Report for cloudflare.com
Generated 2026-07-14 06:02:44 EDT · 33 checks performed · Parent queried: c.gtld-servers.net (192.26.92.30)
82%
Health Score 0 errors · 5 warnings
✔ 26 Passed
⚠ 5 Warnings
✖ 0 Errors
ℹ 2 Info
Parent Zone Delegation
Status Check Details & Recommendation
INFO
Parent NS Delegation
Queried via: c.gtld-servers.net (192.26.92.30)
Delegated NS: ns3.cloudflare.com, ns5.cloudflare.com, ns4.cloudflare.com, ns6.cloudflare.com, ns7.cloudflare.com
These are the NS records published in the parent (TLD) zone — what the global internet sees when resolving your domain for the first time.
OK
Parent Glue Records
ns3.cloudflare.com → 162.159.0.33, 162.159.7.226 | ns5.cloudflare.com → 162.159.2.9, 162.159.9.55 | ns4.cloudflare.com → 162.159.1.33, 162.159.8.55 | ns6.cloudflare.com → 162.159.3.11, 162.159.5.6 | ns7.cloudflare.com → 162.159.4.8, 162.159.6.6
Glue records are A records published alongside NS records in the parent zone. They are required when a nameserver hostname falls within the delegated domain itself (e.g. ns1.example.com for example.com).
Nameserver Configuration
Status Check Details & Recommendation
OK
NS Records (Authoritative)
5 NS record(s): ns6.cloudflare.com, ns7.cloudflare.com, ns3.cloudflare.com, ns4.cloudflare.com, ns5.cloudflare.com
These are the NS records as returned by the authoritative nameservers themselves.
OK
NS Parent/Auth Consistency
Parent zone and authoritative zone agree on nameservers.
Consistency is required for reliable DNS resolution worldwide.
OK
NS Redundancy
5 nameservers — redundancy is satisfied.
Multiple nameservers ensure queries are answered even if one server is offline.
OK
NS A Records
ns6.cloudflare.com → 162.159.5.6, 162.159.3.11 | ns7.cloudflare.com → 162.159.4.8, 162.159.6.6 | ns3.cloudflare.com → 162.159.7.226, 162.159.0.33 | ns4.cloudflare.com → 162.159.8.55, 162.159.1.33 | ns5.cloudflare.com → 162.159.9.55, 162.159.2.9
Each nameserver resolves to a valid IP address.
WARN
NS Network Diversity
All nameservers appear to share the same /16 subnet (162.159.*). Consider using nameservers on separate networks.
Nameservers on the same network segment can all go offline together in a network outage.
Zone / SOA
Status Check Details & Recommendation
OK
SOA Record
Primary NS: ns3.cloudflare.com | Hostmaster: dns.cloudflare.com | Serial: 2409440624
SOA record defines the zone's primary server, admin contact, and replication timers.
OK
SOA Serial
Serial 2409440624 uses YYYYMMDDNN format — good.
Date-based serials make zone history easy to track.
OK
SOA Refresh
Refresh: 10000s — OK.
Secondaries poll for updates at this interval.
OK
SOA Retry
Retry: 2400s — OK.
Retry interval after failed refresh.
OK
SOA Expire
Expire: 604800s — OK.
Secondaries discard stale data after this time.
OK
SOA Negative TTL
Negative TTL: 300s — OK.
Negative caching TTL (NXDOMAIN) per RFC 2308.
DNS Address Records
Status Check Details & Recommendation
OK
A Records
IPv4: 104.16.132.229, 104.16.133.229
A records map your domain to your web server's IPv4 address(es).
OK
AAAA Records
IPv6: 2606:4700::6810:85e5, 2606:4700::6810:84e5
AAAA records provide IPv6 connectivity.
OK
WWW Record
www.cloudflare.com → 104.16.123.96, 104.16.124.96
www subdomain resolves correctly.
