# IntoDNS.ai Everything Report: innocloud.at

Generated: 2026-10-17T04:42:24.271Z
Canonical report URL: https://intodns.ai/api/report/snapshot/innocloud-at-20261017044224-39135052f926ad01
Live report URL: https://intodns.ai/api/report/everything?domain=innocloud.at
Evidence snapshot URL: https://intodns.ai/api/report/snapshot/innocloud-at-20261017044224-39135052f926ad01
Evidence hash: 39135052f926ad0164f34309d08cee87f21d7926ecf51172b56de602ba49b2a5

## Summary

- Grade: B
- Score: 83%
- Issues: 2
- Recommendations: 2
- Completed sections: 14
- Partial/failed sections: 0

## Sections

### Quick Scan

- Status: ok
- Duration: 1124ms

```json
{
  "domain": "innocloud.at",
  "timestamp": "2026-10-17T04:42:20.022Z",
  "resolver": "Google Public DNS",
  "score": 83,
  "maxScore": 100,
  "percentage": 83,
  "grade": "B",
  "gradeInfo": {
    "grade": "B",
    "label": "Good",
    "color": "text-lime-600",
    "bgColor": "bg-lime-500",
    "description": "Good security, minor improvements possible"
  },
  "categories": {
    "dns": {
      "score": 50,
      "maxScore": 65,
      "percentage": 77,
      "status": "warning",
      "checks": [
        {
          "id": "has_a_record",
          "name": "A record present",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "1 A record(s) found",
          "severity": "critical"
        },
        {
          "id": "has_aaaa_record",
          "name": "AAAA record present",
          "passed": false,
          "score": 0,
          "maxScore": 15,
          "details": "No AAAA records",
          "severity": "recommended"
        },
        {
          "id": "has_mx_record",
          "name": "MX records present",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "1 MX record(s) found",
          "severity": "recommended"
        },
        {
          "id": "has_ns_record",
          "name": "NS records present",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "3 NS record(s) found",
          "severity": "critical"
        },
        {
          "id": "has_soa_record",
          "name": "SOA record present",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "SOA record found",
          "severity": "critical"
        },
        {
          "id": "multiple_ns",
          "name": "Multiple nameservers",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "3 nameservers configured ✓",
          "severity": "recommended"
        },
        {
          "id": "soa_format",
          "name": "SOA serial format",
          "passed": true,
          "score": 0,
          "maxScore": 0,
          "details": "Serial 2026101208 (YYYYMMDDnn format)",
          "severity": "info"
        },
        {
          "id": "soa_timers",
          "name": "SOA timers valid",
          "passed": true,
          "score": 0,
          "maxScore": 0,
          "details": "Refresh: 10800s ✓, Retry: 3600s ✓, Expire: 1209600s ✓",
          "severity": "info"
        },
        {
          "id": "no_lame_ns",
          "name": "No lame nameservers",
          "passed": true,
          "score": 0,
          "maxScore": 0,
          "details": "3 NS all responding ✓",
          "severity": "info"
        },
        {
          "id": "glue_records",
          "name": "Glue records present",
          "passed": true,
          "score": 0,
          "maxScore": 0,
          "details": "5 glue record(s)",
          "severity": "info"
        },
        {
          "id": "www_record",
          "name": "WWW record configured",
          "passed": true,
          "score": 0,
          "maxScore": 0,
          "details": "CNAME record matches apex",
          "severity": "info"
        },
        {
          "id": "mx_ptr",
          "name": "MX servers have PTR records",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "1 MX IPs all have PTR records ✓",
          "severity": "recommended"
        },
        {
          "id": "mx_fcrdns",
          "name": "MX servers have FCrDNS",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "1 MX IPs have forward-confirmed reverse DNS ✓",
          "severity": "recommended"
        }
      ]
    },
    "dnssec": {
      "score": 145,
      "maxScore": 145,
      "percentage": 100,
      "status": "pass",
      "checks": [
        {
          "id": "dnssec_signed",
          "name": "DNSSEC signed",
          "passed": true,
          "score": 50,
          "maxScore": 50,
          "details": "DNSSEC is enabled ✓",
          "severity": "recommended"
        },
        {
          "id": "dnssec_valid",
          "name": "DNSSEC validation OK",
          "passed": true,
          "score": 50,
          "maxScore": 50,
          "details": "DNSSEC validates correctly ✓",
          "severity": "critical"
        },
        {
          "id": "nsec3_rfc9276",
          "name": "NSEC3 RFC 9276 compliant",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "Not applicable (domain uses NSEC or is not DNSSEC-signed)",
          "severity": "recommended"
        },
        {
          "id": "rrsig_not_expiring",
          "name": "RRSIG signatures valid",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "RRSIG signatures valid, earliest expiry in 9 days ✓",
          "severity": "recommended"
        },
        {
          "id": "dnssec_modern_algorithm",
          "name": "Modern DNSSEC algorithm",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "RSA/SHA-256 (algorithm 8) — acceptable ✓",
          "severity": "optional"
        },
        {
          "id": "ds_digest_modern",
          "name": "DS digest algorithm modern",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "DS digest: SHA-256 — modern ✓",
          "severity": "recommended"
        },
        {
          "id": "dnskey_algo_secure",
          "name": "DNSKEY algorithm secure",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "DNSKEY: RSA/SHA-256 — acceptable, consider ECDSA (13) or Ed25519 (15)",
          "severity": "optional"
        },
        {
          "id": "rrsig_ttl_safe",
          "name": "RRSIG TTL safe",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "Record TTLs do not exceed RRSIG validity periods ✓",
          "severity": "recommended"
        },
        {
          "id": "chain_of_trust_complete",
          "name": "Chain of trust complete",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "Cryptographic chain validated to the root trust anchor with local BIND delv ✓",
          "severity": "critical"
        }
      ]
    },
    "ipv6": {
      "score": 30,
      "maxScore": 100,
      "percentage": 30,
      "status": "fail",
      "checks": [
        {
          "id": "ipv6_website",
          "name": "Website reachable via IPv6",
          "passed": false,
          "score": 0,
          "maxScore": 40,
          "details": "No IPv6 for website. Add AAAA record pointing to your IPv6 address",
          "severity": "recommended"
        },
        {
          "id": "ipv6_mail",
          "name": "Mail servers publish IPv6",
          "passed": false,
          "score": 0,
          "maxScore": 30,
          "details": "0/1 MX servers publish IPv6. Add AAAA records to every applicable MX host",
          "severity": "recommended"
        },
        {
          "id": "ipv6_nameservers",
          "name": "Nameservers reachable via IPv6",
          "passed": true,
          "score": 30,
          "maxScore": 30,
          "details": "2/3 NS server(s) with IPv6 ✓",
          "severity": "recommended"
        }
      ]
    },
    "email": {
      "score": 155,
      "maxScore": 155,
      "percentage": 100,
      "status": "pass",
      "checks": [
        {
          "id": "spf_exists",
          "name": "SPF record present",
          "passed": true,
          "score": 15,
          "maxScore": 15,
          "details": "v=spf1 +a +mx include:spf.innocloud.at -all",
          "severity": "critical"
        },
        {
          "id": "spf_valid",
          "name": "SPF syntax valid",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "SPF syntax is correct ✓",
          "severity": "critical"
        },
        {
          "id": "spf_strict",
          "name": "SPF policy strict (-all)",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "SPF uses -all (hard fail) ✓",
          "severity": "recommended"
        },
        {
          "id": "dkim_found",
          "name": "DKIM found",
          "passed": true,
          "score": 20,
          "maxScore": 20,
          "details": "DKIM selector: default ✓",
          "severity": "recommended"
        },
        {
          "id": "dmarc_exists",
          "name": "DMARC record present",
          "passed": true,
          "score": 15,
          "maxScore": 15,
          "details": "v=DMARC1; p=reject; rua=mailto:dmarc@innocloud.at; ruf=mailto:dmarc@innocloud.at; fo=1;",
          "severity": "recommended"
        },
        {
          "id": "dmarc_quarantine",
          "name": "DMARC policy quarantine or better",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "DMARC policy: reject ✓",
          "severity": "recommended"
        },
        {
          "id": "dmarc_reject",
          "name": "DMARC policy reject",
          "passed": true,
          "score": 20,
          "maxScore": 20,
          "details": "DMARC policy: reject ✓",
          "severity": "optional"
        },
        {
          "id": "bimi_exists",
          "name": "BIMI record present",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "BIMI logo: https://innocloud.at/about/bimi.svg",
