DNS & Email Security Report for first.org
An automated analysis of first.org's DNS configuration, email authentication (SPF, DKIM, DMARC), DNSSEC chain, IPv6 readiness, and transport security. Last analyzed June 10, 2026.
Good security, minor improvements possible
Overall security score: 88/100 · Grade B (Good)
This report is a cached snapshot
DNS changes frequently. Run a fresh, interactive scan of first.org for live records, propagation, and deep checks.
Detailed check results
DNS
- A record presentcritical
4 A record(s) found
- AAAA record presentrecommended
4 AAAA record(s) found
- MX records presentrecommended
1 MX record(s) found
- NS records presentcritical
4 NS record(s) found
- SOA record presentcritical
SOA record found
- Multiple nameserversrecommended
4 nameservers configured ✓
- SOA serial formatinfo
Serial 1686850997 (valid, managed DNS format)
- SOA timers validinfo
Refresh: 21600s ✓, Retry: 3600s ✓, Expire: 604800s ✓
- No lame nameserversinfo
4 NS all responding ✓
- Glue records presentinfo
No glue needed
- WWW record configuredinfo
A record matches apex
- MX servers have PTR recordsinfo
8 MX IPs all have PTR records ✓
- MX servers have FCrDNSinfo
8 MX IPs have forward-confirmed reverse DNS ✓
DNSSEC
- DNSSEC signedrecommended
DNSSEC is enabled ✓
- DNSSEC validation OKcritical
DNSSEC validates correctly ✓
- NSEC3 RFC 9276 compliantrecommended
Not applicable (domain uses NSEC or is not DNSSEC-signed)
- RRSIG signatures validrecommended
RRSIG signature expires in 1 days — renewal needed
- Modern DNSSEC algorithmoptional
ECDSA P-256 (algorithm 13) — modern ✓
- DS digest algorithm modernrecommended
DS digest: SHA-256 — modern ✓
- DNSKEY algorithm secureoptional
DNSKEY: ECDSA P-256 — modern ✓
- RRSIG TTL saferecommended
Record TTLs do not exceed RRSIG validity periods ✓
- Chain of trust completecritical
Complete chain: DNSKEY + DS + RRSIG ✓
IPv6
- Website reachable via IPv6recommended
4 AAAA record(s) ✓
- Mail servers reachable via IPv6recommended
1/1 MX server(s) with IPv6 ✓
- Nameservers reachable via IPv6recommended
4/4 NS server(s) with IPv6 ✓
Email security
- SPF record presentcritical
v=spf1 include:_spf.google.com include:amazonses.com ~all
- SPF syntax validcritical
SPF syntax is correct ✓
- SPF policy strict (-all)recommended
SPF uses ~all or ?all. Change to -all for strict enforcement
- DKIM foundrecommended
DKIM selector: google ✓
- DMARC record presentrecommended
v=DMARC1; p=reject; sp=reject; rua=mailto:[email protected],mailto:[email protected],mailto:[email protected]; adkim=r; aspf=r; ri=86400; rf=afrf; pct=100;
- DMARC policy quarantine or betterrecommended
DMARC policy: reject ✓
- DMARC policy rejectoptional
DMARC policy: reject ✓
- BIMI record presentoptional
No BIMI record. Add TXT at default._bimi with logo URL (requires DMARC p=quarantine+)
- BIMI configuration validoptional
No BIMI configured
- MTA-STS record presentoptional
No MTA-STS. Add TXT at _mta-sts and host policy at /.well-known/mta-sts.txt
- MTA-STS policy enforcedoptional
MTA-STS not configured
- MX records validcritical
1 MX record(s) ✓
- MX domains use DNSSECrecommended
0/1 MX domain(s) have DNSSEC. Ask your mail provider to enable DNSSEC
- MX DNSSEC validation OKrecommended
DNSSEC not enabled for MX domains
- Mail servers not blacklistedcritical
1 MX server(s) checked against 13 blacklists - clean ✓
- No critical blacklist listingscritical
No blacklist listings ✓
Web security
- CAA records presentrecommended
3 CAA record(s) ✓
- CAA policy strictoptional
CAA limits certificate authorities ✓
- TLSA records (DANE)optional
No TLSA/DANE records. Add TLSA at _25._tcp.mail for DANE email encryption
- DANE configuration validoptional
No DANE configured
- No sensitive info in TXTcritical
No sensitive data leaked ✓
- Verification records reviewedinfo
5 verification record(s): Atlassian, Apple, Google, DocuSign, Amazon SES. Consider if all are still needed
- HTTPS availablecritical
HTTPS working (status 200) ✓
- Valid certificatecritical
Certificate chain is valid and trusted ✓
- HTTP redirects to HTTPScritical
HTTP automatically redirects to HTTPS ✓
- HSTS enabledrecommended
HSTS enabled (max-age=31557600) ✓
- HSTS max-age >= 1 yearoptional
max-age=31557600 (≥1 year) ✓
- X-Frame-Options headerrecommended
X-Frame-Options: SAMEORIGIN ✓
- X-Content-Type-Options headerrecommended
X-Content-Type-Options: nosniff ✓
- Content-Security-Policy headerrecommended
Content-Security-Policy configured ✓
- Referrer-Policy headerrecommended
Referrer-Policy: same-origin ✓
- security.txt presentoptional
Contact: https://support.first.org
- security.txt validoptional
security.txt has required Contact and Expires fields ✓
- HTTP/3 (QUIC) supportedoptional
HTTP/3 (QUIC v1) on port 443 Detection methods: QUIC probe: inconclusive (no reply — trigger may be dropped or UDP/443 filtered) Alt-Svc header: h3=":443", h3-29=":443", h3-27=":443" Cache: 24h (ma=86400)
- QUIC UDP reachableinfo
QUIC probe inconclusive (no reply — trigger may be dropped or UDP/443 filtered). Not a negative signal; h3 is judged from Alt-Svc / HTTPS record
- HTTPS DNS record (SVCB)optional
No HTTPS DNS record (type 65). Add HTTPS record for faster HTTP/3 discovery: first.org IN HTTPS 1 . alpn="h3,h2"
About this report
IntoDNS.AI evaluates first.org against DNS hygiene, email authentication, and transport-security best practices, scoring each check and rolling them up into an overall grade. Results reflect public DNS as observed on June 10, 2026 and may differ from a live scan if the domain has since changed its configuration.
Want to check your own domain? Scan any domain on the homepage.
Last analyzed: June 10, 2026 · Google Public DNS