{"blurb":"Everything important checks out.","check_count":26,"checked_types":["A","AAAA","CNAME","MX","NS","TXT","SOA","CAA","SRV","DS","DNSKEY","NAPTR","PTR"],"checks":[{"detail":"2 nameserver(s): elliott.ns.cloudflare.com, hera.ns.cloudflare.com","fix":null,"group":"Nameservers","id":"ns_present","severity":"ok","title":"Nameservers are published"},{"detail":"Each nameserver name has an A/AAAA record.","fix":null,"group":"Nameservers","id":"ns_resolves","severity":"ok","title":"Every nameserver resolves"},{"detail":"All 6 server address(es) replied to a query.","fix":null,"group":"Nameservers","id":"ns_responds","severity":"ok","title":"Every nameserver answers"},{"detail":"All nameservers returned the same answers.","fix":null,"group":"Nameservers","id":"ns_consistent","severity":"ok","title":"Nameservers agree"},{"detail":"The parent zone and the zone agree on the nameservers.","fix":null,"group":"Nameservers","id":"ns_delegation","severity":"ok","title":"Delegation matches"},{"detail":"All nameservers report serial 2416374680.","fix":null,"group":"Nameservers","id":"soa_serial","severity":"ok","title":"SOA serial is in sync"},{"detail":"refresh 10000s, retry 2400s, expire 604800s, minimum 1800s.","fix":null,"group":"Nameservers","id":"soa_timers","severity":"ok","title":"SOA timers are sane"},{"detail":"NS TTL is 86400s.","fix":null,"group":"Nameservers","id":"ns_ttl","severity":"ok","title":"Nameserver TTL is reasonable"},{"detail":"A null MX (\"0 .\") is published: the domain deliberately does not receive mail. RFC 7505.","fix":null,"group":"Email delivery","id":"mx_present","severity":"ok","title":"Mail servers are published"},{"detail":"v=spf1 -all","fix":null,"group":"Spoofing protection","id":"spf_present","severity":"ok","title":"SPF is published"},{"detail":"A single, well-formed v=spf1 record.","fix":null,"group":"Spoofing protection","id":"spf_syntax","severity":"ok","title":"SPF syntax is valid"},{"detail":"Ends with -all: unauthorised senders are rejected.","fix":null,"group":"Spoofing protection","id":"spf_all","severity":"ok","title":"SPF policy is strict"},{"detail":"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s","fix":null,"group":"Spoofing protection","id":"dmarc_present","severity":"ok","title":"DMARC is published"},{"detail":"p=reject.","fix":null,"group":"Spoofing protection","id":"dmarc_policy","severity":"ok","title":"DMARC policy is enforced"},{"detail":"No rua= address: you get no aggregate reports.","fix":"Add rua=mailto:dmarc@yourdomain to see who sends as you.","group":"Spoofing protection","id":"dmarc_rua","severity":"note","title":"DMARC reports are sent"},{"detail":"Found a public key under selector 'default'.","fix":null,"group":"Spoofing protection","id":"dkim","severity":"ok","title":"DKIM signing is visible"},{"detail":"1 DS record(s) at the parent.","fix":null,"group":"DNSSEC","id":"ds_present","severity":"ok","title":"DS record is published"},{"detail":"4 DNSKEY record(s).","fix":null,"group":"DNSSEC","id":"dnskey_present","severity":"ok","title":"Zone keys are published"},{"detail":"A validating resolver returned a secure (AD) answer.","fix":null,"group":"DNSSEC","id":"dnssec_chain","severity":"ok","title":"Chain of trust validates"},{"detail":"Signature expires in 1 day(s) (2026-10-13).","fix":"Normal where the provider re-signs automatically; only a problem if signing is manual and nobody is watching.","group":"DNSSEC","id":"rrsig_expiry","severity":"note","title":"Signatures are current"},{"detail":"The apex has no CNAME.","fix":null,"group":"Everything else","id":"apex_cname","severity":"ok","title":"No CNAME at the apex"},{"detail":"No CAA records: any certificate authority may issue a certificate for this domain.","fix":"Add e.g. CAA 0 issue \"letsencrypt.org\".","group":"Everything