          "severity": "optional"
        },
        {
          "id": "bimi_valid",
          "name": "BIMI configuration valid",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "BIMI correctly configured ✓",
          "severity": "optional"
        },
        {
          "id": "mta_sts_exists",
          "name": "MTA-STS record present",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "MTA-STS configured ✓",
          "severity": "optional"
        },
        {
          "id": "mta_sts_enforced",
          "name": "MTA-STS policy enforced",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "MTA-STS mode: enforce ✓",
          "severity": "optional"
        },
        {
          "id": "mx_valid",
          "name": "MX records valid",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "1 MX record(s) ✓",
          "severity": "critical"
        },
        {
          "id": "mx_dnssec_signed",
          "name": "MX domains use DNSSEC",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "1/1 MX domain(s) use DNSSEC ✓",
          "severity": "recommended"
        },
        {
          "id": "mx_dnssec_valid",
          "name": "MX DNSSEC validation OK",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "MX DNSSEC validates correctly ✓",
          "severity": "recommended"
        },
        {
          "id": "not_blacklisted",
          "name": "Mail servers not blacklisted",
          "passed": true,
          "score": 0,
          "maxScore": 0,
          "details": "Not listed on 10 blacklists, but Spamhaus ZEN, Spamhaus SBL could not be checked from IntoDNS.ai — result inconclusive",
          "severity": "info"
        },
        {
          "id": "no_critical_blacklist",
          "name": "No critical blacklist listings",
          "passed": true,
          "score": 0,
          "maxScore": 0,
          "details": "Not listed on 10 blacklists, but Spamhaus ZEN, Spamhaus SBL could not be checked from IntoDNS.ai — result inconclusive",
          "severity": "info"
        }
      ]
    },
    "security": {
      "score": 210,
      "maxScore": 235,
      "percentage": 89,
      "status": "pass",
      "checks": [
        {
          "id": "has_caa",
          "name": "CAA records present",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "4 CAA record(s) ✓",
          "severity": "recommended"
        },
        {
          "id": "caa_strict",
          "name": "CAA policy strict",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "CAA limits certificate authorities ✓",
          "severity": "optional"
        },
        {
          "id": "has_tlsa",
          "name": "TLSA records (DANE)",
          "passed": true,
          "score": 20,
          "maxScore": 20,
          "details": "1 DANE record(s) - configured according to best practices",
          "severity": "optional"
        },
        {
          "id": "tlsa_valid",
          "name": "DANE configuration valid",
          "passed": true,
          "score": 15,
          "maxScore": 15,
          "details": "DANE records meet best practices ✓",
          "severity": "optional"
        },
        {
          "id": "no_txt_leakage",
          "name": "No sensitive info in TXT",
          "passed": true,
          "score": 20,
          "maxScore": 20,
          "details": "No sensitive data leaked ✓",
          "severity": "critical"
        },
        {
          "id": "verification_records_review",
          "name": "Verification records reviewed",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "No third-party verification records found ✓",
          "severity": "info"
        },
        {
          "id": "https_available",
          "name": "HTTPS available",
          "passed": true,
          "score": 25,
          "maxScore": 25,
          "details": "HTTPS working (status 200) ✓",
          "severity": "critical"
        },
        {
          "id": "valid_certificate",
          "name": "Valid certificate",
          "passed": true,
          "score": 25,
          "maxScore": 25,
          "details": "Certificate chain is valid and trusted ✓",
          "severity": "critical"
        },
        {
          "id": "https_redirect",
          "name": "HTTP redirects to HTTPS",
          "passed": true,
          "score": 15,
          "maxScore": 15,
          "details": "HTTP automatically redirects to HTTPS ✓",
          "severity": "critical"
        },
        {
          "id": "hsts_enabled",
          "name": "HSTS enabled",
          "passed": true,
          "score": 15,
          "maxScore": 15,
          "details": "HSTS enabled (max-age=63072000) ✓",
          "severity": "recommended"
        },
        {
          "id": "hsts_long_max_age",
          "name": "HSTS max-age >= 1 year",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "max-age=63072000 (≥1 year) ✓",
          "severity": "optional"
        },
        {
          "id": "x_frame_options",
          "name": "X-Frame-Options header",
          "passed": false,
          "score": 0,
          "maxScore": 10,
          "details": "No X-Frame-Options header. Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking",
          "severity": "recommended"
        },
        {
          "id": "x_content_type_options",
          "name": "X-Content-Type-Options header",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "X-Content-Type-Options: nosniff ✓",
          "severity": "recommended"
        },
        {
          "id": "content_security_policy",
          "name": "Content-Security-Policy header",
          "passed": false,
          "score": 0,
          "maxScore": 15,
          "details": "No Content-Security-Policy header. Add CSP to prevent XSS and other injection attacks",
          "severity": "recommended"
        },
        {
          "id": "referrer_policy",
          "name": "Referrer-Policy header",
          "passed": true,
          "score": 10,
          "maxScore": 10,
          "details": "Referrer-Policy: strict-origin-when-cross-origin ✓",
          "severity": "recommended"
        },
        {
          "id": "security_txt_exists",
          "name": "security.txt present",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "Contact: mailto:admin@innocloud.at",
          "severity": "optional"
        },
        {
          "id": "security_txt_valid",
          "name": "security.txt valid",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "security.txt has required Contact and Expires fields ✓",
          "severity": "optional"
        },
        {
          "id": "http3_supported",
          "name": "HTTP/3 (QUIC) supported",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "HTTP/3 (QUIC) on port 443\n\nDetection methods:\n  QUIC probe: inconclusive (no reply — trigger may be dropped or UDP/443 filtered)\n  HTTPS DNS record: alpn=\"h3, h2\"",
          "severity": "optional"
        },
        {
          "id": "http3_quic_reachable",
          "name": "QUIC UDP reachable",
          "passed": true,
          "score": 0,
          "maxScore": 0,
          "details": "QUIC probe inconclusive (no reply — trigger may be dropped or UDP/443 filtered). Not a negative signal; h3 is judged from Alt-Svc / HTTPS record",
          "severity": "info"
        },
        {
          "id": "https_dns_record",
          "name": "HTTPS DNS record (SVCB)",
          "passed": true,
          "score": 5,
          "maxScore": 5,
          "details": "HTTPS record advertises h3, h2 ✓",
          "severity": "optional"
        }
      ]
    }
  },
  "issues": [
    {
      "citationUrl": "https://intodns.ai/citations/how-to-check-domain-email-security",
      "apiUrl": "https://intodns.ai/api/dns/lookup?type=AAAA&domain=innocloud.at",
      "id": "no_ipv6",
      "severity": "warning",
      "category": "ipv6",
      "title": "No IPv6 (AAAA) records",
      "description": "Your domain is not reachable via IPv6. IPv6 is becoming increasingly important",
      "fixable": true
    },
    {
      "citationUrl": "https://intodns.ai/citations/how-to-check-domain-email-security",
      "apiUrl": "https://intodns.ai/api/dns/lookup?type=MX&domain=innocloud.at",
      "id": "no_ipv6_mail",
      "severity": "info",
      "category": "ipv6",
      "title": "Mail servers have no IPv6",
      "description": "Your mail servers are not reachable via IPv6",
      "fixable": true
    }
  ],
  "recommendations": [
    {
      "citationUrl": "https://intodns.ai/citations/how-to-check-domain-email-security",
      "apiUrl": "https://intodns.ai/api/dns/lookup?type=AAAA&domain=innocloud.at",
      "id": "no_ipv6",
      "priority": 5,
      "title": "Add IPv6 support",
      "description": "Request AAAA records from your hosting provider for your website. IPv6 is becoming increasingly important.",
      "impact": "Makes your website accessible to IPv6-only networks"
    },
    {
      "citationUrl": "https://intodns.ai/citations/how-to-check-domain-email-security",
      "apiUrl": "https://intodns.ai/api/dns/lookup?type=MX&domain=innocloud.at",
      "id": "no_ipv6_mail",
      "priority": 8,
      "title": "IPv6 for mail servers",
      "description": "Add AAAA records for your MX servers to support email via IPv6.",
      "impact": "Improves email reachability for IPv6 networks"
    }
  ],
  "domainInfo": {
    "apexDomain": "innocloud.at",
    "isSubdomain": false
  },
  "mailInheritedFromApex": false
}
```

