DNS Records for
james.com
🐛 Hunting for rogue glue records.
DNS Records forjames.com
Domain DNS Health Score
71%
Total Tests
17
Passed
12
Critical Issues
4
Top Recommendations:
DNS Performance Analysis
Performance analysis data is not available for this domain. This can happen when the analysis times out or when nameservers are unreachable.
These nameservers are responsible for answering queries about your domain
4 Records
ns1.nstable.com
ns2.nstable.com
ns3.nstable.com
ns4.nstable.com
Source: This information was kindly provided by k.gtld-servers.net 🙏🏼
Good. k.gtld-servers.net has information for your TLD. This confirms your domain is properly delegated.
Good. The parent server has your nameservers listed and they match the actual NS records. This ensures consistent DNS resolution.
Glue Records from Parent Server
Information provided by k.gtld-servers.net
ns1.nstable.com
Nameserver
IPv4 Addresses:
141.95.140.91ns2.nstable.com
Nameserver
IPv4 Addresses:
141.95.140.92ns3.nstable.com
Nameserver
IPv4 Addresses:
141.95.140.93ns4.nstable.com
Nameserver
IPv4 Addresses:
141.95.140.94Note:
The parent server is providing glue records for these nameservers. While not required (since the nameservers are not under your domain), this helps optimize DNS resolution.
| Status | Test name | Information |
|---|---|---|
Authoritative Nameservers | These nameservers are responsible for answering queries about your domain 4 Records ns1.nstable.comns2.nstable.comns3.nstable.comns4.nstable.comSource: This information was kindly provided by k.gtld-servers.net 🙏🏼 | |
TLD Delegation Check | Good. k.gtld-servers.net has information for your TLD. This confirms your domain is properly delegated. | |
Nameservers Listed at Parent | Good. The parent server has your nameservers listed and they match the actual NS records. This ensures consistent DNS resolution. | |
Glue Records from Parent | Glue Records from Parent ServerInformation provided by k.gtld-servers.net ns1.nstable.comNameserver IPv4 Addresses: 141.95.140.91ns2.nstable.comNameserver IPv4 Addresses: 141.95.140.92ns3.nstable.comNameserver IPv4 Addresses: 141.95.140.93ns4.nstable.comNameserver IPv4 Addresses: 141.95.140.94Note: The parent server is providing glue records for these nameservers. While not required (since the nameservers are not under your domain), this helps optimize DNS resolution. |
Error
Error performing nameserver checks: Module timeout (time budget exceeded)
| Status | Test name | Information |
|---|---|---|
Nameserver Checks | Error performing nameserver checks: Module timeout (time budget exceeded) |
Info
Primary Nameserver
ns1.nstable.com
Hostmaster Email
dns.nstable.com
Serial Number
2025122644
Standard Format (YYYYMMDDnn)
A unique version number that changes whenever the zone file is updated
Time Intervals
Refresh7350 seconds (2 hours)
How often secondary nameservers check for updates (20m - 24h)
Retry1625 seconds (27 minutes)
How long to wait before retrying a failed zone transfer (2m - 2h)
Expire1210645 seconds (14 days)
How long secondary servers serve stale zone data (1w - 4w)
TTL365 seconds (6 minutes)
Default time-to-live for resource records (5m - 24h)
SOA Serial numbers per nameserver:
ns3.nstable.com: 2025122644
ns4.nstable.com: 2025122644
ns1.nstable.com: 2025122644
ns2.nstable.com: 2025122644
Good. All nameservers report the same SOA serial number.
Pass
OK. ns1.nstable.com is correctly listed as one of your nameservers.
Info
Your SOA serial number is: 2025122644.
Pass
OK. Your SOA REFRESH interval is: 7350 seconds (123 minutes). This is within the recommended range of 1200-43200 seconds as per RFC1912 section 2.2.
Pass
OK. Your SOA RETRY value is: 1625 seconds (27 minutes). This is within the recommended range of 120-7200 seconds as per RFC1912 section 2.2.
Pass
Current expire time is 1210645 seconds (14 days).
Pass
OK. Your SOA MINIMUM TTL is: 365 seconds (6 minutes). This value is used for negative caching and is within the recommended range of 180-86400 seconds as per RFC2308 section 4.