else","id":"caa_present","severity":"note","title":"CAA restricts who can issue TLS"},{"detail":"2 A record(s).","fix":null,"group":"Everything else","id":"a_present","severity":"ok","title":"The domain has an address"},{"detail":"2 AAAA record(s).","fix":null,"group":"Everything else","id":"aaaa_present","severity":"ok","title":"IPv6 is configured"},{"detail":"A random name under the domain does not resolve.","fix":null,"group":"Everything else","id":"wildcard","severity":"ok","title":"No hidden wildcard"},{"detail":"2 TXT record(s).","fix":null,"group":"Everything else","id":"txt_present","severity":"ok","title":"TXT records are present"}],"counts":{"critical":0,"note":3,"ok":23,"warning":0},"domain":"example.com","generated_at":"2026-10-12 11:11:15 UTC","grade":"healthy","groups":[{"checks":[{"detail":"2 nameserver(s): elliott.ns.cloudflare.com, hera.ns.cloudflare.com","fix":null,"group":"Nameservers","id":"ns_present","severity":"ok","title":"Nameservers are published"},{"detail":"Each nameserver name has an A/AAAA record.","fix":null,"group":"Nameservers","id":"ns_resolves","severity":"ok","title":"Every nameserver resolves"},{"detail":"All 6 server address(es) replied to a query.","fix":null,"group":"Nameservers","id":"ns_responds","severity":"ok","title":"Every nameserver answers"},{"detail":"All nameservers returned the same answers.","fix":null,"group":"Nameservers","id":"ns_consistent","severity":"ok","title":"Nameservers agree"},{"detail":"The parent zone and the zone agree on the nameservers.","fix":null,"group":"Nameservers","id":"ns_delegation","severity":"ok","title":"Delegation matches"},{"detail":"All nameservers report serial 2416374680.","fix":null,"group":"Nameservers","id":"soa_serial","severity":"ok","title":"SOA serial is in sync"},{"detail":"refresh 10000s, retry 2400s, expire 604800s, minimum 1800s.","fix":null,"group":"Nameservers","id":"soa_timers","severity":"ok","title":"SOA timers are sane"},{"detail":"NS TTL is 86400s.","fix":null,"group":"Nameservers","id":"ns_ttl","severity":"ok","title":"Nameserver TTL is reasonable"}],"name":"Nameservers","problems":0},{"checks":[{"detail":"A null MX (\"0 .\") is published: the domain deliberately does not receive mail. RFC 7505.","fix":null,"group":"Email delivery","id":"mx_present","severity":"ok","title":"Mail servers are published"}],"name":"Email delivery","problems":0},{"checks":[{"detail":"v=spf1 -all","fix":null,"group":"Spoofing protection","id":"spf_present","severity":"ok","title":"SPF is published"},{"detail":"A single, well-formed v=spf1 record.","fix":null,"group":"Spoofing protection","id":"spf_syntax","severity":"ok","title":"SPF syntax is valid"},{"detail":"Ends with -all: unauthorised senders are rejected.","fix":null,"group":"Spoofing protection","id":"spf_all","severity":"ok","title":"SPF policy is strict"},{"detail":"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s","fix":null,"group":"Spoofing protection","id":"dmarc_present","severity":"ok","title":"DMARC is published"},{"detail":"p=reject.","fix":null,"group":"Spoofing protection","id":"dmarc_policy","severity":"ok","title":"DMARC policy is enforced"},{"detail":"No rua= address: you get no aggregate reports.","fix":"Add rua=mailto:dmarc@yourdomain to see who sends as you.","group":"Spoofing protection","id":"dmarc_rua","severity":"note","title":"DMARC reports are sent"},{"detail":"Found a public key under selector 'default'.","fix":null,"group":"Spoofing protection","id":"dkim","severity":"ok","title":"DKIM signing is visible"}],"name":"Spoofing protection","problems":1},{"checks":[{"detail":"1 DS record(s) at the parent.","fix":null,"group":"DNSSEC","id":"ds_present","severity":"ok","title":"DS record is published"},{"detail":"4 DNSKEY record(s).","fix":null,"group":"DNSSEC","id":"dnskey_present","severity":"ok","title":"Zone keys are