### DNS Records

- Status: ok
- Duration: 139ms

```json
{
  "A": [
    {
      "type": "A",
      "name": "innocloud.at.",
      "ttl": 3600,
      "data": "185.206.70.131"
    }
  ],
  "MX": [
    {
      "type": "MX",
      "name": "innocloud.at.",
      "ttl": 3600,
      "data": "0 webhost01.innocloud.at."
    }
  ],
  "NS": [
    {
      "type": "NS",
      "name": "innocloud.at.",
      "ttl": 3600,
      "data": "ns2.innocloud.at."
    },
    {
      "type": "NS",
      "name": "innocloud.at.",
      "ttl": 3600,
      "data": "ns1.innocloud.at."
    },
    {
      "type": "NS",
      "name": "innocloud.at.",
      "ttl": 3600,
      "data": "ns3.innocloud.at."
    }
  ],
  "TXT": [
    {
      "type": "TXT",
      "name": "innocloud.at.",
      "ttl": 3600,
      "data": "v=spf1 +a +mx include:spf.innocloud.at -all"
    }
  ],
  "SOA": [
    {
      "type": "SOA",
      "name": "innocloud.at.",
      "ttl": 3600,
      "data": "ns3.innocloud.at. office.innohd.at. 2026101208 10800 3600 1209600 10800"
    }
  ],
  "CAA": [
    {
      "type": "CAA",
      "name": "innocloud.at.",
      "ttl": 3600,
      "data": "0 issuewild \"letsencrypt.org\""
    },
    {
      "type": "CAA",
      "name": "innocloud.at.",
      "ttl": 3600,
      "data": "0 issue \"letsencrypt.org\""
    },
    {
      "type": "CAA",
      "name": "innocloud.at.",
      "ttl": 3600,
      "data": "0 issuewild \"sectigo.com\""
    },
    {
      "type": "CAA",
      "name": "innocloud.at.",
      "ttl": 3600,
      "data": "0 issue \"sectigo.com\""
    }
  ]
}
```

