SYSTEM

Unspecified (Unspecified)
Using version v6.0.0 of the Zonemaster engine.

BASIC

The domain must have a parent domain (Basic01)
The zone "nilsnh.no" is found.
The domain must have a parent domain (Basic01)
This is a test of an undelegated domain so finding the parent zone is disregarded.
The domain must have at least one working name server (Basic02)
Authoritative answer on SOA query for "nilsnh.no" is returned by name servers "ns1.box.nilsnh.no/185.112.146.150; ns3.box.nilsnh.no/141.0.66.74".
Unspecified (Unspecified)
Functional nameserver found. "A" query for www.nilsnh.no test skipped.

ADDRESS
Warning (1)

Name server address must be globally routable (Address01)
All Nameserver addresses are in the routable public addressing space.
Reverse DNS entry exists for name server IP address (Address02)
Nameserver ns3.box.nilsnh.no has an IP address (2a01:799:b9b:4704::247) without PTR configured.

CONNECTIVITY

AS Diversity (Connectivity03)
At least two IPv4 addresses of the authoritative nameservers are announced by different AS sets. A merged list of all AS: (12996, 29695, 44925).
AS Diversity (Connectivity03)
At least two IPv6 addresses of the authoritative nameservers are announced by different AS sets. A merged list of all AS: (12996, 29695).
IP Prefix Diversity (Connectivity04)
The following name server(s) are announced in unique IPv4 prefix(es): "ns.hyp.net/194.63.248.53; ns1.box.nilsnh.no/185.112.146.150; ns3.box.nilsnh.no/141.0.66.74"
IP Prefix Diversity (Connectivity04)
The following name server(s) are announced in unique IPv6 prefix(es): "ns.hyp.net/2a01:5b40:0:248::53; ns3.box.nilsnh.no/2a01:799:b9b:4704::247"

CONSISTENCY
Notice (1)

SOA serial number consistency (Consistency01)
Saw SOA serial number 2024111204 on following nameserver set : ns.hyp.net/194.63.248.53; ns.hyp.net/2a01:5b40:0:248::53; ns1.box.nilsnh.no/185.112.146.150; ns3.box.nilsnh.no/141.0.66.74; ns3.box.nilsnh.no/2a01:799:b9b:4704::247.
SOA serial number consistency (Consistency01)
A single SOA serial number was found (2024111204).
SOA RNAME consistency (Consistency02)
A single SOA rname value was found (hostmaster.box.nilsnh.no.).
SOA timers consistency (Consistency03)
A single SOA time parameter set was seen (REFRESH=7200, RETRY=3600, EXPIRE=1209600, MINIMUM=86400).
Name server NS consistency (Consistency04)
A single NS set was found (ns.hyp.net.; ns1.box.nilsnh.no.; ns3.box.nilsnh.no.).
Consistency between glue and authoritative data (Consistency05)
Child has extra nameserver IP address(es) not listed at parent (ns3.box.nilsnh.no./2a01:799:b9b:4704::247).
SOA MNAME consistency (Consistency06)
A single SOA mname value was seen (ns1.box.nilsnh.no.).

DELEGATION
Notice (2)

Minimum number of name servers (Delegation01)
Delegation lists enough (2) nameservers. Lower limit set to 2. Name servers: ns1.box.nilsnh.no; ns3.box.nilsnh.no
Minimum number of name servers (Delegation01)
Child lists enough (3) nameservers. Lower limit set to 2. Name servers: ns.hyp.net; ns1.box.nilsnh.no; ns3.box.nilsnh.no
Minimum number of name servers (Delegation01)
Child lists enough (3) nameservers that resolve to IPv4 addresses. Lower limit set to 2. Name servers: ns.hyp.net/194.63.248.53; ns1.box.nilsnh.no/185.112.146.150; ns3.box.nilsnh.no/141.0.66.74
Minimum number of name servers (Delegation01)
Child lists enough (2) nameservers that resolve to IPv6 addresses. Lower limit set to 2. Name servers: ns.hyp.net/2a01:5b40:0:248::53; ns3.box.nilsnh.no/2a01:799:b9b:4704::247
Minimum number of name servers (Delegation01)
Delegation lists enough (2) nameservers that resolve to IPv4 addresses. Lower limit set to 2. Name servers: ns1.box.nilsnh.no/185.112.146.150; ns3.box.nilsnh.no/141.0.66.74
Minimum number of name servers (Delegation01)
Delegation lists no nameserver that resolves to an IPv6 address. If any were present, the minimum allowed would be 2.
Name servers must have distinct IP addresses (Delegation02)
All the IP addresses used by the nameservers in parent are unique.
Name servers must have distinct IP addresses (Delegation02)
All the IP addresses used by the nameservers in child are unique.
Name servers must have distinct IP addresses (Delegation02)
All the IP addresses used by the nameservers are unique.
No truncation of referrals (Delegation03)
The smallest possible legal referral packet is smaller than 513 octets (it is 327).
Name server is authoritative (Delegation04)
All these nameservers are confirmed to be authoritative : ns.hyp.net; ns1.box.nilsnh.no; ns3.box.nilsnh.no.
Name server must not point at CNAME alias (Delegation05)
No nameserver points to CNAME alias.
Existence of SOA (Delegation06)
All the nameservers have SOA record.
Parent glue name records present in child (Delegation07)
Child has nameserver(s) not listed at parent (ns.hyp.net).

