DNS & Email Security Report for vodafone.nl

• A record presentcritical

  2 A record(s) found

• AAAA record presentrecommended

  2 AAAA record(s) found

• MX records presentrecommended

  1 MX record(s) found

• NS records presentcritical

  2 NS record(s) found

• SOA record presentcritical

  SOA record found

• Multiple nameserversrecommended

  2 nameservers configured ✓

• SOA serial formatinfo

  Serial 2010800257 (YYYYMMDDnn format)

• SOA timers validinfo

  Refresh: 1800s ✓, Retry: 180s ✓, Expire: 1209600s ✓

• No lame nameserversinfo

  2 NS all responding ✓

• Glue records presentinfo

  4 glue record(s)

• WWW record configuredinfo

  CNAME: 4o9qpig.impervadns.net

• MX servers have PTR recordsinfo

  4 MX IPs all have PTR records ✓

• MX servers have FCrDNSinfo

  4 MX IPs have forward-confirmed reverse DNS ✓

• DNSSEC signedrecommended

  DNSSEC is enabled ✓

• DNSSEC validation OKcritical

  DNSSEC validates correctly ✓

• NSEC3 RFC 9276 compliantrecommended

  NSEC3 not RFC 9276 compliant: iterations=10 (must be 0), salt="19620fde56a326c04c89dddf" (must be empty). Modern resolvers may reject this zone

• RRSIG signatures validrecommended

  RRSIG signature expires in 3 days — renewal needed

• Modern DNSSEC algorithmoptional

  RSA/SHA-256 (algorithm 8) — acceptable ✓

• DS digest algorithm modernrecommended

  DS digest: SHA-256 — modern ✓

• DNSKEY algorithm secureoptional

  DNSKEY: RSA/SHA-256 — acceptable, consider ECDSA (13) or Ed25519 (15)

• RRSIG TTL saferecommended

  Record TTLs do not exceed RRSIG validity periods ✓

• Chain of trust completecritical

  Complete chain: DNSKEY + DS + RRSIG ✓

• Website reachable via IPv6recommended

  2 AAAA record(s) ✓

• Mail servers reachable via IPv6recommended

  0/1 MX servers have IPv6. Add AAAA records for your mail servers

• Nameservers reachable via IPv6recommended

  2/2 NS server(s) with IPv6 ✓

• SPF record presentcritical

  v=spf1 include:mail.ziggo.com include:rnmk.com -all

• SPF syntax validcritical

  SPF syntax is correct ✓

• SPF policy strict (-all)recommended

  SPF uses -all (hard fail) ✓

• DKIM foundrecommended

  No DKIM found. Configure DKIM signing with your email provider

• DMARC record presentrecommended

  v=DMARC1; p=reject; rua=mailto:[email protected],mailto:[email protected],mailto:[email protected]; ruf=mailto:[email protected],mailto:[email protected]; fo=1

• DMARC policy quarantine or betterrecommended

  DMARC policy: reject ✓

• DMARC policy rejectoptional

  DMARC policy: reject ✓

• BIMI record presentoptional

  BIMI logo: https://www.ziggo.nl/content/dam/email/bimi/Vodafone_Icon_RGB_RED_tiny_ps.svg

• BIMI configuration validoptional

  BIMI correctly configured ✓

• MTA-STS record presentoptional

  No MTA-STS. Add TXT at _mta-sts and host policy at /.well-known/mta-sts.txt

• MTA-STS policy enforcedoptional

  MTA-STS not configured

• MX records validcritical

  1 MX record(s) ✓

• MX domains use DNSSECrecommended

  1/1 MX domain(s) use DNSSEC ✓

• MX DNSSEC validation OKrecommended

  MX DNSSEC validates correctly ✓

• Mail servers not blacklistedcritical

  1 MX server(s) checked against 16 blacklists - clean ✓

• No critical blacklist listingscritical

  No blacklist listings ✓

• CAA records presentrecommended

  4 CAA record(s) ✓

• CAA policy strictoptional

  CAA limits certificate authorities ✓

• TLSA records (DANE)optional

  No TLSA/DANE records. Add TLSA at _25._tcp.mail for DANE email encryption

• DANE configuration validoptional

  No DANE configured

• No sensitive info in TXTcritical

  No sensitive data leaked ✓

• Verification records reviewedinfo

  4 verification record(s): Google, Facebook/Meta, Microsoft 365, Pinterest. Consider if all are still needed

• HTTPS availablecritical

  HTTPS working (status 200) ✓

• Valid certificatecritical

  Certificate chain is valid and trusted ✓

• HTTP redirects to HTTPScritical

  HTTP does not redirect to HTTPS. Add redirect in web server config

• HSTS enabledrecommended

  No HSTS header. Add Strict-Transport-Security header with max-age of at least 31536000 (1 year)

• HSTS max-age >= 1 yearoptional

  HSTS not enabled

• X-Frame-Options headerrecommended

  No X-Frame-Options header. Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking

• X-Content-Type-Options headerrecommended

  No X-Content-Type-Options header. Add X-Content-Type-Options: nosniff to prevent MIME sniffing

• Content-Security-Policy headerrecommended

  No Content-Security-Policy header. Add CSP to prevent XSS and other injection attacks

• Referrer-Policy headerrecommended

  No Referrer-Policy header. Add Referrer-Policy: strict-origin-when-cross-origin

• security.txt presentoptional

  Contact: https://www.vodafone.nl/over-deze-website/privacy-en-disclaimer/report-security-leak.shtml

• security.txt validoptional

  security.txt has required Contact and Expires fields ✓

• HTTP/3 (QUIC) supportedoptional

  No HTTP/3 support detected No h3 in Alt-Svc header No HTTPS DNS record (type 65) QUIC probe inconclusive (Inconclusive - no QUIC reply (trigger may be dropped or UDP/443 filtered)) — not a negative signal

• QUIC UDP reachableinfo

  QUIC probe inconclusive (no reply — trigger may be dropped or UDP/443 filtered). Not a negative signal; h3 is judged from Alt-Svc / HTTPS record

• HTTPS DNS record (SVCB)optional

  No HTTPS DNS record (type 65). Add HTTPS record for faster HTTP/3 discovery: vodafone.nl IN HTTPS 1 . alpn="h3,h2"

Implement DKIM

Configure DKIM signing with your email provider and publish the DKIM public key in DNS.

Impact: Improves email deliverability and prevents spoofing

IPv6 for mail servers

Add AAAA records for your MX servers to support email via IPv6.

Impact: Improves email reachability for IPv6 networks

Enable HTTP/3 (QUIC)

Enable HTTP/3 for faster page loads and improved connection resilience. Nginx: add "listen 443 quic reuseport;" and "add_header Alt-Svc 'h3=":443"; ma=86400'". Caddy: HTTP/3 is enabled by default. Cloudflare: Enable under Speed → Protocol Optimization. Also add an HTTPS DNS record: example.com IN HTTPS 1 . alpn="h3,h2" Ensure UDP port 443 is open in your firewall (QUIC uses UDP, not TCP).

Impact: Faster page loads (0-RTT), better mobile performance, and connection migration between networks