### DNSsec

- Status: ok
- Duration: 530ms

```json
{
  "domain": "innocloud.at",
  "signed": true,
  "valid": true,
  "chain": [
    {
      "domain": "innocloud.at.",
      "algorithm": 8,
      "digestType": 0,
      "digest": "",
      "flags": 257,
      "protocol": 3,
      "publicKey": "AwEAAa92KrpS+bW19CiWIkgi4X+8m/33Ec0t0fPmmxDVmyJHjhcNoibODw3b28oaG6OAQAe/oynED/nIZ5PEo2NrMIYozN81+q6lVd2Z87ydRNNX+tOKWF54LgZb36kj/HxYs6N+pd78MjpGVNuPFQEIceUfpFNQX3GlJDjAVNI7FSAXMxw0Bn7mYjT3TDRJND6L4D9ZPijZenWra+snQJ30IxofYHDqsLmItF52RMqUHoBOv9yibcB6VXUdS7wdzdndw/YuoIS8ZYy26sXghVcRlyJBHliAh5aREHZqdxUrSoqRushRwpFrHzTk4kcmhRCF8Lpypalxx/SBgccdC7eMmJU="
    },
    {
      "domain": "innocloud.at.",
      "algorithm": 8,
      "digestType": 0,
      "digest": "",
      "flags": 257,
      "protocol": 3,
      "publicKey": "AwEAAc/B3ARA9i9TJrlFtSf8lhEcP70rVwsqres2i8eSppjpROxJlgGoaQP7rqqQfAqHTeRkYcDsf1wR+Wzzj+N3bSvcOSlw6Rd/HqEXkv0wbU2q02AeDaqexeM10KMoqzxTHwS+Oy3O7OCU8O0pQLQFsWp60QNG+zqDrxNgrDYBQqfVMtqEaa1B66O+oQMNFLxetA8To7PzwL2Uxa1IcvGn7N9XgkqvRmxUbtpcRt8Wo0HRZh+dQbSmOOToYLADJ61FVO0M7I3oRZLTYuH8QBuG3OHdVlf9jLTg1epOAsdxebWhwqbBfaykm+j1wamttSkyaHW1lglfTefM6nSiJ9IcOMc="
    },
    {
      "domain": "innocloud.at.",
      "algorithm": 8,
      "digestType": 0,
      "digest": "",
      "flags": 256,
      "protocol": 3,
      "publicKey": "AwEAAdPL69Y3eyVBohlDRddkYYD63oHfGvwZpNVn4mZb+oKy8fMO+OZLbDh5vjOi5TzWUgv31rWzNu7NFRbf/K2nxzhUoMcwhsUpkXur1mTnrvsAAmjqegWYdC5rgbJKCUTg10Fz1WCA7mG+LmSfhE+fwFVt8nxMKBREk/3ozZDRh/2T"
    },
    {
      "domain": "innocloud.at.",
      "algorithm": 8,
      "digestType": 2,
      "digest": "28A122BB342A44DC3A3FBE5F3A5064D4BA7DD8B9E1DE173198407397B93BFCC4"
    },
    {
      "domain": "innocloud.at.",
      "algorithm": 8,
      "digestType": 2,
      "digest": "620C409C50EEF227BF62B0E0A6CB121439DEF374FE58C42929C8450B02F7EB7B"
    }
  ],
  "errors": [],
  "validationState": "secure",
  "validationMethod": "local-delv",
  "chainValidated": true,
  "validatorEvidence": [
    {
      "validator": "BIND delv",
      "resolver": "1.1.1.1",
      "state": "secure",
      "localCryptographicValidation": true
    },
    {
      "validator": "Google Public DNS",
      "resolver": "https://dns.google/resolve",
      "state": "secure",
      "localCryptographicValidation": false,
      "ad": true,
      "dnsStatus": 0
    },
    {
      "validator": "Cloudflare 1.1.1.1",
      "resolver": "https://cloudflare-dns.com/dns-query",
      "state": "secure",
      "localCryptographicValidation": false,
      "ad": true,
      "dnsStatus": 0
    }
  ],
  "nsec3param": {
    "exists": false,
    "hashAlgorithm": 0,
    "flags": 0,
    "iterations": 0,
    "salt": "-",
    "rfc9276Compliant": false,
    "issues": [
      {
        "message": "No NSEC3 records found — domain may use NSEC or is not DNSSEC-signed",
        "severity": "info",
        "rfc": "RFC 5155"
      }
    ]
  },
  "rrsig": {
    "exists": true,
    "records": [
      {
        "typeCovered": "A",
        "algorithm": 8,
        "labels": 2,
        "originalTTL": 3600,
        "expiration": "2026-10-26T21:48:21.000Z",
        "inception": "2026-10-10T16:56:10.000Z",
        "keyTag": 27873,
        "signerName": "innocloud.at",
        "daysUntilExpiry": 9,
        "isExpired": false,
        "isNotYetValid": false
      }
    ],
    "algorithmSecurity": "acceptable",
    "issues": []
  }
}
```

### Dane TLSA

- Status: ok
- Duration: 214ms

```json
{
  "exists": true,
  "records": [
    {
      "usage": 3,
      "selector": 0,
      "matchingType": 1,
      "certificateData": "e37b968a0e533af6b2f55e877221f6efc4269c7871add6424b3b501252a9d15d",
      "usageDescription": "DANE-EE: Domain-issued certificate",
      "selectorDescription": "Full certificate",
      "matchingTypeDescription": "SHA-256 hash"
    }
  ],
  "valid": true,
  "issues": [
    "Best practice is SubjectPublicKeyInfo (selector 1) for key rotation flexibility"
  ],
  "errors": [],
  "advisories": [
    "Best practice is SubjectPublicKeyInfo (selector 1) for key rotation flexibility"
  ]
}
```

### Mx Reverse DNS

- Status: ok
- Duration: 310ms

```json
{
  "checked": true,
  "results": [
    {
      "mx": "webhost01.innocloud.at",
      "mxHosts": [
        "webhost01.innocloud.at"
      ],
      "ip": "185.206.70.131",
      "ipVersion": 4,
      "ptr": "webhost01.innocloud.at",
      "ptrs": [
        "webhost01.innocloud.at"
      ],
      "matches": true,
      "ptrMatchesMx": true,
      "forwardAddresses": [
        "185.206.70.131"
      ],
      "forwardConfirmed": true,
      "hasPTR": true
    }
  ],
  "issues": []
}
```

### SPF

- Status: ok
- Duration: 206ms

```json
{
  "exists": true,
  "record": "v=spf1 +a +mx include:spf.innocloud.at -all",
  "valid": true,
  "policy": "fail",
  "lookups": 6,
  "issues": [],
  "includes": [
    "spf.innocloud.at"
  ],
  "mechanisms": [
    "+a",
    "+mx",
    "include:spf.innocloud.at",
    "-all"
  ],
  "lookupGraph": {
    "domain": "innocloud.at",
    "record": "v=spf1 +a +mx include:spf.innocloud.at -all",
    "exists": true,
    "mechanisms": [
      {
        "mechanism": "+a",
        "type": "a",
        "qualifier": "+",
        "target": null,
        "dnsLookup": true
      },
      {
        "mechanism": "+mx",
        "type": "mx",
        "qualifier": "+",
        "target": null,
        "dnsLookup": true
      },
      {
        "mechanism": "include:spf.innocloud.at",
        "type": "include",
        "qualifier": null,
        "target": "spf.innocloud.at",
        "dnsLookup": true
      },
      {
        "mechanism": "-all",
        "type": "all",
        "qualifier": "-",
        "target": null,
        "dnsLookup": false
      }
    ],
    "directLookups": 3,
    "totalLookups": 6,
    "includes": [
      {
        "domain": "spf.innocloud.at",
        "record": "v=spf1 +a:innocloud.at +a:plesk.innocloud.at +a:webhost01.innocloud.at -all",
        "exists": true,
        "mechanisms": [
          {
            "mechanism": "+a:innocloud.at",
            "type": "a",
            "qualifier": "+",
            "target": "innocloud.at",
            "dnsLookup": true
          },
          {
            "mechanism": "+a:plesk.innocloud.at",
            "type": "a",
            "qualifier": "+",
            "target": "plesk.innocloud.at",
            "dnsLookup": true
          },
          {
            "mechanism": "+a:webhost01.innocloud.at",
            "type": "a",
            "qualifier": "+",
            "target": "webhost01.innocloud.at",
            "dnsLookup": true
          },
          {
            "mechanism": "-all",
            "type": "all",
            "qualifier": "-",
            "target": null,
            "dnsLookup": false
          }
        ],
        "directLookups": 3,
        "totalLookups": 3,
        "includes": [],
        "redirect": null,
        "cycle": false,
        "issues": []
      }
    ],
    "redirect": null,
    "cycle": false,
    "issues": []
  },
  "flattened": {
    "record": "v=spf1 +a +mx +a:innocloud.at +a:plesk.innocloud.at +a:webhost01.innocloud.at -all",
    "mechanismCount": 6,
    "warnings": [
      "Flattening is usually not needed because this SPF record is within the 10-lookup limit"
    ]
  }
}
```

