Skip to main content
DNS Tool
Engineer's DNS Intelligence Report
Generated 19 Apr 2026, 02:47 UTC
Duration 2.2s
Version v26.46.20
Integrity cf68a1910789be68cde7f11de91c7bf40a4c86d31ccf6db6b7ac85f26c9488d20f25cc8e490a7ce8c940d8e4026975a464b7001cf3f857e050adea89e59dd388
Subject Domain
swutch.com

Engineer's DNS Intelligence Report

swutch.com
19 Apr 2026, 02:47 UTC · 2.2s ·v26.46.20 · SHA-3-512: cf68✱✱✱✱ Verify ·Archived ·Cross-Referenced
Executive Topology
Recon Mode Snapshot Re-analyze New Domain
DNS Security & Trust Posture Risk Level: High Risk
Confidence: MODERATE · 71/100
2 protocols configured, 7 not configured Why we go beyond letter grades
What’s Wrong Publish a DMARC record starting with p=none and rua reporting
Jump To: DMARC MTA-STS TLS-RPT BIMI DANE DNSSEC CAA
Email Spoofing
Partial
Brand Impersonation
Not Setup
DNS Tampering
Unsigned
Certificate Control
Open
Recommended
Publish a DMARC record starting with p=none and rua reporting
Configured
SPF (hard fail), DKIM (not applicable — no-mail domain)
Not Configured
DMARC, MTA-STS, TLS-RPT, BIMI, DANE, DNSSEC, CAA
Priority Actions Achievable posture: Low Risk
High Add DMARC Reject for Null MX Domain

This domain publishes a Null MX record (RFC 7505) but lacks a DMARC reject policy. Without it, attackers can still spoof email from this domain. Complete the no-mail hardening with a strict DMARC reject policy.

Instructs receiving servers to reject all email from this null MX domain — no legitimate mail is expected.
TypeTXT
Host_dmarc.swutch.com
Valuev=DMARC1; p=reject; sp=reject; adkim=s; aspf=s;
RFC 7489
Medium Enable DNSSEC

DNSSEC is not enabled for this domain. DNSSEC provides cryptographic authentication of DNS responses, preventing cache poisoning and DNS spoofing attacks.

RFC 4035
Low Add CAA Records

CAA records specify which Certificate Authorities may issue certificates for your domain, reducing the risk of unauthorized certificate issuance.

CAA constrains which CAs can issue certificates for this domain.
TypeCAA
Hostswutch.com (root of domain — adjust CA to match your provider)
Value0 issue "letsencrypt.org"
RFC 8659
Open Remediation Workspace — Copy-Paste Ready Records
Registrar (RDAP) OBSERVED LIVE
HANGANG Systems, Inc. dba Doregi.com
Where domain was purchased
Email Service Provider
No Mail Domain
No-Mail Domain — Incomplete Hardening
Web Hosting
Unknown
Where website is hosted
DNS Hosting
Unknown
Where DNS records are edited
Footprint
Email Security Methodology Can this domain be impersonated by email? No null MX indicates no-mail domain
No-Mail Domain — Incomplete Hardening 2/3 controls
This domain publishes a Null MX record (RFC 7505) declaring it does not accept email, but is missing additional hardening controls needed to fully prevent spoofing.
DMARC reject (RFC 7489) Null MX (RFC 7505) SPF -all (RFC 7208)
Missing steps to complete no-mail hardening:
DMARC Policy — Publish a DMARC record (RFC 7489)
No spoofing protection policy

SPF Record RFC 7208 §4 Gold

Does this domain declare who may send email on its behalf? Yes
������� -all

Valid SPF (no mail allowed) - domain declares it sends no email

v=spf1 -all
RFC 7208 Conformant — This SPF record conforms to the syntax and semantics defined in RFC 7208 §4.
RFC Failure Mode: Unlike DMARC (where unknown tags are silently ignored per RFC 7489 §6.3), SPF with unrecognized mechanisms produces a PermError per RFC 7208 §4.6 — the record fails loudly rather than silently.
Related CVEs: CVE-2024-7208 (multi-tenant domain spoofing), CVE-2024-7209 (shared SPF exploitation), CVE-2023-51764 (SMTP smuggling bypasses SPF)

