DNS report for zone netfilter.org

This is a cached entry from 2011-02-06 11:38:48, press here to do a realtime lookup!

• Category Status Test Name Information
• NS
  • 
  • NS records from
    your nameservers

  • NS records got from your nameservers are:

    
    

    ns1.free-net.net [62.104.64.8]
    sunserv.kfki.hu [148.6.0.5]
    ns.sdg.de [62.245.145.254]
    dns.franken.de [193.175.24.33]
    chaplin.franken.de [193.175.24.40, 193.175.24.39]
    ns2.freenet.de [194.97.109.82]
    

• • 
  • Zone transfers

  • All of your nameservers disallows zone transfers (AXFR). This is good.

• • 
  • Recursive Queries

  • I could use the nameservers listed below to performe recursive queries. It may be that I am wrong but the chances of that are low. You should not have nameservers that allow recursive queries as this will allow almost anyone to use your nameservers and can cause problems. Problem record(s) are:
    dns.franken.de
    chaplin.franken.de

• • 
  • Mismatched NS records

  • OK. The NS records at all your nameservers are identical.

• • 
  • DNS servers responded

  • Good. All nameservers listed at the parent server responded.

• • 
  • Multiple Nameservers

  • OK. You have multiple nameservers. In most cases 2 are enough, however, RFC2182 section 5 states that you must have at least 3 nameservers, and no more than 7.

• • 
  • Nameservers are lame

  • OK. All the nameservers listed at the parent servers answer authoritatively for your domain.

• • 
  • Domain CNAMES

  • OK. RFC1912 2.4 and RFC2181 10.3 state that there should be no CNAMEs if an NS (or any other)
    record is present.

• • 
  • Different subnets

  • OK. Looks like you have nameservers on different subnets!

• • 
  • IPs of nameservers
    are public

  • Ok. Looks like the IP addresses of your nameservers are public. This is a good thing because it will prevent DNS delays and other problems like

• • 
  • DNS servers allow
    TCP connection

  • OK. Seems all your DNS servers allow TCP connections. This is a good thing and useful even if UDP connections are used by default.

• SOA
  • 
  • SOA record

  • The SOA record is:
    Primary nameserver: ns.netfilter.org
    Hostmaster E-mail address: hostmaster@netfilter.org
    Serial #: 2010102101
    Refresh: 86400
    Retry: 7200
    Expire:3600000
    Default TTL: 43200

• • 
  • NSs have same SOA
    serial

  • OK. All your nameservers agree that your SOA serial number is 2010102101

• • 
  • SOA MNAME entry

  • WARN. ns.netfilter.org is not listed in the zone as a nameserver. This could mean that you're leaking information about a hidden master.

• • 
  • SOA Serial

  • Your SOA serial number is: 2010102101. Your SOA serial can pretty much be whatever you want, but most people prefer to have it in YYYYMMDD00-99 format.

• • 
  • SOA REFRESH

  • WARN Your SOA REFRESH interval is: 86400. We recommend that you lower it to be within the 1200 to 43200 range. (20 minutes to 12 hours)

• • 
  • SOA RETRY

  • OK. Your SOA RETRY value is: 600. Looks ok.

• • 
  • SOA EXPIRE

  • WARN. Your SOA EXPIRE interval is: 3600000. We recommend that you lower it to be within the 1209600 to 2419200 range. (2 to 4 weeks)

• • 
  • SOA MINIMUM

  • WARN. Your SOA MINIMUM interval is: 43200. We recommend that you lower it to be within the 3600 to 10800 range. (1 to 3 hours)

• MX
  • 
  • MX Records

  • Your MX records that were reported by your nameservers are:

    
    

    10 vishnu.netfilter.org
    

• • 
  • MX is not IP

  • OK. All of your MX records are host names.

• • 
  • Multiple MX

  • WARN. You have one MX-record. You should look into getting a backup mailserver for increased redundancy.

• WWW
  • 
  • WWW Record

  • Your www.netfilter.org record is:
    www.netfilter.org [213.95.27.115]
    

• • 
  • IPs are public

  • OK. All of your WWW IPs appear to be public IPs.

• • 
  • WWW CNAME

  • OK. No CNAME