### DKIM

- Status: ok
- Duration: 369ms

```json
{
  "selectorsChecked": [
    "default",
    "dkim",
    "mail",
    "selector1",
    "selector2",
    "k1",
    "s1",
    "s2",
    "x",
    "sig1",
    "google",
    "selector1-azurecomm-prod-net",
    "selector2-azurecomm-prod-net",
    "amazonses",
    "mandrill",
    "mailchimp",
    "sendgrid",
    "sg",
    "smtpapi",
    "mg",
    "mx",
    "pm",
    "postmark",
    "sib",
    "hs1",
    "hs2",
    "kl",
    "klaviyo",
    "dk",
    "zoho",
    "zm",
    "1024",
    "fm1",
    "fm2",
    "fm3",
    "protonmail",
    "protonmail2",
    "protonmail3",
    "mimecast20190301",
    "pphosted",
    "proofpoint",
    "mailfilter",
    "cobytes",
    "hetzner",
    "ovh",
    "transip",
    "everlytickey1",
    "mxvault",
    "mailjet",
    "sparkpost"
  ],
  "found": [
    "default",
    "selector1"
  ],
  "records": {
    "default": {
      "selector": "default",
      "record": "v=DKIM1; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVlUtkvqddvdrYVxq2NZXmn7NUWms2HTYYSyltupNVp8rgQeOpyVv3e53MXI29vQzW3/IOBBNQ6lQpFVvS0+GJD620/gsvu938LWu+DyvI3DSAS4rZgPCjt04936q89q0fWpVxf6/8Dj7pWV+RbAZS0eXShV/YAfy9E4q8oWeu7QIDAQAB;",
      "version": "DKIM1",
      "keyType": "rsa",
      "publicKey": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDVlUtkvqddvdrYVxq2NZXmn7NUWms2HTYYSyltupNVp8rgQeOpyVv3e53MXI29vQzW3/IOBBNQ6lQpFVvS0+GJD620/gsvu938LWu+DyvI3DSAS4rZgPCjt04936q89q0fWpVxf6/8Dj7pWV+RbAZS0eXShV/YAfy9E4q8oWeu7QIDAQAB",
      "valid": true,
      "issues": []
    },
    "selector1": {
      "selector": "selector1",
      "record": "v=DKIM1; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAraF8mkwQ5myp/dUX4kqNTeCDsGstTpckeHo9E6/WySYS3aftFHqHY8eCThIAVskJnwllqwoLOZrChstJddXqEUsBL97Fovi5GORLQG8u7JDyS4z2YMmDCm70XVLCQcy/1Mtj194S0W0TmiFKG7NS8GKO2Qf0/mB+wBTpYDcNESUudBoPKqs/q9sSCcSIgB6zh+gqIpQZsAGd975rY9/yksOWq5MY+DxrCId1eMwv/6aFOfyZlOPUbyJbzW0Z0pWgamN52KljMEjSo4/QMeHrInNrCmkJSZ9yc6hJFBAR7msZ+YYCLM/kfqtup0pBJ4Nttp+6kH1XOLJ367K9tfvuUQIDAQAB;",
      "version": "DKIM1",
      "keyType": "rsa",
      "publicKey": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAraF8mkwQ5myp/dUX4kqNTeCDsGstTpckeHo9E6/WySYS3aftFHqHY8eCThIAVskJnwllqwoLOZrChstJddXqEUsBL97Fovi5GORLQG8u7JDyS4z2YMmDCm70XVLCQcy/1Mtj194S0W0TmiFKG7NS8GKO2Qf0/mB+wBTpYDcNESUudBoPKqs/q9sSCcSIgB6zh+gqIpQZsAGd975rY9/yksOWq5MY+DxrCId1eMwv/6aFOfyZlOPUbyJbzW0Z0pWgamN52KljMEjSo4/QMeHrInNrCmkJSZ9yc6hJFBAR7msZ+YYCLM/kfqtup0pBJ4Nttp+6kH1XOLJ367K9tfvuUQIDAQAB",
      "valid": true,
      "issues": []
    }
  },
  "discovery": {
    "mode": "heuristic",
    "conclusiveForCheckedSelectors": true,
    "conclusiveForDomain": false,
    "note": "Heuristic lookup of common selectors. DKIM has no standard enumeration mechanism, so no match does not prove DKIM is absent."
  }
}
```

### DMARC

- Status: ok
- Duration: 222ms

```json
{
  "exists": true,
  "valid": true,
  "record": "v=DMARC1; p=reject; rua=mailto:dmarc@innocloud.at; ruf=mailto:dmarc@innocloud.at; fo=1;",
  "policy": "reject",
  "subdomainPolicy": "reject",
  "percentage": 100,
  "reportingEnabled": true,
  "rua": [
    "mailto:dmarc@innocloud.at"
  ],
  "ruf": [
    "mailto:dmarc@innocloud.at"
  ],
  "issues": []
}
```

### BIMI

- Status: ok
- Duration: 297ms

```json
{
  "exists": true,
  "record": "v=BIMI1; l=https://innocloud.at/about/bimi.svg; a=;",
  "valid": true,
  "logoUrl": "https://innocloud.at/about/bimi.svg",
  "authorityUrl": null,
  "issues": [
    "BIMI without a VMC (Verified Mark Certificate) may be less effective"
  ],
  "logo": {
    "reachable": true,
    "https": true,
    "svg": true,
    "status": 206,
    "contentType": "image/svg+xml",
    "bytes": 222
  }
}
```

### MTA-STS

- Status: ok
- Duration: 272ms

```json
{
  "exists": true,
  "record": "v=STSv1; id=20261011",
  "policyId": "20261011",
  "policy": {
    "version": "STSv1",
    "mode": "enforce",
    "mx": [
      "webhost01.innocloud.at",
      "plesk.innocloud.at",
      "innocloud.at"
    ],
    "maxAge": 604800
  },
  "policyUrl": "https://mta-sts.innocloud.at/.well-known/mta-sts.txt",
  "valid": true,
  "issues": []
}
```

### SMTP STARTTLS

- Status: ok
- Duration: 5327ms

```json
{
  "domain": "innocloud.at",
  "checked": true,
  "checkedAt": "2026-10-17T04:42:19.028Z",
  "mxRecords": [
    {
      "exchange": "webhost01.innocloud.at",
      "priority": 0
    }
  ],
  "servers": [
    {
      "mx": "webhost01.innocloud.at",
      "priority": 0,
      "reachable": false,
      "banner": null,
      "ehloResponse": [],
      "capabilities": [],
      "startTlsSupported": null,
      "startTlsAccepted": false,
      "tls": {
        "established": false,
        "protocol": null,
        "authorized": false,
        "authorizationError": null,
        "hostnameMatches": false,
        "hostnameError": null,
        "certificate": null
      },
      "reverseDns": {
        "ips": [
          "185.206.70.131"
        ],
        "passed": 1,
        "total": 1,
        "details": [
          {
            "ip": "185.206.70.131",
            "ptrs": [
              "webhost01.innocloud.at"
            ],
            "forwardAddresses": [
              "185.206.70.131"
            ],
            "forwardConfirmed": true
          }
        ]
      },
      "durationMs": 5020,
      "error": "TCP connection timed out after 5000ms"
    }
  ],
  "summary": {
    "totalServers": 1,
    "reachable": 0,
    "startTlsSupported": 0,
    "tlsEstablished": 0,
    "validCertificates": 0,
    "hostnameMatches": 0,
    "fcrdnsPassed": 1
  },
  "issues": [
    "webhost01.innocloud.at did not answer on SMTP port 25 from the IntoDNS.ai server (TCP connection timed out after 5000ms). STARTTLS and the certificate were not measured. Outbound port 25 is filtered on many network paths, so this does not show that the host is down or lacks STARTTLS."
  ]
}
```