Mail Server (MX)
Status Check Details & Recommendation
OK
MX Records
4 MX record(s): pri=5 mxb-canary.global.inbound.cf-emailsecurity.net, pri=5 mxa-canary.global.inbound.cf-emailsecurity.net, pri=10 mxa.global.inbound.cf-emailsecurity.net, pri=10 mxb.global.inbound.cf-emailsecurity.net
MX records list mail servers in priority order (lowest number = highest priority).
OK
MX A Record
mxb-canary.global.inbound.cf-emailsecurity.net → 172.65.65.66
MX host resolves to a valid IP address.
OK
MX A Record
mxa-canary.global.inbound.cf-emailsecurity.net → 172.65.65.66
MX host resolves to a valid IP address.
OK
MX A Record
mxa.global.inbound.cf-emailsecurity.net → 172.65.64.78
MX host resolves to a valid IP address.
OK
MX A Record
mxb.global.inbound.cf-emailsecurity.net → 172.65.64.78
MX host resolves to a valid IP address.
WARN
MX Reverse DNS (PTR)
No PTR record for 172.65.65.66.
Missing PTR records on mail server IPs are a leading cause of email deliverability issues. Ask your IP provider to configure one.
WARN
MX Reverse DNS (PTR)
No PTR record for 172.65.65.66.
Missing PTR records on mail server IPs are a leading cause of email deliverability issues. Ask your IP provider to configure one.
WARN
MX Reverse DNS (PTR)
No PTR record for 172.65.64.78.
Missing PTR records on mail server IPs are a leading cause of email deliverability issues. Ask your IP provider to configure one.
WARN
MX Reverse DNS (PTR)
No PTR record for 172.65.64.78.
Missing PTR records on mail server IPs are a leading cause of email deliverability issues. Ask your IP provider to configure one.
OK
MX Redundancy
4 MX records — mail delivery has redundancy.
Multiple MX records ensure email is queued and delivered even if the primary server is down.
Email Authentication
Status Check Details & Recommendation
OK
SPF Record
v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all
SPF record is present. Receiving servers will validate your outgoing email against this policy.
OK
SPF Policy
Policy: -all (hardfail) — unauthorized senders are rejected.
-all provides the strongest SPF enforcement.
OK
DMARC Record
v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; pct=100; rua=mailto:[email protected],mailto:[email protected]
DMARC policy is published.
OK
DMARC Policy
Policy: reject — failing emails are blocked.
Maximum protection. Recommended for mature mail setups.
OK
DKIM Record
Selector 'k1': k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06X…
DKIM (RFC 6376) adds a cryptographic signature to outgoing mail, proving it was sent by an authorised server and was not altered in transit.
Other Records
Status Check Details & Recommendation
OK
CAA Records
0 issuewild "pki.goog; cansignhttpexchanges=yes" | 0 issuewild "ssl.com" | 0 iodef "mailto:[email protected]" | 0 issue "comodoca.com" | 0 issue "digicert.com; cansignhttpexchanges=yes" | 0 issue "letsencrypt.org" | 0 issue "pki.goog; cansignhttpexchanges=yes" | 0 issue "ssl.com" | 0 issuewild "comodoca.com" | 0 issuewild "digicert.com; cansignhttpexchanges=yes" | 0 issuewild "letsencrypt.org"
CAA records restrict SSL certificate issuance to the listed certificate authorities.
INFO
Other TXT Records
stripe-verification=5096d01ff2cf194285dd51cae18f24fa9c26dc928cebac3636d462b4c6925623
stripe-verification=bf1a94e6b16ace2502a4a7fff574a25c8a45291054960c883c59be39d1788db9
uber-domain-verification=58086039-150a-42a4-a4be-b4032921aa0f
MS=ms70274184
ZOOM_verify_7LFBvOO9SIigypFG2xRlMA
_neqmkgaq1lq9it5s8qmetrhbnu121wb
Additional TXT records for domain ownership verification (Google Search Console, Microsoft 365, etc.) and other services.