DNS check

SYSTEM

Unspecified (Unspecified)
Using version v6.0.0 of the Zonemaster engine.

BASIC

The domain must have a parent domain (Basic01)
The parent zone is "no" as returned from name servers "i.nic.no/194.146.106.6; i.nic.no/2001:67c:1010:1::53; njet.norid.no/156.154.101.12; not.norid.no/156.154.100.12; not.norid.no/2001:502:ad09::12; x.nic.no/128.39.8.40; x.nic.no/2001:700:0:412f::40; y.nic.no/193.75.4.22; y.nic.no/2001:8c0:8200:1::2; z.nic.no/158.38.8.133; z.nic.no/2001:700:0:52d:158:38:8:133".
The domain must have a parent domain (Basic01)
The zone "nilsnh.no" is found.
The domain must have at least one working name server (Basic02)
Authoritative answer on SOA query for "nilsnh.no" is returned by name servers "ns1.box.nilsnh.no/185.112.146.150".
Unspecified (Unspecified)
Functional nameserver found. "A" query for www.nilsnh.no test skipped.

ADDRESS
Warning (1)

Name server address must be globally routable (Address01)
All Nameserver addresses are in the routable public addressing space.
Reverse DNS entry exists for name server IP address (Address02)
Nameserver ns2.box.nilsnh.no has an IP address (2a01:799:b9b:4704::247) without PTR configured.

CONNECTIVITY
Warning (3)

UDP connectivity (Connectivity01)
Nameserver ns2.box.nilsnh.no/141.0.66.74 does not respond to any queries over UDP.
UDP connectivity (Connectivity01)
Nameserver ns2.box.nilsnh.no/2a01:799:b9b:4704::247 does not respond to any queries over UDP.
AS Diversity (Connectivity03)
At least two IPv4 addresses of the authoritative nameservers are announced by different AS sets. A merged list of all AS: (29695, 44925).
AS Diversity (Connectivity03)
All authoritative nameservers have their IPv6 addresses in the same AS (29695).
IP Prefix Diversity (Connectivity04)
The following name server(s) are announced in unique IPv4 prefix(es): "ns1.box.nilsnh.no/185.112.146.150; ns2.box.nilsnh.no/141.0.66.74"
IP Prefix Diversity (Connectivity04)
The following name server(s) are announced in unique IPv6 prefix(es): "ns2.box.nilsnh.no/2a01:799:b9b:4704::247"

CONSISTENCY

SOA serial number consistency (Consistency01)
Saw SOA serial number 2025010700 on following nameserver set : ns1.box.nilsnh.no/185.112.146.150.
SOA serial number consistency (Consistency01)
A single SOA serial number was found (2025010700).
SOA RNAME consistency (Consistency02)
A single SOA rname value was found (hostmaster.box.nilsnh.no.).
SOA timers consistency (Consistency03)
A single SOA time parameter set was seen (REFRESH=7200, RETRY=3600, EXPIRE=1209600, MINIMUM=86400).
Name server NS consistency (Consistency04)
A single NS set was found (ns1.box.nilsnh.no.; ns2.box.nilsnh.no.).
Consistency between glue and authoritative data (Consistency05)
Glue records are consistent between glue and authoritative data.
SOA MNAME consistency (Consistency06)
A single SOA mname value was seen (ns1.box.nilsnh.no.).

DELEGATION
Warning (2)

