marketstead.com

DNS hosting provider

Cloudflare

Parent zone

com — answered by l.gtld-servers.net

DNSSEC

Signed — the parent publishes a DS record

Primary nameserver (SOA)

becky.ns.cloudflare.com · serial 2417612509

Nameservers

Each server was asked directly, with recursion off. "Parent" = listed by the registry; "Local" = listed by your own nameservers.

Tests

1. Info

   SOA serial format

   Cloudflare manages serials internally — nothing to grade here.

   More info about “SOA serial format”

   The SOA serial is the version number of your zone. Secondaries compare serials to decide whether to refresh, so it only works if it reliably increases. RFC 1912 §2.2 recommends YYYYMMDDnn (year, month, day, revision), not a mandatory wire format. A future date can make that convention confusing; managed providers use their own counters and are not graded.

2. Info

   SOA expire timer

   Cloudflare sets this timer deliberately — platform-managed zones are not graded against the RFC 1912 §2.2 bands.

   More info about “SOA expire timer”

   Expire is the survival clock: if secondaries lose contact with the primary, they keep answering from their last good copy until the timer runs out, then stop serving the zone altogether. Set it past the longest outage you would ever ride through (RFC 1912 §2.2 suggests two to four weeks) — shorter and a bad week at your provider takes your domain off the internet; longer and visitors may be served very stale data. RFC 1912 §2.2 also recommends keeping it larger than both the minimum and retry timers.

3. Info

   SOA refresh timer

   Cloudflare sets this timer deliberately — platform-managed zones are not graded against the RFC 1912 §2.2 bands.

   More info about “SOA refresh timer”

   The refresh timer decides how often each secondary nameserver checks the primary for a newer version of your zone. Too low and the polling is pure traffic; too high and every DNS change propagates only at the speed of the timer (or a NOTIFY message, if your provider sends them). RFC 1912 §2.2 suggests twenty minutes to twelve hours. If this number looks unfamiliar, your DNS platform chose it for you — which is exactly why we do not grade managed zones on it.

4. Info

   SOA retry timer

   Cloudflare sets this timer deliberately — platform-managed zones are not graded against the RFC 1912 §2.2 bands.

   More info about “SOA retry timer”

   When a secondary cannot reach the primary at refresh time, retry is how long it waits before trying again. It only matters during a primary outage — but that is exactly when your zone's consistency is already at its weakest. RFC 1912 §2.2 wants it to be a modest fraction of the refresh interval: frequent enough to recover quickly, gentle enough not to punish a struggling primary.

5. Info

   SOA minimum TTL (negative cache)

   Cloudflare sets this timer deliberately — platform-managed zones are not graded against the RFC 1912 §2.2 bands.

   More info about “SOA minimum TTL (negative cache)”

   Despite its name, the SOA "minimum" has not set the default record TTL since RFC 2308 §5: today it is how long resolvers cache NEGATIVE answers — lookups for names that do not exist in your zone. Too low and junk traffic (typo probes, scanners) hits your nameservers at full rate; too high and every new hostname you create stays invisible to parts of the internet for up to that long after a cached miss. One to three hours is the modern consensus, which is why this band tops out at a day rather than RFC 1912's original one-to-five days.

6. OK

   DNS record published

   marketstead.com is delegated and its nameservers answer for it (SOA found).

   More info about “DNS record published”

   The basic question: does the registry point to nameservers for this domain, and do those servers actually answer for it? If not, nothing else works: no website, no email.

7. OK

   Glue record consistency

   Glue at the parent matches the nameservers’ IPv4 and IPv6 address records.

   More info about “Glue record consistency”

   RFC 1034 §4.2.1 requires parent addresses (glue) for nameservers inside the delegated zone, so visitors can find those servers without asking them first. Missing glue risks a circular lookup. RFC 2181 §5.4.1 distinguishes this bootstrap data from the authoritative address records; IPv4 glue must match IPv4 records, and IPv6 glue must match IPv6 records.

8. OK

   Nameserver count

   2 distinct nameservers are published for this zone: todd.ns.cloudflare.com, becky.ns.cloudflare.com.

   More info about “Nameserver count”

   Nameservers are the only path from a visitor's resolver to your zone, so their count is your availability floor. A single nameserver means any maintenance window, crashed daemon, or provider hiccup takes your domain completely offline — there is nothing to fail over to. Two is the internet's practical minimum; more is fine, but every published entry is also a server that must be patched and monitored, so unusually large sets should be deliberate.

9. OK

   Nameserver reachability

   12 of 12 answered with a successful SOA or NS record.

   More info about “Nameserver reachability”

   Every listed nameserver address should return a successful SOA (zone information) or NS (nameserver list) answer. A server that does not answer slows down visitors sent to it and provides no backup. RFC 1035 §4.1.1 defines a successful response code of zero and the separate authoritative-answer flag. Authority is checked separately, so a cached answer is not mistaken for proof that this server hosts the zone.

10. OK

    Nameservers answer authoritatively

    Every responding nameserver returned an authoritative SOA or NS answer.