published"},{"detail":"A validating resolver returned a secure (AD) answer.","fix":null,"group":"DNSSEC","id":"dnssec_chain","severity":"ok","title":"Chain of trust validates"},{"detail":"Signature expires in 1 day(s) (2026-10-13).","fix":"Normal where the provider re-signs automatically; only a problem if signing is manual and nobody is watching.","group":"DNSSEC","id":"rrsig_expiry","severity":"note","title":"Signatures are current"}],"name":"DNSSEC","problems":1},{"checks":[{"detail":"The apex has no CNAME.","fix":null,"group":"Everything else","id":"apex_cname","severity":"ok","title":"No CNAME at the apex"},{"detail":"No CAA records: any certificate authority may issue a certificate for this domain.","fix":"Add e.g. CAA 0 issue \"letsencrypt.org\".","group":"Everything else","id":"caa_present","severity":"note","title":"CAA restricts who can issue TLS"},{"detail":"2 A record(s).","fix":null,"group":"Everything else","id":"a_present","severity":"ok","title":"The domain has an address"},{"detail":"2 AAAA record(s).","fix":null,"group":"Everything else","id":"aaaa_present","severity":"ok","title":"IPv6 is configured"},{"detail":"A random name under the domain does not resolve.","fix":null,"group":"Everything else","id":"wildcard","severity":"ok","title":"No hidden wildcard"},{"detail":"2 TXT record(s).","fix":null,"group":"Everything else","id":"txt_present","severity":"ok","title":"TXT records are present"}],"name":"Everything else","problems":1}],"ipv6_tested":false,"nameserver_rows":[{"answers":true,"ips":["162.159.44.228","108.162.195.228","172.64.35.228","2a06:98c1:50::ac40:23e4","2606:4700:58::a29f:2ce4","2803:f800:50::6ca2:c3e4"],"name":"elliott.ns.cloudflare.com"},{"answers":true,"ips":["108.162.192.162","172.64.32.162","173.245.58.162","2a06:98c1:50::ac40:20a2","2606:4700:50::adf5:3aa2","2803:f800:50::6ca2:c0a2"],"name":"hera.ns.cloudflare.com"}],"nameservers":["elliott.ns.cloudflare.com","hera.ns.cloudflare.com"],"parent_nameservers":["a.gtld-servers.net","b.gtld-servers.net","c.gtld-servers.net","d.gtld-servers.net","e.gtld-servers.net","f.gtld-servers.net","g.gtld-servers.net","h.gtld-servers.net","i.gtld-servers.net","j.gtld-servers.net","k.gtld-servers.net","l.gtld-servers.net","m.gtld-servers.net"],"problem_count":3,"records":{"A":{"answers":["104.20.23.154","172.66.147.243"],"cname":null,"status":"ok","ttl":300},"AAAA":{"answers":["2606:4700:10::ac42:93f3","2606:4700:10::6814:179a"],"cname":null,"status":"ok","ttl":300},"CAA":{"answers":[],"cname":null,"status":"nodata","ttl":null},"CNAME":{"answers":[],"cname":null,"status":"nodata","ttl":null},"DNSKEY":{"answers":["257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0d xCjjnopKl+GqJxpVXckHAeF+KkxLbxIL fDLUT0rAK9iUzy1L53eKGQ==","256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWz JaOau8XNEZeqCYKD5ar0IRd8KqXXFJkq mVfRvMGPmM1x8fGAa2XhSA==","256 3 13 kxipjoIbNZDsWqEKaYaGq6fM/XThrRp1 ue6AV9R/n3eWxpGCeCWJb47PEEEj/Q6V AYFW/7UFo5mXoZfxKYZa3A==","256 3 13 MjyZielP0GqniI1+j+wAG/3t0ImDDIlj 1CxR0oobkZQHSKH2Fqx6tm2NcYu57POJ 83SzCWLkqIjZHS1mh5wbaw=="],"cname":null,"status":"ok","ttl":3600},"DS":{"answers":[],"cname":null,"status":"nodata","ttl":null},"MX":{"answers":["0 ."],"cname":null,"status":"ok","ttl":300},"NAPTR":{"answers":[],"cname":null,"status":"nodata","ttl":null},"NS":{"answers":["elliott.ns.cloudflare.com.","hera.ns.cloudflare.com."],"cname":null,"status":"ok","ttl":86400},"PTR":{"answers":[],"cname":null,"status":"nodata","ttl":null},"SOA":{"answers":["elliott.ns.cloudflare.com. dns.cloudflare.com. 2416374680 10000 2400 604800 1800"],"cname":null,"status":"ok","ttl":1800},"SRV":{"answers":[],"cname":null,"status":"nodata","ttl":null},"TXT":{"answers":["\"_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9\"","\"v=spf1 -all\""],"cname":null,"status":"ok","ttl":300}},"score":97}