Minimum number of name servers (Delegation01)
Delegation lists enough (2) nameservers. Lower limit set to 2. Name servers: ns1.box.nilsnh.no; ns2.box.nilsnh.no
Minimum number of name servers (Delegation01)
Child lists enough (2) nameservers. Lower limit set to 2. Name servers: ns1.box.nilsnh.no; ns2.box.nilsnh.no
Minimum number of name servers (Delegation01)
Child lists enough (2) nameservers that resolve to IPv4 addresses. Lower limit set to 2. Name servers: ns1.box.nilsnh.no/185.112.146.150; ns2.box.nilsnh.no/141.0.66.74
Minimum number of name servers (Delegation01)
Child does not list enough (1) nameservers that resolve to IPv6 addresses. Lower limit set to 2. Name servers: ns2.box.nilsnh.no/2a01:799:b9b:4704::247
Minimum number of name servers (Delegation01)
Delegation lists enough (2) nameservers that resolve to IPv4 addresses. Lower limit set to 2. Name servers: ns1.box.nilsnh.no/185.112.146.150; ns2.box.nilsnh.no/141.0.66.74
Minimum number of name servers (Delegation01)
Delegation does not list enough (1) nameservers that resolve to IPv6 addresses. Lower limit set to 2. Name servers: ns2.box.nilsnh.no/2a01:799:b9b:4704::247
Name servers must have distinct IP addresses (Delegation02)
All the IP addresses used by the nameservers in parent are unique.
Name servers must have distinct IP addresses (Delegation02)
All the IP addresses used by the nameservers in child are unique.
Name servers must have distinct IP addresses (Delegation02)
All the IP addresses used by the nameservers are unique.
No truncation of referrals (Delegation03)
The smallest possible legal referral packet is smaller than 513 octets (it is 355).
Name server is authoritative (Delegation04)
All these nameservers are confirmed to be authoritative : ns1.box.nilsnh.no; ns2.box.nilsnh.no.
Name server must not point at CNAME alias (Delegation05)
No nameserver points to CNAME alias.
Existence of SOA (Delegation06)
All the nameservers have SOA record.
Parent glue name records present in child (Delegation07)
All of the nameserver names are listed both at parent and child.

DNSSEC
Warning (2) Error (1)

Verify NSEC3 parameters (DNSSEC03)
The following servers respond with a legal hash algorithm in NSEC3. Fetched from name servers "ns1.box.nilsnh.no/185.112.146.150".
Verify NSEC3 parameters (DNSSEC03)
The following servers respond with NSEC3 opt-out disabled (as recommended). Fetched from name servers "ns1.box.nilsnh.no/185.112.146.150".
Verify NSEC3 parameters (DNSSEC03)
The following servers respond with the NSEC3 iteration value 1. The recommended practice is to set this value to 0. Fetched from name servers "ns1.box.nilsnh.no/185.112.146.150".
Verify NSEC3 parameters (DNSSEC03)
The following servers respond with a legal empty salt in NSEC3. Fetched from name servers "ns1.box.nilsnh.no/185.112.146.150".
Check for too short or too long RRSIG lifetimes (DNSSEC04)
RRSIG with keytag 4594 and covering type(s) DNSKEY expires at : Thu Feb 6 00:00:00 2025.
Check for too short or too long RRSIG lifetimes (DNSSEC04)
RRSIG with keytag 61675 and covering type(s) DNSKEY expires at : Thu Feb 6 00:00:00 2025.
Check for too short or too long RRSIG lifetimes (DNSSEC04)
RRSIG with keytag 49843 and covering type(s) SOA expires at : Thu Feb 6 00:00:00 2025.
Check for too short or too long RRSIG lifetimes (DNSSEC04)
RRSIG with keytag 63799 and covering type(s) SOA expires at : Thu Feb 6 00:00:00 2025.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 49843 uses algorithm number 8 (RSA/SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 63799 uses algorithm number 13 (ECDSA Curve P-256 with SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 4594 uses algorithm number 8 (RSA/SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 61675 uses algorithm number 13 (ECDSA Curve P-256 with SHA-256), which is OK.
Zone contains NSEC or NSEC3 records (DNSSEC10)
The zone has NSEC3 records. Fetched from the nameservers with IP addresses "185.112.146.150".
Check for valid RSA DNSKEY key size (DNSSEC14)
DNSKEY with tag 49843 and using algorithm 8 (RSA/SHA-256) has a size (1024) smaller than the recommended one (2048).
Check for valid RSA DNSKEY key size (DNSSEC14)
DNSKEY with tag 4594 and using algorithm 8 (RSA/SHA-256) has a size (1024) smaller than the recommended one (2048).
Existence of CDS and CDNSKEY (DNSSEC15)
No CDS or CDNSKEY RRsets are found on any name server.

