Analysis report on domain: vxns.de
Your domain is really well configured
[ 126.96.36.199 ]
- 30 ms
- RCODE : 0 AA : 0 TC : 0
- Numbers of Labels
- 13 Sep 2021 20:03
- 27 Sep 2021 21:33
- 8 (RSA/SHA-256)
- Orig TTL
- 86400 (1 day)
- 7200 (2 hours)
- signature Name
BIND version is hidden
The Bind version should not be visible otherwise it will be possible to search for potential security vulnerabilities of the version.
Domain have at least 2 DNS servers
In order for the availability rate of DNS servers to be at its highest, it is vital and recommended by the RFC to have at least 2 servers.RFC
All Dns servers are responding
Every DNS servers should be accessible and accept public query.
All servers return success
It's important that all servers returned a "success" code.
Responses are not CNAME or A
The answers should not be a CNAME or A type.RFC
DNS servers IP are differents
IPs for DNS servers must be different in order to have high availability.
DNS servers IP are in different class C
The class C of each IP must be different so that the servers are not found on the same bay and therefore there is a risk of unavailability.RFC
SOA are synchronized
The SOA answered by the DNS servers must be identical for each servers. The most important information is the master server and the contact email address.
SOA email is valid
An email address must respect some conditions to be valid, accordding to the RFC 5322.RFC
SOA refresh is valid
The refresh value be must between 1200 and 43200.RFC
SOA retry, refresh and expire values are correct
The Retry, Refresh and Expire values musth follow this path : retry < refresh < expire.RFC
DNS servers are not open relay
DNS resolvers that allow queries from all IP addresses and are exposed to the Internet can be attacked and used to conduct Denial of Service (DoS) attacks on behalf of the hacker.
Transfer zone is disable
An attacker can use a zone transfer that contains a malicious code or an inappropriate format that crashes a DNS server vulnerable to this type of attack, which results in a DoS that destabilizes the DNS services. It is possible to test it manually with this commands: #host -T axfr or #dig axfr.documentation
Recursive query is disable
DNS servers IP are not private
It is strictly forbidden to have private IP in DNSdocumentation
Same MX are returned
It is extremely important that each DNS return the same MX records in order to avoid contacting an SMTP server that no longer exists.
DNS servers are synchronized
The synchronization of the DNS servers must be perfect in order to avoid any dns resolution error. The servers must therefore give the same answer when asked "what are the DNS servers for the domain?".
- Whois server
- Created at
- Changed at
- 01 Jan 2021
- Expires at
- Name servers
Google Safe Browsing
- RFC Ignorant
- Rbl Jp
- Spam Eating Monkey
- Support Intelligence
- Detection ratio
- 0 / 77
- Artists Against 419
- CINS Army
- CLEAN MX
- Comodo Valkyrie Verdict
- Feodo Tracker
- Google Safebrowsing
- Malware Domain Blocklist
- Phishing Database
- Quick Heal
- Snort IP sample list
- Sucuri SiteCheck
- VX Vault
- Virusdie External Site Scan
- Web Security Guard
- Yandex Safebrowsing
- malwares.com URL checker
- Forcepoint ThreatSeeker
Domain is not blacklisted
A domain must not be blacklisted or it will be penalized for referencing and deliverability of emails.
Domain is not listed in Google Safe Browsing
Google safe browsing categorizes a domain as bad if something suspicious is detected.
Domain is not listed in VirusTotal
Virus Total analyze your domain or IP address with 66 antivirus.
Domain have good reputation on Web of Trust
Web Of Trust rates thousands of websites and find threats if they exist.
DNS servers are same in dns tree and whois
The dns servers given in the domain whois must be the same as those returned by a dns resolution request.
This domain has no MX server
Autodiscover not configured
MX servers are accessibles
Smtp servers that are listed in DNS area must be accessible, otherwise, there is a risk that emails may be lost
MX IPs have reverse
When a sending server makes a connection to the recipient server, the recipient server notes the sending IP address and performs a reverse lookup, called a PTR lookup, named after the type of DNS record used. If the result of the reverse lookup matches the result of a forward DNS Lookup, then it's much more likely that the message is legitimate. If the IP address doesn't match, it's much more likely that the sending address was spoofed and therefore much more likely that it's unwanted and could be considered spam.documentation
HELO command is accepted
According to the RFC 2181, smtp server should accept HELO commandRFC
EHLO command is accepted
According to the RFC 2181, smtp server should accept EHLO commandRFC
STARTTLS command is accepted
STARTTLS turns an unencrypted connection into a secure connection. Note: You can use a service like altospam to solve this problem. Click on the link below to learn more
EXPN command is refused
EXPN command is now considered to be a security risk, spammers being able to harvest valid e-mail addresses via each mailing list.
VRFY command is refused
As the EXPN command, VRFY is used by spammers to verify an address.
MX servers are not open relay
If a server is open relay, there is a risk that spammers use your server to send illegitimate mail.
MX servers accept abuse@ address
According to the RFC 2142, SMTP server should accept abuse@yourDomain as a recipient.RFC
MX servers accept postmaster@ address
According to the RFC 5321, SMTP server should accept postmaster@yourDomain as a recipient.RFC
Banner return 2xx or 4xx code
The banner must return (2xx) a valid (4xx) or temporary code.
Banner return server name
Banner must contain the name of the server
SMTP server type is hidden
There is a risk to display the type and the version of the server, because people can find a breach for a specific version and use it
Domain have "A" field
The domain must have an A field in order for the website to be accessible.
Host "www" have "A" field
WWW host is not required for a website, but it's better to have one.
Domain have "AAAA" field
It is highly recommended to have an IPv6 for the website.
Host "www" have "AAAA" field
If you configure a WWW host for your website, it is recommended to have an IPv6.
HTTP port (80) is open
This test verifies the presence of a website for the given IP or domain. Then scans port 80.
If the domain or IP is pointing to a website then port 80 must be open so that it can be accessed from a browser.
Otherwise port 80 must be closed.
HTTPS port (443) is open
This test verifies the presence of a website for the given IP or domain. Then scans port 443.
If the domain or IP is pointing to a website then port 443 must be open so that it can be accessed from a browser.
Otherwise port 443 must be closed.
Web server version is hidden
To avoid giving details to malicious people, the version of the server should not be visible.
Web application technology is hidden
To avoid giving details to malicious people, the technology that supports the application should not be visible.
Cookies are secure
X-XSS-Protection header is present
The HTTP X-XSS-Protection response header is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks.documentation
Content Security Policy header is present
The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (XSS).documentation
Content Type Options header is present
The only defined value, "nosniff", prevents Internet Explorer from MIME-sniffing a response away from the declared content-type. This also applies to Google Chrome, when downloading extensions.