

  Delegation at the registry

  The registry delegates the domain to 2 name server(s). explain

  ns11.abovedomains.com
  ns12.abovedomains.com
  

• OK

  Number of name servers

  2 name servers are delegated, which is a healthy number. explain

• Info

  Glue records

  All name servers are outside this zone, so no glue record is needed. explain

• OK

  Registry and zone agree

  The registry and your name servers publish exactly the same NS list. explain

• OK

  Registration (RDAP)

  Registration data was retrieved over RDAP. explain

  Registrar: Above.com Pty Ltd.
  Registered: 2020-07-24 21:17:34
  Expires: 2027-07-24 21:17:34
  Status: client transfer prohibited
  

Direct queries sent to every authoritative server of the zone.

• Info

  Answering servers

  2 authoritative servers were queried directly over UDP. explain

  Name server	Addresses	Response	Serial	Authoritative	Answers
  ns11.abovedomains.com	103.224.182.47	66.9 ms	2026091901	✓	✓
  ns12.abovedomains.com	103.224.212.47	67.0 ms	2026091901	✓	✓

• OK

  All name servers respond

  Every delegated name server answered a direct UDP query. explain

• OK

  Authoritative answers

  Every server answers authoritatively for the zone. explain

• OK

  SOA serial is in sync

  All name servers report the same serial number (2026091901). explain

• OK

  NS records are identical

  Every server publishes the same NS record set. explain

• OK

  Recursion is disabled

  No name server offers open recursion to the internet. explain

• Warning

  DNS over TCP

  These servers do not answer over TCP. TCP is mandatory (RFC 7766) and is needed for large answers such as DNSSEC: ns11.abovedomains.com explain

• Warning

  EDNS(0) support

  These servers ignore EDNS(0), which limits answer size and blocks DNSSEC: ns11.abovedomains.com, ns12.abovedomains.com explain

• OK

  Network diversity

  Name servers are spread over 2 different networks. explain

• Warning

  IPv6 reachable name servers

  No name server has an AAAA record. IPv6-only clients and networks will depend on a translator to resolve your domain. explain

• OK

  Response time

  Average response time 67.0 ms, slowest 67.0 ms. explain

• Info

  Reverse DNS of the name servers

  Reverse names resolved for the servers. explain

  ns11.abovedomains.com: ns11.above.com
  ns12.abovedomains.com: ns12.above.com
  

The Start Of Authority record and its timers.

• OK

  SOA record exists

  The zone publishes a SOA record. explain

  ns1.abovedomains.com. hostmaster.trellian.com. 2026091901 10800 3600 604800 3600
  

• Warning

  Primary server (MNAME)

  The primary server in the SOA (ns1.abovedomains.com) is not listed as an NS record. That is legal for a hidden primary, but dynamic updates and notifications often break because of it. explain

• OK

  Zone contact (RNAME)

  Zone contact: hostmaster@trellian.com explain

• OK

  Serial number

  The serial 2026091901 follows the recommended YYYYMMDDnn format. explain

• OK

  Refresh

  Refresh is 3h, inside the recommended range. explain

• OK

  Retry

  Retry is 1h, inside the recommended range. explain

• Warning

  Expire

  Expire is 7d, below the recommended minimum of 14d. explain

• OK

  Minimum TTL (negative caching)

  Minimum TTL (negative caching) is 1h, inside the recommended range. explain

• OK

  TTL values

  Record TTLs are in a sensible range. explain

  Record	TTL (s)	Duration
  NS	86400	1d
  A	3600	1h
  MX	3600	1h
  SOA	3600	1h

The records a browser needs to open your site.

• OK

  Address of the domain

  showlogin.cc resolves to 1 address(es). explain

  103.224.182.242
  

• OK

  No CNAME at the zone apex

  The zone apex correctly has no CNAME record. explain

• OK

  www subdomain

  www.showlogin.cc resolves. explain

  103.224.182.242
  

• Warning

  IPv6 (AAAA)

  No AAAA record was found. IPv6-only mobile networks reach your site only through a carrier translator, which adds latency. explain

• Info

  HTTPS (SVCB) record

  No HTTPS resource record. It is optional, but it removes the initial HTTP redirect and advertises HTTP/3 (ECH also relies on it). explain

• Info

  Wildcard record

  A random, non-existent subdomain answers with 103.224.182.242, so the zone has a wildcard. This hides typos and prevents NXDOMAIN answers. explain

• Warning

  Web server answers

  No web server answered on port 80 or 443 (ConnectionError). This does not affect DNS, but the site is not serving pages. explain

MX records and everything a receiving server checks before accepting your mail.

• OK

  MX records

  1 mail server(s) are published. explain

  Priority	Mail server	Addresses	Reverse DNS
  10	park-mx.above.com	103.224.212.34	park-mx.above.com

• Warning

  Mail server redundancy

  Only one MX record exists. A second server (or a backup MX at a different provider) keeps mail queued during an outage instead of bouncing it. explain

• OK

  MX hosts resolve

  Every mail server resolves to at least one address. explain

• OK

  Reverse DNS of the mail servers

  Every mail server address has a PTR record. explain

  103.224.212.34 -> park-mx.above.com
  

• Info

  DANE / TLSA

  No TLSA record. DANE is optional and requires DNSSEC, but it is the strongest protection against downgrade attacks on SMTP. explain

• OK

  Blocklists (DNSBL)

  No mail or web address of this domain is listed on the public blocklists we query. explain

SPF, DKIM, DMARC and the modern transport policies.

• OK

  SPF

  The SPF record ends in -all, so unauthorised senders are rejected or marked. explain

  v=spf1 ip6:fdcf:abda:4154::/48 -all
  DNS lookups used: 0 of 10
  

• Error

  DMARC

  No DMARC record at _dmarc.showlogin.cc. Without it, SPF and DKIM failures have no consequence and you receive no reports about abuse of your domain. explain

• Warning

  DKIM

  No DKIM key was found on the selectors we probe. DKIM may still be active on a private selector, but without it DMARC survives no forwarding. explain

• Info

  MTA-STS

  No MTA-STS policy. It stops attackers from stripping TLS between mail servers and is supported by the large providers. explain

• Info

  TLS-RPT

  No TLS-RPT record. It is the reporting half of MTA-STS and DANE. explain

• Info

  BIMI

  No BIMI record. It shows your brand logo next to authenticated mail and requires DMARC at p=quarantine or p=reject first. explain

DNSSEC, certificate authorisation and exposure of the zone.

• Warning

  DNSSEC

  DNSSEC is not enabled. Without it, answers for your domain can be forged on the way to the resolver. explain

• Warning

  CAA

  No CAA record. Any certificate authority in the world may issue a certificate for your domain; a CAA record limits that to the ones you choose. explain

• OK

  Zone transfer (AXFR)

  No name server allows an anonymous zone transfer. explain

• OK

  Software version disclosure

  The name servers do not disclose their software version. explain