NAMESERVER

A name server should not be a recursor (Nameserver01)
Nameserver ns1.box.nilsnh.no/185.112.146.150 is not a recursor.
Test availability of zone transfer (AXFR) (Nameserver03)
AXFR not available on nameserver ns1.box.nilsnh.no/185.112.146.150.
Test availability of zone transfer (AXFR) (Nameserver03)
AXFR not available on nameserver ns2.box.nilsnh.no/141.0.66.74.
Test availability of zone transfer (AXFR) (Nameserver03)
AXFR not available on nameserver ns2.box.nilsnh.no/2a01:799:b9b:4704::247.
Same source address (Nameserver04)
All nameservers reply with same IP used to query them.
NS can be resolved (Nameserver06)
All nameservers succeeded to resolve to an IP address.
To check whether authoritative name servers return an upward referral (Nameserver07)
None of the following nameservers returns an upward referral : ns1.box.nilsnh.no; ns2.box.nilsnh.no.
Testing QNAME case insensitivity (Nameserver08)
Nameserver ns1.box.nilsnh.no/185.112.146.150 preserves original case of queried names (wwW.nilsnh.NO).
Testing QNAME case sensitivity (Nameserver09)
When asked for SOA records on "www.nilsnh.no" with different cases, all servers reply consistently.
Checking for revealed software version (Nameserver15)
The following name server(s) do not reveal the software version. Returned from name servers: "ns1.box.nilsnh.no/185.112.146.150"

SYNTAX

No illegal characters in the domain name (Syntax01)
No illegal characters in the domain name (nilsnh.no).
No hyphen ('-') at the start or end of the domain name (Syntax02)
Neither end of any label in the domain name (nilsnh.no) has a hyphen.
There must be no double hyphen ('--') in position 3 and 4 of the domain name (Syntax03)
Domain name (nilsnh.no) has no label with a double hyphen ('--') in position 3 and 4 (with a prefix which is not 'xn--').
The NS name must have a valid domain/hostname (Syntax04)
Nameserver (ns1.box.nilsnh.no) syntax is valid.
The NS name must have a valid domain/hostname (Syntax04)
Nameserver (ns2.box.nilsnh.no) syntax is valid.
Misuse of '@' character in the SOA RNAME field (Syntax05)
There is no misused '@' character in the SOA RNAME field (hostmaster.box.nilsnh.no.).
No illegal characters in the SOA RNAME field (Syntax06)
The SOA RNAME field (hostmaster@box.nilsnh.no) is compliant with RFC2822.
No illegal characters in the SOA MNAME field (Syntax07)
SOA MNAME (ns1.box.nilsnh.no) syntax is valid.
MX name must have a valid hostname (Syntax08)
Domain name MX (box.nilsnh.no) syntax is valid.

ZONE
Notice (1)

SOA 'refresh' minimum value (Zone02)
SOA 'refresh' value (7200) is less than the recommended one (14400).
SOA 'retry' lower than 'refresh' (Zone03)
SOA 'refresh' value (7200) is higher than the SOA 'retry' value (3600).
SOA 'retry' at least 1 hour (Zone04)
SOA 'retry' value (3600) is at least equal to the minimum recommended value (3600).
SOA 'expire' minimum value (Zone05)
SOA 'expire' value (1209600) is higher than the minimum recommended value (604800) and not lower than the 'refresh' value (7200).
SOA 'minimum' maximum value (Zone06)
SOA 'minimum' value (86400) is between the recommended ones (300/86400).
SOA master is not an alias (Zone07)
SOA 'mname' value (ns1.box.nilsnh.no) refers to a NS which is not an alias (CNAME).
SOA master is not an alias (Zone07)
SOA 'mname' value (ns1.box.nilsnh.no) refers to a NS which is not an alias (CNAME).
MX is not an alias (Zone08)
MX record for the domain is not pointing to a CNAME.
MX record present (Zone09)
Mail targets in the MX RRset "box.nilsnh.no." returned from name servers "185.112.146.150".
SPF policy validation (Zone11)
The SPF policy of nilsnh.no has correct syntax.

nilsnh.no

Former tests

nilsnh.no