DNSSEC
Warning (13) Error (1)

If DNSKEY at child, parent should have DS (DNSSEC07)
194.63.248.53 sent a DNSKEY record, but 194.146.106.6 did not send a DS record.
Verify NSEC3 parameters (DNSSEC03)
The following servers respond with a legal hash algorithm in NSEC3. Fetched from name servers "ns.hyp.net/194.63.248.53; ns.hyp.net/2a01:5b40:0:248::53; ns1.box.nilsnh.no/185.112.146.150; ns3.box.nilsnh.no/141.0.66.74; ns3.box.nilsnh.no/2a01:799:b9b:4704::247".
Verify NSEC3 parameters (DNSSEC03)
The following servers respond with NSEC3 opt-out disabled (as recommended). Fetched from name servers "ns.hyp.net/194.63.248.53; ns.hyp.net/2a01:5b40:0:248::53; ns1.box.nilsnh.no/185.112.146.150; ns3.box.nilsnh.no/141.0.66.74; ns3.box.nilsnh.no/2a01:799:b9b:4704::247".
Verify NSEC3 parameters (DNSSEC03)
The following servers respond with the NSEC3 iteration value 1. The recommended practice is to set this value to 0. Fetched from name servers "ns.hyp.net/194.63.248.53; ns.hyp.net/2a01:5b40:0:248::53; ns1.box.nilsnh.no/185.112.146.150; ns3.box.nilsnh.no/141.0.66.74; ns3.box.nilsnh.no/2a01:799:b9b:4704::247".
Verify NSEC3 parameters (DNSSEC03)
The following servers respond with a legal empty salt in NSEC3. Fetched from name servers "ns.hyp.net/194.63.248.53; ns.hyp.net/2a01:5b40:0:248::53; ns1.box.nilsnh.no/185.112.146.150; ns3.box.nilsnh.no/141.0.66.74; ns3.box.nilsnh.no/2a01:799:b9b:4704::247".
Check for too short or too long RRSIG lifetimes (DNSSEC04)
RRSIG with keytag 4818 and covering type(s) DNSKEY expires at : Thu Dec 12 00:00:00 2024.
Check for too short or too long RRSIG lifetimes (DNSSEC04)
RRSIG with keytag 13939 and covering type(s) DNSKEY expires at : Thu Dec 12 00:00:00 2024.
Check for too short or too long RRSIG lifetimes (DNSSEC04)
RRSIG with keytag 61675 and covering type(s) DNSKEY expires at : Thu Dec 12 00:00:00 2024.
Check for too short or too long RRSIG lifetimes (DNSSEC04)
RRSIG with keytag 57257 and covering type(s) SOA expires at : Thu Dec 12 00:00:00 2024.
Check for too short or too long RRSIG lifetimes (DNSSEC04)
RRSIG with keytag 2658 and covering type(s) SOA expires at : Thu Dec 12 00:00:00 2024.
Check for too short or too long RRSIG lifetimes (DNSSEC04)
RRSIG with keytag 63799 and covering type(s) SOA expires at : Thu Dec 12 00:00:00 2024.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 63799 uses algorithm number 13 (ECDSA Curve P-256 with SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 4818 uses an algorithm number 7 (RSASHA1-NSEC3-SHA1) which is not recommended to be used.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 13939 uses algorithm number 8 (RSA/SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 61675 uses algorithm number 13 (ECDSA Curve P-256 with SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 57257 uses an algorithm number 7 (RSASHA1-NSEC3-SHA1) which is not recommended to be used.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 2658 uses algorithm number 8 (RSA/SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 4818 uses an algorithm number 7 (RSASHA1-NSEC3-SHA1) which is not recommended to be used.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 57257 uses an algorithm number 7 (RSASHA1-NSEC3-SHA1) which is not recommended to be used.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 61675 uses algorithm number 13 (ECDSA Curve P-256 with SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 2658 uses algorithm number 8 (RSA/SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 63799 uses algorithm number 13 (ECDSA Curve P-256 with SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 13939 uses algorithm number 8 (RSA/SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 57257 uses an algorithm number 7 (RSASHA1-NSEC3-SHA1) which is not recommended to be used.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 2658 uses algorithm number 8 (RSA/SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 63799 uses algorithm number 13 (ECDSA Curve P-256 with SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 4818 uses an algorithm number 7 (RSASHA1-NSEC3-SHA1) which is not recommended to be used.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 13939 uses algorithm number 8 (RSA/SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 61675 uses algorithm number 13 (ECDSA Curve P-256 with SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 57257 uses an algorithm number 7 (RSASHA1-NSEC3-SHA1) which is not recommended to be used.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 2658 uses algorithm number 8 (RSA/SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 63799 uses algorithm number 13 (ECDSA Curve P-256 with SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 4818 uses an algorithm number 7 (RSASHA1-NSEC3-SHA1) which is not recommended to be used.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 13939 uses algorithm number 8 (RSA/SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 61675 uses algorithm number 13 (ECDSA Curve P-256 with SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 57257 uses an algorithm number 7 (RSASHA1-NSEC3-SHA1) which is not recommended to be used.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 2658 uses algorithm number 8 (RSA/SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 63799 uses algorithm number 13 (ECDSA Curve P-256 with SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 4818 uses an algorithm number 7 (RSASHA1-NSEC3-SHA1) which is not recommended to be used.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 13939 uses algorithm number 8 (RSA/SHA-256), which is OK.
Check for invalid DNSKEY algorithms (DNSSEC05)
The DNSKEY with tag 61675 uses algorithm number 13 (ECDSA Curve P-256 with SHA-256), which is OK.
Zone contains NSEC or NSEC3 records (DNSSEC10)
The zone has NSEC3 records. Fetched from the nameservers with IP addresses "141.0.66.74; 185.112.146.150; 194.63.248.53; 2a01:5b40:0:248::53; 2a01:799:b9b:4704::247".
Check for valid RSA DNSKEY key size (DNSSEC14)
DNSKEY with tag 57257 and using algorithm 7 (RSASHA1-NSEC3-SHA1) has a size (1024) smaller than the recommended one (2048).
Check for valid RSA DNSKEY key size (DNSSEC14)
DNSKEY with tag 2658 and using algorithm 8 (RSA/SHA-256) has a size (1024) smaller than the recommended one (2048).
Existence of CDS and CDNSKEY (DNSSEC15)
No CDS or CDNSKEY RRsets are found on any name server.

