DNS & Email Security Report for mollie.com

• A record presentcritical

  1 A record(s) found

• AAAA record presentrecommended

  No AAAA records

• MX records presentrecommended

  5 MX record(s) found

• NS records presentcritical

  4 NS record(s) found

• SOA record presentcritical

  SOA record found

• Multiple nameserversrecommended

  4 nameservers configured ✓

• SOA serial formatinfo

  Serial 1 (valid, managed DNS format)

• SOA timers validinfo

  Refresh: 21600s ✓, Retry: 3600s ✓, Expire: 259200s ✗. Expire should be 604800-2419200s (1-4 weeks)

• No lame nameserversinfo

  4 NS all responding ✓

• Glue records presentinfo

  No glue needed

• WWW record configuredinfo

  CNAME record matches apex

• MX servers have PTR recordsinfo

  7 MX IPs all have PTR records ✓

• MX servers have FCrDNSinfo

  7 MX IPs have forward-confirmed reverse DNS ✓

• DNSSEC signedrecommended

  DNSSEC is enabled ✓

• DNSSEC validation OKcritical

  DNSSEC validates correctly ✓

• NSEC3 RFC 9276 compliantrecommended

  NSEC3 not RFC 9276 compliant: iterations=1 (must be 0), salt="c0f4e74677b90a1a" (must be empty). Modern resolvers may reject this zone

• RRSIG signatures validrecommended

  RRSIG signatures valid, earliest expiry in 20 days ✓

• Modern DNSSEC algorithmoptional

  RSA/SHA-256 (algorithm 8) — acceptable ✓

• DS digest algorithm modernrecommended

  DS digest: SHA-256 — modern ✓

• DNSKEY algorithm secureoptional

  DNSKEY: RSA/SHA-256 — acceptable, consider ECDSA (13) or Ed25519 (15)

• RRSIG TTL saferecommended

  Record TTLs do not exceed RRSIG validity periods ✓

• Chain of trust completecritical

  Complete chain: DNSKEY + DS + RRSIG ✓

• Website reachable via IPv6recommended

  No IPv6 for website. Add AAAA record pointing to your IPv6 address

• Mail servers reachable via IPv6recommended

  5/5 MX server(s) with IPv6 ✓

• Nameservers reachable via IPv6recommended

  4/4 NS server(s) with IPv6 ✓

• SPF record presentcritical

  v=spf1 ip4:81.93.166.36/31 include:_spf.google.com include:mail.zendesk.com -all

• SPF syntax validcritical

  SPF syntax is correct ✓

• SPF policy strict (-all)recommended

  SPF uses -all (hard fail) ✓

• DKIM foundrecommended

  DKIM selector: google ✓

• DMARC record presentrecommended

  v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected];

• DMARC policy quarantine or betterrecommended

  DMARC policy: quarantine ✓

• DMARC policy rejectoptional

  DMARC policy: quarantine. Set p=reject for maximum protection

• BIMI record presentoptional

  BIMI logo: https://vmc.digicert.com/e40782ea-b106-4c3e-93a1-b30f87b924d9.svg

• BIMI configuration validoptional

  BIMI correctly configured ✓

• MTA-STS record presentoptional

  No MTA-STS. Add TXT at _mta-sts and host policy at /.well-known/mta-sts.txt

• MTA-STS policy enforcedoptional

  MTA-STS not configured

• MX records validcritical

  5 MX record(s) ✓

• MX domains use DNSSECrecommended

  0/2 MX domain(s) have DNSSEC. Ask your mail provider to enable DNSSEC

• MX DNSSEC validation OKrecommended

  DNSSEC not enabled for MX domains

• Mail servers not blacklistedcritical

  1 MX server(s) checked against 15 blacklists - clean ✓

• No critical blacklist listingscritical

  No blacklist listings ✓

• CAA records presentrecommended

  8 CAA record(s) ✓

• CAA policy strictoptional

  CAA limits certificate authorities ✓

• TLSA records (DANE)optional

  No TLSA/DANE records. Add TLSA at _25._tcp.mail for DANE email encryption

• DANE configuration validoptional

  No DANE configured

• No sensitive info in TXTcritical

  No sensitive data leaked ✓

• Verification records reviewedinfo

  8 verification records found (Pinterest, HubSpot, Atlassian, DocuSign, Google...). Review these - they reveal your tech stack to attackers. Remove unused service verifications

• HTTPS availablecritical

  HTTPS working (status 403) ✓

• Valid certificatecritical

  Certificate chain is valid and trusted ✓

• HTTP redirects to HTTPScritical

  HTTP automatically redirects to HTTPS ✓

• HSTS enabledrecommended

  HSTS enabled (max-age=31536000, includeSubDomains, preload) ✓

• HSTS max-age >= 1 yearoptional

  max-age=31536000 (≥1 year) ✓

• X-Frame-Options headerrecommended

  No X-Frame-Options header. Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking

• X-Content-Type-Options headerrecommended

  No X-Content-Type-Options header. Add X-Content-Type-Options: nosniff to prevent MIME sniffing

• Content-Security-Policy headerrecommended

  No Content-Security-Policy header. Add CSP to prevent XSS and other injection attacks

• Referrer-Policy headerrecommended

  No Referrer-Policy header. Add Referrer-Policy: strict-origin-when-cross-origin

• security.txt presentoptional

  No security.txt. Create /.well-known/security.txt with Contact and Expires fields (RFC 9116)

• security.txt validoptional

  No security.txt configured

• HTTP/3 (QUIC) supportedoptional

  HTTP/3 (QUIC v1) on port 443 Detection methods: QUIC probe: inconclusive (no reply — trigger may be dropped or UDP/443 filtered) Alt-Svc header: h3=":443" Cache: 720h (ma=2592000)

• QUIC UDP reachableinfo

  QUIC probe inconclusive (no reply — trigger may be dropped or UDP/443 filtered). Not a negative signal; h3 is judged from Alt-Svc / HTTPS record

• HTTPS DNS record (SVCB)optional

  No HTTPS DNS record (type 65). Add HTTPS record for faster HTTP/3 discovery: mollie.com IN HTTPS 1 . alpn="h3,h2"

Add IPv6 support

Request AAAA records from your hosting provider for your website. IPv6 is becoming increasingly important.

Impact: Makes your website accessible to IPv6-only networks

Review verification TXT records

Your domain has many third-party verification records that reveal your tech stack (Google, Microsoft, Atlassian, etc.). Review each one: 1) Remove records for services no longer used 2) Consider if each service really needs domain verification 3) Use a subdomain for less critical services. This is an information disclosure issue - attackers can map your SaaS footprint.

Impact: Reduces reconnaissance surface and limits attacker knowledge of your infrastructure