DNS & Email Security Report for philips.com

• A record presentcritical

  1 A record(s) found

• AAAA record presentrecommended

  No AAAA records

• MX records presentrecommended

  1 MX record(s) found

• NS records presentcritical

  3 NS record(s) found

• SOA record presentcritical

  SOA record found

• Multiple nameserversrecommended

  3 nameservers configured ✓

• SOA serial formatinfo

  Serial 2019092953 (YYYYMMDDnn format)

• SOA timers validinfo

  Refresh: 1200s ✓, Retry: 300s ✓, Expire: 1209600s ✓

• No lame nameserversinfo

  3 NS all responding ✓

• Glue records presentinfo

  6 glue record(s)

• WWW record configuredinfo

  CNAME: fallback.global.prod.cdn.philips.com

• MX servers have PTR recordsinfo

  4 MX IPs all have PTR records ✓

• MX servers have FCrDNSinfo

  4 MX IPs have forward-confirmed reverse DNS ✓

• DNSSEC signedrecommended

  DNSSEC not configured. Enable DNSSEC at your domain registrar to protect against DNS spoofing

• DNSSEC validation OKcritical

  Not applicable (DNSSEC not enabled)

• NSEC3 RFC 9276 compliantrecommended

  Not applicable (domain uses NSEC or is not DNSSEC-signed)

• RRSIG signatures validrecommended

  Not applicable (DNSSEC not enabled)

• Modern DNSSEC algorithmoptional

  Not applicable (DNSSEC not enabled)

• DS digest algorithm modernrecommended

  Not applicable (no DS records or DNSSEC not enabled)

• DNSKEY algorithm secureoptional

  Not applicable (DNSSEC not enabled)

• RRSIG TTL saferecommended

  Not applicable (DNSSEC not enabled or no RRSIG data)

• Chain of trust completecritical

  DNSSEC not enabled

• Website reachable via IPv6recommended

  No IPv6 for website. Add AAAA record pointing to your IPv6 address

• Mail servers reachable via IPv6recommended

  0/1 MX servers have IPv6. Add AAAA records for your mail servers

• Nameservers reachable via IPv6recommended

  3/3 NS server(s) with IPv6 ✓

• SPF record presentcritical

  v=spf1 include:spf.protection.outlook.com include:spf.res55113.zixworks.com include:philips.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email ~all

• SPF syntax validcritical

  SPF syntax is correct ✓

• SPF policy strict (-all)recommended

  SPF uses ~all or ?all. Change to -all for strict enforcement

• DKIM foundrecommended

  DKIM selector: selector1 ✓

• DMARC record presentrecommended

  v=DMARC1; p=reject; rua=mailto:[email protected],mailto:[email protected]; fo=0; rf=afrf

• DMARC policy quarantine or betterrecommended

  DMARC policy: reject ✓

• DMARC policy rejectoptional

  DMARC policy: reject ✓

• BIMI record presentoptional

  No BIMI record. Add TXT at default._bimi with logo URL (requires DMARC p=quarantine+)

• BIMI configuration validoptional

  No BIMI configured

• MTA-STS record presentoptional

  No MTA-STS. Add TXT at _mta-sts and host policy at /.well-known/mta-sts.txt

• MTA-STS policy enforcedoptional

  MTA-STS not configured

• MX records validcritical

  1 MX record(s) ✓

• MX domains use DNSSECrecommended

  1/1 MX domain(s) use DNSSEC ✓

• MX DNSSEC validation OKrecommended

  MX DNSSEC validates correctly ✓

• Mail servers not blacklistedcritical

  1 MX server(s) checked against 16 blacklists - clean ✓

• No critical blacklist listingscritical

  No blacklist listings ✓

• CAA records presentrecommended

  14 CAA record(s) ✓

• CAA policy strictoptional

  CAA limits certificate authorities ✓

• TLSA records (DANE)optional

  No TLSA/DANE records. Add TLSA at _25._tcp.mail for DANE email encryption

• DANE configuration validoptional

  No DANE configured

• No sensitive info in TXTcritical

  No sensitive data leaked ✓

• Verification records reviewedinfo

  3 verification record(s): Atlassian, Slack, Apple. Consider if all are still needed

• HTTPS availablecritical

  HTTPS working (status 200) ✓

• Valid certificatecritical

  Certificate chain is valid and trusted ✓

• HTTP redirects to HTTPScritical

  HTTP automatically redirects to HTTPS ✓

• HSTS enabledrecommended

  HSTS enabled (max-age=31536000) ✓

• HSTS max-age >= 1 yearoptional

  max-age=31536000 (≥1 year) ✓

• X-Frame-Options headerrecommended

  X-Frame-Options: sameorigin ✓

• X-Content-Type-Options headerrecommended

  X-Content-Type-Options: nosniff ✓

• Content-Security-Policy headerrecommended

  Content-Security-Policy configured ✓

• Referrer-Policy headerrecommended

  Referrer-Policy: strict-origin-when-cross-origin ✓

• security.txt presentoptional

  Contact: mailto:[email protected]

• security.txt validoptional

  security.txt missing required fields. Must have Contact: and Expires: per RFC 9116

• HTTP/3 (QUIC) supportedoptional

  HTTP/3 (QUIC v1) on port 443 Detection methods: QUIC probe: QUIC v1 (RFC 9000) (8ms)

• QUIC UDP reachableoptional

  QUIC reachable on UDP/443 (8ms) — QUIC v1 (RFC 9000) ✓

• HTTPS DNS record (SVCB)optional

  No HTTPS DNS record (type 65). Add HTTPS record for faster HTTP/3 discovery: philips.com IN HTTPS 1 . alpn="h3,h2"

Implement DNSSEC

Activate DNSSEC with your domain registrar and add the DS records to your parent zone. This protects against DNS spoofing attacks.

Impact: Significantly increases security and prevents DNS manipulation

Add IPv6 support

Request AAAA records from your hosting provider for your website. IPv6 is becoming increasingly important.

Impact: Makes your website accessible to IPv6-only networks

IPv6 for mail servers

Add AAAA records for your MX servers to support email via IPv6.

Impact: Improves email reachability for IPv6 networks