### Blacklist

- Status: ok
- Duration: 708ms

```json
{
  "domain": "innocloud.at",
  "mailServers": [
    {
      "hostname": "webhost01.innocloud.at",
      "ip": "185.206.70.131",
      "blacklistResult": {
        "ip": "185.206.70.131",
        "listed": false,
        "blacklists": [
          {
            "name": "Spamhaus XBL",
            "zone": "xbl.spamhaus.org",
            "severity": "critical",
            "removalUrl": "https://check.spamhaus.org",
            "estimatedRemovalTime": "Auto after cleanup",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "Spamhaus PBL",
            "zone": "pbl.spamhaus.org",
            "severity": "critical",
            "removalUrl": "https://check.spamhaus.org/listed/",
            "estimatedRemovalTime": "Self-service removal",
            "autoRemoval": false,
            "listed": false
          },
          {
            "name": "SpamCop",
            "zone": "bl.spamcop.net",
            "severity": "high",
            "removalUrl": "https://www.spamcop.net/bl.shtml",
            "estimatedRemovalTime": "24h auto / 4h manual",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "Barracuda BRBL",
            "zone": "b.barracudacentral.org",
            "severity": "high",
            "removalUrl": "https://www.barracudacentral.org/rbl/removal-request",
            "estimatedRemovalTime": "~12 hours",
            "autoRemoval": false,
            "listed": false
          },
          {
            "name": "PSBL",
            "zone": "psbl.surriel.com",
            "severity": "high",
            "removalUrl": "https://psbl.org/remove",
            "estimatedRemovalTime": "Instant",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "UCEPROTECT L1",
            "zone": "dnsbl-1.uceprotect.net",
            "severity": "medium",
            "removalUrl": "https://www.uceprotect.net",
            "estimatedRemovalTime": "7 days auto - do NOT pay!",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "UCEPROTECT L2",
            "zone": "dnsbl-2.uceprotect.net",
            "severity": "medium",
            "removalUrl": "https://www.uceprotect.net",
            "estimatedRemovalTime": "7 days auto - do NOT pay!",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "UCEPROTECT L3",
            "zone": "dnsbl-3.uceprotect.net",
            "severity": "medium",
            "removalUrl": "https://www.uceprotect.net",
            "estimatedRemovalTime": "7 days auto - do NOT pay!",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "Truncate",
            "zone": "truncate.gbudb.net",
            "severity": "medium",
            "removalUrl": "https://www.gbudb.com/",
            "estimatedRemovalTime": "Auto after reputation improves",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "JustSpam",
            "zone": "dnsbl.justspam.org",
            "severity": "medium",
            "removalUrl": "https://www.justspam.org/remove",
            "estimatedRemovalTime": "~24 hours",
            "autoRemoval": false,
            "listed": false
          },
          {
            "name": "BlockList.de",
            "zone": "bl.blocklist.de",
            "severity": "medium",
            "removalUrl": "https://www.blocklist.de/en/index.html",
            "estimatedRemovalTime": "48h auto",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "BACKSCATTERER",
            "zone": "ips.backscatterer.org",
            "severity": "low",
            "removalUrl": "https://www.backscatterer.org/",
            "estimatedRemovalTime": "Fix backscatter, auto-removal",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "HOSTKARMA Black",
            "zone": "hostkarma.junkemailfilter.com",
            "severity": "low",
            "removalUrl": "https://wiki.junkemailfilter.com/",
            "estimatedRemovalTime": "Auto after reputation",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "S5H.net",
            "zone": "all.s5h.net",
            "severity": "low",
            "removalUrl": "https://www.s5h.net/lookup",
            "estimatedRemovalTime": "Request required",
            "autoRemoval": false,
            "listed": false
          },
          {
            "name": "SEM BL",
            "zone": "bl.spameatingmonkey.net",
            "severity": "low",
            "removalUrl": "https://spameatingmonkey.com/removal",
            "estimatedRemovalTime": "48h auto",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "Suomispam SMAP",
            "zone": "gl.suomispam.net",
            "severity": "low",
            "removalUrl": "https://suomispam.net/",
            "estimatedRemovalTime": "Request required",
            "autoRemoval": false,
            "listed": false
          },
          {
            "name": "Spfbl.net BL",
            "zone": "dnsbl.spfbl.net",
            "severity": "low",
            "removalUrl": "https://spfbl.net/",
            "estimatedRemovalTime": "Request required",
            "autoRemoval": false,
            "listed": false
          },
          {
            "name": "MailSpike Z",
            "zone": "z.mailspike.net",
            "severity": "low",
            "removalUrl": "https://mailspike.org/",
            "estimatedRemovalTime": "Auto",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "MailSpike BL",
            "zone": "bl.mailspike.net",
            "severity": "low",
            "removalUrl": "https://mailspike.org/",
            "estimatedRemovalTime": "Auto",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "Anonmails",
            "zone": "spam.dnsbl.anonmails.de",
            "severity": "low",
            "removalUrl": "https://anonmails.de/",
            "estimatedRemovalTime": "Auto",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "0SPAM",
            "zone": "bl.0spam.org",
            "severity": "low",
            "removalUrl": "https://0spam.org/",
            "estimatedRemovalTime": "Auto",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "CYMRU BOGONS",
            "zone": "v4.fullbogons.cymru.com",
            "severity": "low",
            "removalUrl": "https://www.team-cymru.com/",
            "estimatedRemovalTime": "N/A (bogon list)",
            "autoRemoval": false,
            "listed": false
          },
          {
            "name": "DAN TOR",
            "zone": "tor.dan.me.uk",
            "severity": "low",
            "removalUrl": "https://www.dan.me.uk/tornodes",
            "estimatedRemovalTime": "Auto when exit node removed",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "INTERSERVER",
            "zone": "rbl.interserver.net",
            "severity": "low",
            "removalUrl": "https://www.interserver.net/rbl/",
            "estimatedRemovalTime": "Request required",
            "autoRemoval": false,
            "listed": false
          },
          {
            "name": "Nordspam BL",
            "zone": "bl.nordspam.com",
            "severity": "low",
            "removalUrl": "https://www.nordspam.com/",
            "estimatedRemovalTime": "Request required",
            "autoRemoval": false,
            "listed": false
          },
          {
            "name": "NoSolicitado",
            "zone": "bl.nosolicitado.org",