NAMESERVER

A name server should not be a recursor (Nameserver01)
Nameserver ns.hyp.net/194.63.248.53 is not a recursor.
A name server should not be a recursor (Nameserver01)
Nameserver ns.hyp.net/2a01:5b40:0:248::53 is not a recursor.
A name server should not be a recursor (Nameserver01)
Nameserver ns1.box.nilsnh.no/185.112.146.150 is not a recursor.
A name server should not be a recursor (Nameserver01)
Nameserver ns3.box.nilsnh.no/141.0.66.74 is not a recursor.
A name server should not be a recursor (Nameserver01)
Nameserver ns3.box.nilsnh.no/2a01:799:b9b:4704::247 is not a recursor.
Test of EDNS0 support (Nameserver02)
The following nameservers support EDNS0 : ns.hyp.net/194.63.248.53; ns3.box.nilsnh.no/141.0.66.74; ns1.box.nilsnh.no/185.112.146.150; ns.hyp.net/2a01:5b40:0:248::53; ns3.box.nilsnh.no/2a01:799:b9b:4704::247.
Test availability of zone transfer (AXFR) (Nameserver03)
AXFR not available on nameserver ns.hyp.net/194.63.248.53.
Test availability of zone transfer (AXFR) (Nameserver03)
AXFR not available on nameserver ns.hyp.net/2a01:5b40:0:248::53.
Test availability of zone transfer (AXFR) (Nameserver03)
AXFR not available on nameserver ns1.box.nilsnh.no/185.112.146.150.
Test availability of zone transfer (AXFR) (Nameserver03)
AXFR not available on nameserver ns3.box.nilsnh.no/141.0.66.74.
Test availability of zone transfer (AXFR) (Nameserver03)
AXFR not available on nameserver ns3.box.nilsnh.no/2a01:799:b9b:4704::247.
Same source address (Nameserver04)
All nameservers reply with same IP used to query them.
NS can be resolved (Nameserver06)
All nameservers succeeded to resolve to an IP address.
To check whether authoritative name servers return an upward referral (Nameserver07)
None of the following nameservers returns an upward referral : ns.hyp.net; ns1.box.nilsnh.no; ns3.box.nilsnh.no.
Testing QNAME case insensitivity (Nameserver08)
Nameserver ns.hyp.net/194.63.248.53 preserves original case of queried names (Www.NILsnh.no).
Testing QNAME case insensitivity (Nameserver08)
Nameserver ns.hyp.net/2a01:5b40:0:248::53 preserves original case of queried names (Www.NILsnh.no).
Testing QNAME case insensitivity (Nameserver08)
Nameserver ns1.box.nilsnh.no/185.112.146.150 preserves original case of queried names (Www.NILsnh.no).
Testing QNAME case insensitivity (Nameserver08)
Nameserver ns3.box.nilsnh.no/141.0.66.74 preserves original case of queried names (Www.NILsnh.no).
Testing QNAME case insensitivity (Nameserver08)
Nameserver ns3.box.nilsnh.no/2a01:799:b9b:4704::247 preserves original case of queried names (Www.NILsnh.no).
Testing QNAME case sensitivity (Nameserver09)
When asked for SOA records on "www.nilsnh.no" with different cases, all servers reply consistently.
Checking for revealed software version (Nameserver15)
The following name server(s) do not reveal the software version. Returned from name servers: "ns.hyp.net/194.63.248.53; ns.hyp.net/2a01:5b40:0:248::53; ns1.box.nilsnh.no/185.112.146.150; ns3.box.nilsnh.no/141.0.66.74; ns3.box.nilsnh.no/2a01:799:b9b:4704::247"

