Comprobando si un dominio público está correcto

/ / , , , , /

Estos días se puede probar totalmente gratuita una herramienta genial que realiza unos 100 tests sobre nuestro dominio público, de todos es sabído que es muy importante tener el dominio público bien configurado, para evitar problemas sobre todo con resolución DNS a él o cualquier problema ‘raro’ de correo electrónico. Este test se puede hacer con DNSreport de DNSstuff.com, una página que nunca debemos olvidar!

Si vamos a la web de DNSstuff y nos registramos de forma gratuita podremos ejecutar DNSreport con nuestro dominio, le damos a «Run!» para que realice todos los test, y así si no tenemos errores o sabemos a qué se debe, podremos estar seguros que nunca tendremos un problema con nuestro dominio, la mayoría de las veces se debe a correos que no llegan siempre, o a ciertas empresas no les llegan nuestros correos, o no nos llegan de ciertas empresas…

Tras ejecutar el test nos sacará ese report enorme dándonos las explicaciones de cualquier incidencia que note, aquí pego el ejemplo con mi dominio:

DNSreport for bujarra.com

Category Status Test Name Information
Parent PASS Missing Direct Parent check OK. Your direct parent zone exists, which is good. Some domains (usually third or fourth level domains, such as example.co.us) do not have a direct parent zone (‘co.us’ in this example), which is legal but can cause confusion.
INFO NS records at parent servers Your NS records at the parent servers are:

ns1.hostmonster.com. [74.220.195.131] [TTL=172800] [US] ns2.hostmonster.com. [69.89.16.8] [TTL=172800] [US]

[These were obtained from f.gtld-servers.net]
PASS Parent nameservers have your nameservers listed OK. When someone uses DNS to look up your domain, the first step (if it doesn’t already know about your domain) is to go to the parent servers. If you aren’t listed there, you can’t be found. But you are listed there.
PASS Glue at parent nameservers OK. The parent servers have glue for your nameservers. That means they send out the IP address of your nameservers, as well as their host names.
PASS DNS servers have A records OK. All your DNS servers either have A records at the zone parent servers, or do not need them (if the DNS servers are on other TLDs). A records are required for your hostnames to ensure that other DNS servers can reach your DNS servers. Note that there will be problems if your DNS servers do not have these same A records.

NS INFO NS records at your nameservers Your NS records at your nameservers are:

ns1.hostmonster.com. [74.220.195.131] [TTL=86400] ns2.hostmonster.com. [69.89.16.8] [TTL=86400]
PASS Open DNS servers OK. Your DNS servers do not announce that they are open DNS servers. Although there is a slight chance that they really are open DNS servers, this is very unlikely. Open DNS servers increase the chances that of cache poisoning, can degrade performance of your DNS, and can cause your DNS servers to be used in an attack (so it is good that your DNS servers do not appear to be open DNS servers).
PASS Mismatched glue OK. The DNS report did not detect any discrepancies between the glue provided by the parent servers and that provided by your authoritative DNS servers.
PASS No NS A records at nameservers OK. Your nameservers do include corresponding A records when asked for your NS records. This ensures that your DNS servers know the A records corresponding to all your NS records.
PASS All nameservers report identical NS records OK. The NS records at all your nameservers are identical.
PASS All nameservers respond OK. All of your nameservers listed at the parent nameservers responded.
PASS Nameserver name validity OK. All of the NS records that your nameservers report seem valid (no IPs or partial domain names).
PASS Number of nameservers OK. You have 2 nameservers. You must have at least 2 nameservers (RFC2182 section 5 recommends at least 3 nameservers), and preferably no more than 7.
PASS Lame nameservers OK. All the nameservers listed at the parent servers answer authoritatively for your domain.
PASS Missing (stealth) nameservers OK. All 2 of your nameservers (as reported by your nameservers) are also listed at the parent servers.
PASS Missing nameservers 2 OK. All of the nameservers listed at the parent nameservers are also listed as NS records at your nameservers.
PASS No CNAMEs for domain OK. There are no CNAMEs for bujarra.com. RFC1912 2.4 and RFC2181 10.3 state that there should be no CNAMEs if an NS (or any other) record is present.
PASS No NSs with CNAMEs OK. There are no CNAMEs for your NS records. RFC1912 2.4 and RFC2181 10.3 state that there should be no CNAMEs if an NS (or any other) record is present.
PASS Nameservers on separate class C’s OK. You have nameservers on different Class C (technically, /24) IP ranges. You must have nameservers at geographically and topologically dispersed locations. RFC2182 3.1 goes into more detail about secondary nameserver location.
PASS All NS IPs public OK. All of your NS records appear to use public IPs. If there were any private IPs, they would not be reachable, causing DNS delays.
WARN TCP Allowed WARNING: One or more of your DNS servers does not accept TCP connections. Although rarely used, TCP connections are occasionally used instead of UDP connections. When firewalls block the TCP DNS connections, it can cause hard-to-diagnose problems. This message could also appear if your DNS servers are using anycast. The problem servers are:

74.220.195.131: Error [Connection refused (10061)]. 69.89.16.8: Error [Connection refused (10061)].
INFO Nameservers versions Your nameservers have the following versions: 74.220.195.131: No version info available (referral). 69.89.16.8: No version info available (referral).
PASS Stealth NS record leakage Your DNS servers do not leak any stealth NS records (if any) in non-NS requests.
SOA INFO SOA record Your SOA record [TTL=86400] is:

Primary nameserver: ns1.hostmonster.com. Hostmaster E-mail address: root.host184.hostmonster.com. Serial #: 2008062600 Refresh: 86400 Retry: 7200 Expire: 3600000 Default TTL: 300
PASS NS agreement on SOA Serial # OK. All your nameservers agree that your SOA serial number is 2008062600. That means that all your nameservers are using the same data (unless you have different sets of data with the same serial number, which would be very bad)! Note that the DNSreport only checks the NS records listed at the parent servers (not any stealth servers).
PASS SOA MNAME Check OK. Your SOA (Start of Authority) record states that your master (primary) name server is: ns1.hostmonster.com.. That server is listed at the parent servers, which is correct.
PASS SOA RNAME Check OK. Your SOA (Start of Authority) record states that your DNS contact E-mail address is: root@host184.hostmonster.com. (techie note: we have changed the initial ‘.’ to an ‘@’ for display purposes).
PASS SOA Serial Number OK. Your SOA serial number is: 2008062600. This appears to be in the recommended format of YYYYMMDDnn, where ‘nn’ is the revision. So this indicates that your DNS was last updated on 26 Jun 2008 (and was revision #0). This number must be incremented every time you make a DNS change.
WARN SOA REFRESH value WARNING: Your SOA REFRESH interval is : 86400 seconds. This seems high. You should consider decreasing this value to about 3600-7200 seconds (or higher, if using DNS NOTIFY). RFC1912 2.2 recommends a value between 1200 to 43200 seconds (20 minutes to 12 hours, with the longer time periods used for very slow Internet connections), and if you are using DNS NOTIFY the refresh value is not as important (RIPE recommend 86400 seconds if using DNS NOTIFY). This value determines how often secondary/slave nameservers check with the master for updates. A value that is too high will cause DNS changes to be in limbo for a long time.
PASS SOA RETRY value OK. Your SOA RETRY interval is : 7200 seconds. This seems normal (about 120-7200 seconds is good). The retry value is the amount of time your secondary/slave nameservers will wait to contact the master nameserver again if the last attempt failed.
WARN SOA EXPIRE value WARNING: Your SOA EXPIRE time is : 3600000 seconds. This seems a bit high. You should consider decreasing this value to about 1209600 to 2419200 seconds (2 to 4 weeks). RFC1912 suggests 2-4 weeks. This is how long a secondary/slave nameserver will wait before considering its DNS data stale if it can’t reach the primary nameserver.
WARN SOA MINIMUM TTL value WARNING: Your SOA MINIMUM TTL is : 300 seconds. This seems low (unless you are just about to update your DNS). You should consider increasing this value to somewhere between 3600 and 10800. RFC2308 suggests a value of 1-3 hours. This value used to determine the default (technically, minimum) TTL (time-to-live) for DNS entries, but now is used for negative caching.

MX INFO MX Record Your 1 MX record is:

0 bujarra.com. [TTL=14400] IP=74.220.207.184 [TTL=14400] [US]
PASS Low port test OK. Our local DNS server that uses a low port number can get your MX record. Some DNS servers are behind firewalls that block low port numbers. This does not guarantee that your DNS server does not block low ports (this specific lookup must be cached), but is a good indication that it does not.
PASS Invalid characters OK. All of your MX records appear to use valid hostnames, without any invalid characters.
PASS All MX IPs public OK. All of your MX records appear to use public IPs. If there were any private IPs, they would not be reachable, causing slight mail delays, extra resource usage, and possibly bounced mail.
PASS MX records are not CNAMEs OK. Looking up your MX record did not just return a CNAME. If an MX record query returns a CNAME, extra processing is required, and some mail servers may not be able to handle it.
PASS MX A lookups have no CNAMEs OK. There appear to be no CNAMEs returned for A records lookups from your MX records (CNAMEs are prohibited in MX records, according to RFC974, RFC1034 3.6.2, RFC1912 2.4, and RFC2181 10.3).
PASS MX is host name, not IP OK. All of your MX records are host names (as opposed to IP addresses, which are not allowed in MX records).
INFO Multiple MX records NOTE: You only have 1 MX record. If your primary mail server is down or unreachable, there is a chance that mail may have troubles reaching you. In the past, mailservers would usually re-try E-mail for up to 48 hours. But many now only re-try for a couple of hours. If your primary mailserver is very reliable (or can be fixed quickly if it goes down), having just one mailserver may be acceptable.
PASS Differing MX-A records OK. I did not detect differing IPs for your MX records (this would happen if your DNS servers return different IPs than the DNS servers that are authoritative for the hostname in your MX records).
PASS Duplicate MX records OK. You do not have any duplicate MX records (pointing to the same IP). Although technically valid, duplicate MX records can cause a lot of confusion, and waste resources.
PASS Reverse DNS entries for MX records OK. The IPs of all of your mail server(s) have reverse DNS (PTR) entries. RFC1912 2.1 says you should have a reverse DNS for all your mail servers. It is strongly urged that you have them, as many mailservers will not accept mail from mailservers with no reverse DNS entry. Note that this information is cached, so if you changed it recently, it will not be reflected here (see the ‘Reverse DNS Tool’ for the current data). The reverse DNS entries are:

184.207.220.74.in-addr.arpa host184.hostmonster.com. [TTL=85747]

Mail PASS Connect to mail servers OK: I was able to connect to all of your mailservers.
PASS Mail server host name in greeting OK: All of your mailservers have their host name in the greeting:

bujarra.com:<br />    220-host184.hostmonster.com ESMTP Exim 4.69 #1 Wed, 09 Sep 2009 01:43:27 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail. <br />
PASS Acceptance of NULL <> sender OK: All of your mailservers accept mail from «<>». You are required (RFC1123 5.2.9) to receive this type of mail (which includes reject/bounce messages and return receipts).
FAIL Acceptance of postmaster address ERROR: One or more of your mailservers does not accept mail to postmaster@bujarra.com. Mailservers are required (RFC822 6.3, RFC1123 5.2.7, and RFC2821 4.5.1) to accept mail to postmaster.

bujarra.com’s postmaster response:<br /> >>> RCPT TO:<postmaster@bujarra.com><br /> <<< 550 No Such User Here <br />
WARN Acceptance of abuse address WARNING: One or more of your mailservers does not accept mail to abuse@bujarra.com. Mailservers are expected by RFC2142 to accept mail to abuse.

bujarra.com’s abuse response:<br /> >>> RCPT TO:<abuse@bujarra.com><br /> <<< 550 No Such User Here <br />
INFO Acceptance of domain literals WARNING: One or more of your mailservers does not accept mail in the domain literal format (user@[0.0.0.0]). Mailservers are technically required RFC1123 5.2.17 to accept mail to domain literals for any of its IP addresses. Not accepting domain literals can make it more difficult to test your mailserver, and can prevent you from receiving E-mail from people reporting problems with your mailserver. However, it is unlikely that any problems will occur if the domain literals are not accepted (mailservers at many common large domains have this problem).

bujarra.com’s postmaster@[74.220.207.184] response:<br /> >>> RCPT TO:<postmaster@[74.220.207.184]><br /> <<< 501 <postmaster@[74.220.207.184]>: domain literals not allowed <br />
PASS Open relay test OK: All of your mailservers appear to be closed to relaying. This is not a thorough check, you can get a thorough one here.

bujarra.com OK: 550-plum.dnsstuff.com (test.DNSreport.com) [174.133.202.226] is currently not 550-permitted to relay through this server. Perhaps you have not logged into 550-the pop/imap server in the last 30 minutes or do not have SMTP 550 Authentication turned on in your email client. <br />
PASS SPF record You have an SPF record. This is very good, as it will help prevent spammers from abusing your domain. Your SPF record (I don’t check to see if it is well designed!) is:

«v=spf1 a mx ptr include:hostmonster.com ?all» [TTL=14400]
WWW INFO WWW Record Your www.bujarra.com A record is:

www.bujarra.com. CNAME bujarra.com. [TTL=14400] bujarra.com. A 74.220.207.184 [TTL=14400] [US]
PASS All WWW IPs public OK. All of your WWW IPs appear to be public IPs. If there were any private IPs, they would not be reachable, causing problems reaching your web site.
PASS CNAME Lookup OK. You do have a CNAME record for www.bujarra.com, which can cause some confusion. However, this is legal. Your CNAME entry also returns the A record for the CNAME entry, which is good — otherwise, it would require an extra DNS lookup, which slightly delays the initial access to the website and use extra bandwidth. Note that if the CNAME points to another CNAME, it will likely cause problems.
INFO Domain A Lookup Your bujarra.com A record is:

bujarra.com. A 74.220.207.184 [TTL=14400]
Legend:

  • Rows with a FAIL indicate a problem that in most cases really should be fixed.
  • Rows with a WARN indicate a possible minor problem, which often is not worth pursuing.
  • Note that all information is accessed in real-time (except where noted), so this is the freshest information about your domain.
  • Note that automated usage is not tolerated without the purchase of an Automated Usage plan; please only view the DNS report directly with your web browser.
 










Posts recomendados:


                         
Héctor Herrero
 
Últimas entradas de Héctor Herrero (ver todo)