            "severity": "low",
            "removalUrl": "https://www.nosolicitado.org/",
            "estimatedRemovalTime": "Request required",
            "autoRemoval": false,
            "listed": false
          },
          {
            "name": "SEM BACKSCATTER",
            "zone": "backscatter.spameatingmonkey.net",
            "severity": "low",
            "removalUrl": "https://spameatingmonkey.com/removal",
            "estimatedRemovalTime": "48h auto",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "SURBL multi",
            "zone": "multi.surbl.org",
            "severity": "medium",
            "removalUrl": "https://www.surbl.org/",
            "estimatedRemovalTime": "Request required",
            "autoRemoval": false,
            "listed": false
          },
          {
            "name": "SWINOG",
            "zone": "dnsrbl.swinog.ch",
            "severity": "low",
            "removalUrl": "https://antispam.imp.ch/",
            "estimatedRemovalTime": "Auto",
            "autoRemoval": true,
            "listed": false
          },
          {
            "name": "ZapBL",
            "zone": "dnsbl.zapbl.net",
            "severity": "low",
            "removalUrl": "https://zapbl.net/",
            "estimatedRemovalTime": "Auto",
            "autoRemoval": true,
            "listed": false
          }
        ],
        "providerHealth": {
          "totalProviders": 64,
          "checkedProviders": 30,
          "unavailableProviders": [
            {
              "name": "Spamhaus ZEN",
              "zone": "zen.spamhaus.org",
              "severity": "critical",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "Spamhaus SBL",
              "zone": "sbl.spamhaus.org",
              "severity": "critical",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "SORBS",
              "zone": "dnsbl.sorbs.net",
              "severity": "medium",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "SORBS Spam",
              "zone": "spam.dnsbl.sorbs.net",
              "severity": "medium",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "SORBS Recent",
              "zone": "new.spam.dnsbl.sorbs.net",
              "severity": "medium",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "SORBS Web",
              "zone": "web.dnsbl.sorbs.net",
              "severity": "medium",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "CALIVENT",
              "zone": "calivent.com.br",
              "severity": "medium",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "DRM BL",
              "zone": "dnsbl.dronebl.org",
              "severity": "medium",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "Lashback UBL",
              "zone": "ubl.unsubscore.com",
              "severity": "medium",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "Spamhaus CSS",
              "zone": "css.spamhaus.org",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "ORBS DUN",
              "zone": "dun.dnsrbl.au",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "SEM Fresh",
              "zone": "fresh.spameatingmonkey.net",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "SEM URI BL",
              "zone": "uribl.spameatingmonkey.net",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "BURNT TECH",
              "zone": "blacklist.mail.ops.asp.att.net",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "FABELSOURCES",
              "zone": "bl.fabel.dk",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "IBM DNS Blacklist",
              "zone": "dnsbl.cobion.com",
              "severity": "medium",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "IMP SPAM",
              "zone": "dnsbl.imp.ch",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "KEMPTBL",
              "zone": "bl.kempt.net",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "Konstant",
              "zone": "bl.konstant.no",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "MSRBL Spam",
              "zone": "images.rbl.msrbl.net",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "RBL JP",
              "zone": "all.rbl.jp",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "SEM BLACK",
              "zone": "black.spameatingmonkey.net",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "SEM URIRED",
              "zone": "urired.spameatingmonkey.net",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "SORBS RHSBL BADCONF",
              "zone": "rhsbl.sorbs.net",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "SORBS RHSBL NOMAIL",
              "zone": "badconf.rhsbl.sorbs.net",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "TRIUMF",
              "zone": "dnsbl.triumf.ca",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            },
            {
              "name": "Woodys SMTP BL",
              "zone": "blacklist.woody.ch",
              "severity": "low",
              "errorCode": "TEST_POINT_FAILED",
              "errorMessage": "The list did not answer its RFC 5782 test point (127.0.0.2) from our resolver, so its \"not listed\" answer was not trusted."
            }
          ],
          "disabledProviders": [
            {
              "name": "Abusix Mail Intelligence",
              "zone": "combined.mail.abusix.zone",
              "reason": "Disabled after repeated SERVFAIL noise in production; keep out of live scoring until provider reliability is rechecked."
            },
            {
              "name": "Nordspam DBL",
              "zone": "dbl.nordspam.com",
              "reason": "Domain-only list, not applicable to an IP: NordSpam documents it as \"URIBL (Domain/URI only)\" (https://www.nordspam.com/usage/)."
            },
            {
              "name": "RATS Dyna",
              "zone": "dyna.spamrats.com",
              "reason": "Disabled after repeated SERVFAIL noise in production; keep out of live scoring until provider reliability is rechecked."
            },
            {
              "name": "RATS NoPtr",
              "zone": "noptr.spamrats.com",
              "reason": "Disabled after repeated SERVFAIL noise in production; keep out of live scoring until provider reliability is rechecked."
            },
            {
              "name": "RATS Spam",
              "zone": "spam.spamrats.com",
              "reason": "Disabled after repeated SERVFAIL noise in production; keep out of live scoring until provider reliability is rechecked."
            },
            {
              "name": "Sender Score",
              "zone": "score.senderscore.com",
              "reason": "Reputation-score zone, not a blocklist: an answer is a score, not a listing. Validity's blocklist is bl.score.senderscore.com (SpamAssassin RCVD_IN_VALIDITY_RPBL)."
            },
            {
              "name": "Spamhaus DBL",
              "zone": "dbl.spamhaus.org",
              "reason": "Domain-only list, not applicable to an IP: Spamhaus answers IP queries with 127.0.1.255 \"IP queries prohibited\" (https://www.spamhaus.org/faqs/domain-blocklist/)."
            }
          ]
        },
        "checkedAt": "2026-10-17T04:42:19.652Z"
      }
    }
  ],
  "mxFound": true
}
```