    More info about “Nameservers answer authoritatively”

    RFC 1035 §4.1.1 defines the authoritative-answer (AA) flag. It means the server is responsible for the answer, rather than repeating a cached answer from elsewhere. Every nameserver listed for your domain should return a successful SOA or NS record with this flag; otherwise visitors can be sent to a server that does not host your zone.

11. OK

    Nameserver delegation consistency

    The parent delegation and all 6 readable authoritative answers agree on the NS set. Could not compare: todd.ns.cloudflare.com (2606:4700:58:0:0:0:adf5:3b92), todd.ns.cloudflare.com (2803:f800:50:0:0:0:6ca2:c192), todd.ns.cloudflare.com (2a06:98c1:50:0:0:0:ac40:2192), becky.ns.cloudflare.com (2606:4700:50:0:0:0:adf5:3a49), becky.ns.cloudflare.com (2803:f800:50:0:0:0:6ca2:c049), becky.ns.cloudflare.com (2a06:98c1:50:0:0:0:ac40:2049).

    More info about “Nameserver delegation consistency”

    Your registrar publishes the parent nameserver list, which directs visitors to your DNS servers. RFC 1034 §4.2.2 describes this delegation and the authoritative zone copies: their nameserver lists should agree. A mismatch often means a move was only completed on one side. Empty or unanswered queries are reported separately as reachability problems, not mismatched lists.

12. Warning

    Network dispersal

    All nameservers are on one network (CLOUDFLARENET - Cloudflare, Inc.). Separate IP address blocks still depend on this one operator; adding a secondary DNS provider on another network reduces that shared risk.

    More info about “Network dispersal”

    RFC 2182 §3.1 recommends nameservers on separate networks and in separate places. An ASN identifies a network operator: separate address blocks at one operator still share routing risks. Two operators reduce that shared risk, but network numbers alone cannot prove geographic separation. When network ownership is unknown, this check is informational rather than a grade. How to fix it yourself: Host your secondary nameserver at a different provider — or at least a different autonomous system — than the primary.

13. OK

    Public nameserver addresses

    All 12 nameserver addresses are publicly routable.

    More info about “Public nameserver addresses”

    Nameserver addresses published in delegation are read by resolvers on the public internet, so they must be reachable from the public internet. A private address (10.x.x.x, 172.16.x.x, 192.168.x.x), a reserved or loopback address, or a documentation-only address (RFC 5737 TEST-NET like 192.0.2.x, RFC 2544 benchmark, RFC 6598 CGNAT) in the delegation sends every query that lands on it into a void until the resolver gives up. It almost always means an internal DNS server — or a copy-pasted example from documentation — was published to the registrar by mistake.

14. OK

    SOA serial consistency

    All 2 nameservers serve serial 2417612509.

    More info about “SOA serial consistency”

    When you change your zone, the change reaches your nameservers one by one. Each secondary polls the primary (the refresh interval), compares SOA serials, and only transfers data when the serial increased. If even one nameserver keeps serving an older serial, everyone whose resolver picked that server sees the old version of your zone — old mail routing, old site IPs — until it catches up or its data expires. Serial numbers only compare between servers of the same DNS provider: if your zone is deliberately hosted at two providers, each numbers its own copy, the serials will never match, and that is fine as long as both publish the same records.

15. OK

    Primary nameserver listed at parent

    The primary nameserver named in the SOA (becky.ns.cloudflare.com) is listed at the registry.

    More info about “Primary nameserver listed at parent”

    The SOA record names one nameserver as the primary, where changes start. It is normally also one of the servers listed at the registry. If it is not, that is either a deliberate "hidden primary" setup or a leftover from an old configuration.

16. OK

    Recursion closed to third parties

    All reachable nameservers refused third-party recursion (6 verified). No answer from: todd.ns.cloudflare.com (2606:4700:58:0:0:0:adf5:3b92), todd.ns.cloudflare.com (2803:f800:50:0:0:0:6ca2:c192), todd.ns.cloudflare.com (2a06:98c1:50:0:0:0:ac40:2192), becky.ns.cloudflare.com (2606:4700:50:0:0:0:adf5:3a49), becky.ns.cloudflare.com (2803:f800:50:0:0:0:6ca2:c049), becky.ns.cloudflare.com (2a06:98c1:50:0:0:0:ac40:2049) (probe inconclusive there).

    More info about “Recursion closed to third parties”

    An authoritative nameserver should answer questions about the zones it hosts — nothing else. A server that also resolves arbitrary domains for anyone ("open recursion") is used as a force-multiplier in DNS amplification DDoS attacks: attackers send it small queries with a spoofed source address and it floods the victim with large answers. Open resolvers also collect cache poisoning attempts aimed at domains they resolve for others. RFC 1035 §4.1.1 defines the RA flag (recursion available) and REFUSED response; a refused request is not evidence of open recursion.

Check next

• mx:marketstead.com
• spf:marketstead.com
• dmarc:marketstead.com
• a:marketstead.com
• propagation:marketstead.com
• blacklist:marketstead.com

Check something else

Email me this result

We send it once, with the link. No newsletter, no follow-ups.