What is checked
Nameservers are queried directly only when their addresses are public.
- Nameservers: at least two, each with a public address, on different networks, answering for the zone with the same serial.
- SOA timers against the ranges in RFC 1912.
- The apex and www resolve, over IPv4 and IPv6, with no CNAME at the apex.
- MX, SPF and DMARC.
- CAA and DNSSEC.
Questions
- Is a warning always a problem?
- No. Some warnings are choices: one /24 for all nameservers is fine for large anycast providers, and a short SOA expire suits some setups.