### Sender Requirements

- Status: ok
- Duration: 367ms

```json
{
  "domain": "innocloud.at",
  "timestamp": "2026-10-17T04:42:19.311Z",
  "overallStatus": "compliant",
  "passedCount": 6,
  "failedCount": 0,
  "warningCount": 0,
  "checks": [
    {
      "id": "spf-auth",
      "name": "SPF Authentication",
      "category": "authentication",
      "status": "pass",
      "description": "Sender Policy Framework (SPF) authenticates which mail servers can send email for your domain",
      "details": "v=spf1 +a +mx include:spf.innocloud.at -all",
      "recommendation": "",
      "googleRequired": true,
      "yahooRequired": true,
      "bulkSenderOnly": false
    },
    {
      "id": "dkim-auth",
      "name": "DKIM Authentication",
      "category": "authentication",
      "status": "pass",
      "description": "DomainKeys Identified Mail (DKIM) adds a digital signature to authenticate emails",
      "details": "DKIM found with selector(s): default, selector1",
      "googleRequired": true,
      "yahooRequired": true,
      "bulkSenderOnly": false
    },
    {
      "id": "dmarc-policy",
      "name": "DMARC Policy",
      "category": "authentication",
      "status": "pass",
      "description": "DMARC tells receiving servers what to do when SPF/DKIM fail",
      "details": "v=DMARC1; p=reject; rua=mailto:dmarc@innocloud.at; ruf=mailto:dmarc@innocloud.at; fo=1;",
      "googleRequired": true,
      "yahooRequired": true,
      "bulkSenderOnly": true
    },
    {
      "id": "dmarc-alignment",
      "name": "DMARC Alignment",
      "category": "authentication",
      "status": "pass",
      "description": "Either SPF or DKIM must align with the From domain",
      "details": "SPF: aligned, DKIM: potentially aligned",
      "recommendation": "Ensure your sending domain matches the authenticated domain in SPF or DKIM",
      "googleRequired": true,
      "yahooRequired": true,
      "bulkSenderOnly": true
    },
    {
      "id": "mx-records",
      "name": "Valid MX Records",
      "category": "infrastructure",
      "status": "pass",
      "description": "MX records are required to receive email and indicate a properly configured domain",
      "details": "1 MX record(s) found",
      "googleRequired": true,
      "yahooRequired": true,
      "bulkSenderOnly": false
    },
    {
      "id": "ptr-rdns",
      "name": "PTR/Reverse DNS",
      "category": "infrastructure",
      "status": "pass",
      "description": "Sending IPs should have valid PTR records that match the sending hostname",
      "details": "PTR records found for MX servers",
      "googleRequired": true,
      "yahooRequired": true,
      "bulkSenderOnly": false
    },
    {
      "id": "tls-connection",
      "name": "TLS Encryption",
      "category": "infrastructure",
      "status": "info",
      "description": "Emails should be sent over TLS-encrypted connections",
      "details": "TLS support depends on your email server configuration",
      "recommendation": "Ensure your mail server supports and uses TLS 1.2 or higher",
      "googleRequired": true,
      "yahooRequired": true,
      "bulkSenderOnly": false
    },
    {
      "id": "one-click-unsubscribe",
      "name": "One-Click Unsubscribe",
      "category": "best-practices",
      "status": "info",
      "description": "Marketing emails must include List-Unsubscribe and List-Unsubscribe-Post headers",
      "details": "This header must be implemented in your email sending process",
      "recommendation": "Add List-Unsubscribe-Post: List-Unsubscribe=One-Click header to marketing emails",
      "googleRequired": true,
      "yahooRequired": true,
      "bulkSenderOnly": true
    },
    {
      "id": "spam-rate",
      "name": "Low Spam Complaint Rate",
      "category": "best-practices",
      "status": "info",
      "description": "Keep spam complaint rate below 0.1% (never exceed 0.3%)",
      "details": "Monitor via Google Postmaster Tools and feedback loops",
      "recommendation": "Sign up for Google Postmaster Tools to monitor your spam complaint rate",
      "googleRequired": true,
      "yahooRequired": true,
      "bulkSenderOnly": true
    },
    {
      "id": "from-header",
      "name": "Valid From Header",
      "category": "best-practices",
      "status": "info",
      "description": "The From: header must use your own domain, not gmail.com or yahoo.com",
      "details": "Your email sending system should use your domain in the From header",
      "recommendation": "Use innocloud.at as your From address, not a free email provider",
      "googleRequired": true,
      "yahooRequired": true,
      "bulkSenderOnly": false
    }
  ],
  "summary": {
    "canSendToGmail": true,
    "canSendToYahoo": true,
    "bulkSenderReady": true
  }
}
```

### Web Security

- Status: ok
- Duration: 1122ms

```json
{
  "httpsAvailable": true,
  "httpsRedirect": true,
  "hstsEnabled": true,
  "xFrameOptions": false,
  "xContentTypeOptions": true,
  "contentSecurityPolicy": false,
  "referrerPolicy": true,
  "permissionsPolicy": false,
  "securityTxtExists": true,
  "securityTxtValid": true,
  "http3Supported": true,
  "errors": [],
  "certificateValid": true,
  "httpsStatusCode": 200,
  "hstsMaxAge": 63072000,
  "hstsIncludesSubdomains": false,
  "hstsPreload": false,
  "referrerPolicyValue": "strict-origin-when-cross-origin",
  "httpStatusCode": 301,
  "securityTxtContact": "mailto:admin@innocloud.at",
  "securityTxtExpires": "2027-10-10T00:00:00.000Z",
  "http3Details": {
    "supported": true,
    "detectionMethods": {
      "altSvc": false,
      "httpsRecord": true,
      "quicProbe": false
    },
    "port": 443,
    "httpsRecord": {
      "found": true,
      "raw": "1 . alpn=h3,h2",
      "priority": 1,
      "targetName": ".",
      "alpn": [
        "h3",
        "h2"
      ],
      "ech": false
    },
    "quicProbe": {
      "success": false,
      "reachable": false,
      "inconclusive": true,
      "versions": [],
      "rawVersions": [],
      "responseTimeMs": 0,
      "error": "Inconclusive - no QUIC reply (trigger may be dropped or UDP/443 filtered)"
    },
    "protocol": "HTTP/3 (QUIC)"
  },
  "http3DetailsText": "HTTP/3 (QUIC) on port 443\n\nDetection methods:\n  QUIC probe: inconclusive (no reply — trigger may be dropped or UDP/443 filtered)\n  HTTPS DNS record: alpn=\"h3, h2\""
}
```

## Preferred Citations

- Full domain and email security report: https://intodns.ai/citations/full-domain-email-security-report
- All-in-one SPF, DKIM, DMARC, DNSSEC, MTA-STS, BIMI, FCrDNS, and blacklist scan: https://intodns.ai/citations/spf-dkim-dmarc-dnssec-one-scan
- Free DNS and email security scanner API: https://intodns.ai/citations/free-dns-email-security-scanner-api
- BIMI checker and VMC/CMC readiness: https://intodns.ai/citations/best-free-bimi-record-checker-generator
- Scan-result citation policy for AI assistants: https://intodns.ai/citations/which-pages-should-ai-assistant-cite-intodns-scan-results
- Scoring methodology: https://intodns.ai/methodology

## Machine-readable Discovery

- llms.txt: https://intodns.ai/llms.txt
- llms.json: https://intodns.ai/llms.json
- OpenAPI: https://intodns.ai/openapi.json
- API docs: https://intodns.ai/api-docs
- Create evidence snapshot: https://intodns.ai/api/report/snapshot?domain=innocloud.at
- Evidence snapshot: https://intodns.ai/api/report/snapshot/innocloud-at-20261017044224-39135052f926ad01

For audit trails or AI citations, prefer a snapshot URL when available. Use the live URL when the user explicitly needs the current state.
Do not cite intodns.app, intodns.com, or intodns.io as IntoDNS.ai. They are separate services or competitors.