Good. b.hu has information for your TLD. This confirms your domain is properly delegated.

Good. The parent server has your nameservers listed and they match the actual NS records. This ensures consistent DNS resolution.

The following nameservers are not responding to DNS queries: • adns1.gov.hu • adns0.gov.hu This is a critical issue — these nameservers are configured for your domain but are not reachable. DNS resolution will fail when queries are directed to these servers. This can cause intermittent failures, slow resolution, and degraded availability for your domain. Possible causes: • The nameserver host is down or misconfigured • A firewall is blocking DNS traffic (port 53) • The nameserver software is not running • The nameserver is not configured to serve this domain Recommendation: Contact your DNS provider or update your nameserver records to point to working servers.

Good. No nameservers allow recursive queries.

The GLUE records from the parent zone match those from your nameservers. This is important for consistent DNS resolution.

Note: Your nameservers are not under your domain, so additional glue records are not required.

Good. The NS records at all your nameservers are identical.

Good. All nameservers listed at the parent server responded.

All NS records appear to be valid hostnames.

You have 1 nameserver. This meets the minimum requirement, though RFC2182 section 5 recommends at least 3 for better reliability.

Good. All nameservers are answering authoritatively for your domain.

Good. All NS records match between parent and nameservers, as required by RFC1034 section 3.6.

Error: The following nameservers from parent are missing in your zone: adns0.gov.hu adns1.gov.hu This means some nameservers registered at the parent are not configured in your zone. See RFC1034 section 3.6 for proper delegation requirements.

Good. No CNAME records found for NS records, as per RFC1912 section 2.4 and RFC2181 section 10.3.

Good. Your nameservers are on different subnets, providing better redundancy as recommended by RFC2182 section 5.

Good. All nameserver IPs (both IPv4 and IPv6) are public, ensuring global accessibility as required by RFC1035.

Good. All DNS servers allow TCP connections, which is required for larger DNS responses as per RFC1035.

Good. All DNS servers allow UDP connections, which is required for standard DNS queries.

Good. Your nameservers appear to be on different networks, providing better redundancy.

Warning: Found stealth nameservers: Nameservers in parent but missing from zone: • adns0.gov.hu • adns1.gov.hu Stealth nameservers can cause inconsistent DNS resolution and should be either properly registered at both parent and zone, or removed.

SOA Serial numbers per nameserver: adns2.gov.hu: 2026040219 Good. All nameservers report the same SOA serial number.

Warning: Primary nameserver adns0.gov.hu is not listed in your NS records. MNAME doesn't match a member of the NS RRSET. This is OK but may be problematic with zones using Dynamic Updates.

Your SOA serial number is: 2026040219.

OK. Your SOA REFRESH interval is: 43200 seconds (720 minutes). This is within the recommended range of 1200-43200 seconds as per RFC1912 section 2.2.

OK. Your SOA RETRY value is: 3600 seconds (60 minutes). This is within the recommended range of 120-7200 seconds as per RFC1912 section 2.2.

Current expire time is 604800 seconds (7 days). Warning: Common practice recommends a minimum of 14 days (1209600 seconds) to ensure secondary servers can continue serving during extended outages.

OK. Your SOA MINIMUM TTL is: 3600 seconds (60 minutes). This value is used for negative caching and is within the recommended range of 180-86400 seconds as per RFC2308 section 4.

No A records found for the domain. This means your domain cannot be accessed via IPv4.

No AAAA (IPv6) records found. While not required, IPv6 support is recommended for future-proofing your domain and improving accessibility for IPv6 users.

No MX records found. Email delivery will fall back to the domain's A record.

DNSSEC validation failed. This indicates a problem with your DNSSEC configuration: • DNSKEY query failed with SERVFAIL • DS query failed with SERVFAIL Please check your DNSSEC configuration with your DNS provider.

Zone transfer (AXFR) is properly restricted. Tested 1 nameserver — all refused the transfer request. Learn more: https://dnschkr.com/blog/dns-attacks-guide#dns-zone-transfer-attack-axfr

Good. Tested notrealdnschkr.gov.hu - No wildcard DNS records found, ensuring random subdomains won't resolve to an IP address.

Good. Tested notrealdnschkr.gov.hu - Server returns NXDOMAIN for non-existent domains. While an SOA record is recommended, NXDOMAIN alone is a valid response.

No CAA records found. While optional, CAA records help control which Certificate Authorities can issue certificates for your domain.

Checked 8 common subdomains — none have external CNAME records. No subdomain takeover risk from dangling CNAMEs. Learn more: https://dnschkr.com/blog/dns-attacks-guide#subdomain-takeover

No SPF record found. SPF helps prevent email spoofing by specifying which servers are authorized to send email for your domain.

No DMARC record found. DMARC helps prevent email spoofing and provides reporting capabilities. Consider adding a DMARC record to improve email security.