| Status | Test name | Information |
|---|---|---|
SOA record | Primary Nameserverns1.nstable.com Hostmaster Emaildns.nstable.com Serial Number 2025122644 Standard Format (YYYYMMDDnn) A unique version number that changes whenever the zone file is updated Time IntervalsRefresh7350 seconds (2 hours) How often secondary nameservers check for updates (20m - 24h) Retry1625 seconds (27 minutes) How long to wait before retrying a failed zone transfer (2m - 2h) Expire1210645 seconds (14 days) How long secondary servers serve stale zone data (1w - 4w) TTL365 seconds (6 minutes) Default time-to-live for resource records (5m - 24h) | |
SOA Serial Consistency | SOA Serial numbers per nameserver:
ns3.nstable.com: 2025122644
ns4.nstable.com: 2025122644
ns1.nstable.com: 2025122644
ns2.nstable.com: 2025122644
Good. All nameservers report the same SOA serial number. | |
SOA MNAME entry | OK. ns1.nstable.com is correctly listed as one of your nameservers. | |
SOA Serial | Your SOA serial number is: 2025122644. | |
SOA REFRESH | OK. Your SOA REFRESH interval is: 7350 seconds (123 minutes). This is within the recommended range of 1200-43200 seconds as per RFC1912 section 2.2. | |
SOA RETRY | OK. Your SOA RETRY value is: 1625 seconds (27 minutes). This is within the recommended range of 120-7200 seconds as per RFC1912 section 2.2. | |
SOA EXPIRE | Current expire time is 1210645 seconds (14 days). | |
SOA MINIMUM TTL | OK. Your SOA MINIMUM TTL is: 365 seconds (6 minutes). This value is used for negative caching and is within the recommended range of 180-86400 seconds as per RFC2308 section 4. |
IPv4 Configuration
Single IPv4 address configuration
IPv4 Addresses
141.95.140.95TTL: 30s
Provides a good balance between propagation speed and DNS loadInfo
Low TTL of 30 seconds provides quick propagation but may increase DNS load.
| Status | Test name | Information |
|---|---|---|
A Record Configuration | IPv4 ConfigurationSingle IPv4 address configuration IPv4 Addresses 141.95.140.95TTL: 30s Provides a good balance between propagation speed and DNS load | |
A Record TTL | Low TTL of 30 seconds provides quick propagation but may increase DNS load. |
Info
No AAAA (IPv6) records found. While not required, IPv6 support is recommended for future-proofing your domain and improving accessibility for IPv6 users.
| Status | Test name | Information |
|---|---|---|
IPv6 Support | No AAAA (IPv6) records found. While not required, IPv6 support is recommended for future-proofing your domain and improving accessibility for IPv6 users. |
Info
MX analysis was skipped due to time constraints. The analysis took longer than expected, likely due to slow or unreachable nameservers.
| Status | Test name | Information |
|---|---|---|
MX Analysis | MX analysis was skipped due to time constraints. The analysis took longer than expected, likely due to slow or unreachable nameservers. |
Error
Error analyzing WWW records: Module timeout (time budget exceeded)
| Status | Test name | Information |
|---|---|---|
WWW Analysis | Error analyzing WWW records: Module timeout (time budget exceeded) |
Error
DNSSEC validation failed. This indicates a problem with your DNSSEC configuration:
• DNSKEY query failed with SERVFAIL
• DS query failed with SERVFAIL
Please check your DNSSEC configuration with your DNS provider.
Pass
Zone transfer (AXFR) is properly restricted. Tested 4 nameservers — all refused the transfer request.
Learn more: https://dnschkr.com/blog/dns-attacks-guide#dns-zone-transfer-attack-axfr
Pass
Good. Tested notrealdnschkr.james.com - No wildcard DNS records found, ensuring random subdomains won't resolve to an IP address.
Warning
Warning: Server does not return NXDOMAIN for non-existent domains. This could indicate misconfiguration or intentional wildcard records.
Info
No CAA records found. While optional, CAA records help control which Certificate Authorities can issue certificates for your domain.
Checked 8 common subdomains — none have external CNAME records. No subdomain takeover risk from dangling CNAMEs.
Learn more: https://dnschkr.com/blog/dns-attacks-guide#subdomain-takeover
| Status | Test name | Information |
|---|---|---|
DNSSEC | DNSSEC validation failed. This indicates a problem with your DNSSEC configuration:
• DNSKEY query failed with SERVFAIL
• DS query failed with SERVFAIL
Please check your DNSSEC configuration with your DNS provider. | |
Zone Transfer | Zone transfer (AXFR) is properly restricted. Tested 4 nameservers — all refused the transfer request.
Learn more: https://dnschkr.com/blog/dns-attacks-guide#dns-zone-transfer-attack-axfr | |
Wildcard DNS | Good. Tested notrealdnschkr.james.com - No wildcard DNS records found, ensuring random subdomains won't resolve to an IP address. | |
NXDOMAIN Response | Warning: Server does not return NXDOMAIN for non-existent domains. This could indicate misconfiguration or intentional wildcard records. | |
CAA Records | No CAA records found. While optional, CAA records help control which Certificate Authorities can issue certificates for your domain. | |
Subdomain Takeover | Checked 8 common subdomains — none have external CNAME records. No subdomain takeover risk from dangling CNAMEs.
Learn more: https://dnschkr.com/blog/dns-attacks-guide#subdomain-takeover |
Error
Error analyzing TXT records: Module timeout (time budget exceeded)
| Status | Test name | Information |
|---|---|---|
TXT Analysis | Error analyzing TXT records: Module timeout (time budget exceeded) |