DMARC Policy RFC 7489 §6.3 Gold

Are spoofed emails rejected or quarantined? No policy published
Error

No valid DMARC record found

No forensic reporting (ruf) tag — this is correct. The absence of ruf= is not a gap. RFC 7489 §7.3 warns that forensic reports can expose PII (full message headers or bodies). Google, Microsoft, and Yahoo do not honour ruf= requests regardless. The DMARCbis draft (draft-ietf-dmarc-dmarcbis) has formally removed ruf= from the specification, confirming its deprecation. Omitting ruf= is the recommended modern practice. RFC 7489 §7.3 — Forensic Reports
RFC 7489 Present — DMARC record published per RFC 7489 §6.3.
DMARCbis (Pending): draft-ietf-dmarc-dmarcbis will elevate DMARC to Standards Track, obsolete RFC 7489, replace pct= with t= (testing flag), add np= (non-existent subdomain policy), and mandate DNS tree walk for policy discovery instead of the Public Suffix List.
Related CVEs: CVE-2024-49040 (Exchange sender spoofing), CVE-2024-7208 (multi-tenant DMARC bypass)

DKIM Records RFC 6376 §3.6 Gold

Are outbound emails cryptographically signed? Not discoverable
Not Discoverable

DKIM not discoverable via common selectors (large providers use rotating selectors)

DKIM key management delegated — _domainkey.swutch.com NS records point to an external service (ns1.afternic.com, ns2.afternic.com). DKIM selectors are dynamically managed and may include keys for services beyond what static scanning discovers.
RFC 6376 (Provider-Managed) — DKIM signing managed by the detected mail provider per RFC 6376.
Known Vulnerabilities: DKIM l= tag body length vulnerability (attacker appends unsigned content to signed mail), weak key exploitation (keys below 1024-bit are cryptographically breakable per RFC 6376 §3.3.3), DKIM replay attacks (re-sending legitimately signed messages at scale)

MTA-STS RFC 8461 §3 Gold

Can attackers downgrade SMTP to intercept mail? Not prevented
Warning

No valid MTA-STS record found

MTA-STS policy enforcement is evaluated in Mail Transport Security below.

TLS-RPT RFC 8460 §3 Gold

Will failures in TLS delivery be reported? No reporting
Warning

No valid TLS-RPT record found

Resolver agreement is inconsistent for some protocols, limiting confidence. Data currency and system maturity are adequate.
Accuracy 60% Currency 85/100 Maturity consistent
Limiting factor: Resolver agreement is low for this scan — some protocols returned inconsistent results across resolvers
Currentness Excellent TTL Compliance Excellent Completeness Degraded Source Credibility Excellent TTL Relevance Excellent
ICuAE Details
DNS data is mostly current with minor gaps — good intelligence currency

The following DNS record TTLs deviate from recommended values. Incorrect TTLs can cause caching issues, slow propagation, or unnecessary DNS traffic.

Record Type Observed TTL Typical TTL Severity Context
NS 6 hours (21600s) 1 day (86400s) medium NS TTL is below typical — observed 6 hours (21600s), typical value is 1 day (86400s). Short TTLs increase DNS query volume but enable faster propagation. If you are preparing for a migration or need rapid failover, this may be intentional (RFC 1035 §3.2.1). For steady-state production, consider 86400 seconds per NIST SP 800-53 SI-7 relevance guidance. Use the TTL Tuner for profile-specific recommendations.

Big Picture Questions

  • How often do you actually change this record? If it hasn’t changed in months, a short TTL is generating unnecessary DNS queries without any benefit.
  • Are you preparing for a migration or IP change? Short TTLs make sense temporarily — but should be raised back to 1 hour (3600s) once the change is complete.
  • Every DNS lookup adds 20–150ms of latency. With a 60s TTL, returning visitors trigger a fresh lookup every minute. With 3600s, they get cached responses for an hour — faster page loads, no extra infrastructure needed.
  • Google runs A records at ~30s because they operate a global anycast network and need to steer traffic dynamically. For a typical website without that infrastructure, copying those TTLs increases query volume with zero upside.
Tune TTL for swutch.com
Reference: NIST SP 800-53 SI-7 (Information Integrity) · RFC 8767 (Serve Stale) · RFC 1035 §3.2.1 (TTL semantics) Note: Some DNS providers (e.g., AWS Route 53 alias records, Cloudflare proxied records) enforce fixed TTLs that cannot be modified. If a finding targets a record you cannot edit, it reflects the observed value rather than a configuration error on your part.
Primary NS ns2.afternic.com
Serial 1
Admin dns.jomax.net
Provider Unknown
Timer Value RFC 1912 Range
Refresh28800s1,200–43,200s (20 min – 12 hrs)
Retry7200sFraction of Refresh
Expire604800s1,209,600–2,419,200s (14–28 days)
Minimum (Neg. Cache)86400s300–86,400s (5 min – 1 day)
Expire: SOA Expire is 7 days (604800s). RFC 1912 §2.2 recommends 1,209,600–2,419,200 seconds (14–28 days). If the primary nameserver becomes unreachable, secondary nameservers will stop serving this zone after only 7 days (604800s).
RFC 1912 §2.2
Suggested Scanner Configuration