SYNTAX

No illegal characters in the domain name (Syntax01)
No illegal characters in the domain name (nilsnh.no).
No hyphen ('-') at the start or end of the domain name (Syntax02)
Neither end of any label in the domain name (nilsnh.no) has a hyphen.
There must be no double hyphen ('--') in position 3 and 4 of the domain name (Syntax03)
Domain name (nilsnh.no) has no label with a double hyphen ('--') in position 3 and 4 (with a prefix which is not 'xn--').
The NS name must have a valid domain/hostname (Syntax04)
Nameserver (ns1.box.nilsnh.no) syntax is valid.
The NS name must have a valid domain/hostname (Syntax04)
Nameserver (ns3.box.nilsnh.no) syntax is valid.
The NS name must have a valid domain/hostname (Syntax04)
Nameserver (ns.hyp.net) syntax is valid.
Misuse of '@' character in the SOA RNAME field (Syntax05)
There is no misused '@' character in the SOA RNAME field (hostmaster.box.nilsnh.no.).
No illegal characters in the SOA RNAME field (Syntax06)
The SOA RNAME field (hostmaster@box.nilsnh.no) is compliant with RFC2822.
No illegal characters in the SOA MNAME field (Syntax07)
SOA MNAME (ns1.box.nilsnh.no) syntax is valid.
MX name must have a valid hostname (Syntax08)
Domain name MX (box.nilsnh.no) syntax is valid.

ZONE
Notice (1)

SOA 'refresh' minimum value (Zone02)
SOA 'refresh' value (7200) is less than the recommended one (14400).
SOA 'retry' lower than 'refresh' (Zone03)
SOA 'refresh' value (7200) is higher than the SOA 'retry' value (3600).
SOA 'retry' at least 1 hour (Zone04)
SOA 'retry' value (3600) is at least equal to the minimum recommended value (3600).
SOA 'expire' minimum value (Zone05)
SOA 'expire' value (1209600) is higher than the minimum recommended value (604800) and not lower than the 'refresh' value (7200).
SOA 'minimum' maximum value (Zone06)
SOA 'minimum' value (86400) is between the recommended ones (300/86400).
SOA master is not an alias (Zone07)
SOA 'mname' value (ns1.box.nilsnh.no) refers to a NS which is not an alias (CNAME).
SOA master is not an alias (Zone07)
SOA 'mname' value (ns1.box.nilsnh.no) refers to a NS which is not an alias (CNAME).
MX is not an alias (Zone08)
MX record for the domain is not pointing to a CNAME.
MX record present (Zone09)
Mail targets in the MX RRset "box.nilsnh.no." returned from name servers "185.112.146.150; 141.0.66.74; 2a01:799:b9b:4704::247; 2a01:5b40:0:248::53; 194.63.248.53".
No multiple SOA records (Zone10)
A unique SOA record is returned by all nameservers of the zone.
SPF policy validation (Zone11)
The SPF policy of nilsnh.no has correct syntax.

nilsnh.no

Name servers

Former tests

nilsnh.no