* DNS Report will tell you what you need to know about your DNS servers
Surrounding your Web applications is (hopefully) a robust infrastructure of supporting services. One of the most crucial to your Web apps are your DNS servers.
Now you may think you know all about DNS but there’s a service that is likely to prove you wrong: DNS Report, which appears to be the work on one R. Scott Perry.
To get a DNS report you go to the site, enter a domain name (IP addresses aren’t allowed) in the DNS Report field, and click the button. Wow. The report goes to a depth of analysis and recommendation that I have never seen before – this guy really knows his stuff!
The report is broken down into the categories Parent, NS (Name Server), SOA (Start of Authority), MX (Mail Exchanger), Mail, and WWW.
Under the each category next comes the status of each test (PASS, INFO, WARN, or FAIL) and the name of each test followed by a detailed explanation. For example using my own domain name under Parent the test “Missing Direct Parent check” is a PASS and the explanation is “OK. Your direct parent zone exists, which is good. Some domains (usually third or fourth level domains, such as example.co.us) do not have a direct parent zone (‘co.us’ in this example), which is legal but can cause confusion.”
My first surprise was in the NS category. I use easycgi.com (part of Tucows) for my Web hosting and domain management and the test “Open DNS Servers” was reported as FAIL with the comment: “ERROR: One or more of your nameservers reports that it is an open DNS server. This usually means that anyone in the world can query it for domains it is not authoritative for (it is possible that the DNS server advertises that it does recursive lookups when it does not, but that shouldn’t happen). This can cause an excessive load on your DNS server. Also, it is strongly discouraged to have a DNS server be both authoritative for your domain and be recursive (even if it is not open), due to the potential for cache poisoning (with no recursion, there is no cache, and it is impossible to poison it). Also, the bad guys could use your DNS server as part of an attack, by forging their IP address.”
The comments then list the problem records, provides links to tests, as well as another link to information on how to close open DNS servers.
Even tests that generate a WARN status are tremendously detailed. My domain’s SOA REFRESH value test warned that “WARNING: Your SOA REFRESH interval is: 900 seconds. This seems low. You should consider increasing this value to about 3600-7200 seconds. RFC1912 2.2 recommends a value between 1200 to 43200 seconds (20 minutes to 12 hours). A value that is too low will unnecessarily increase Internet traffic.”
Remarkably this service is free. The site recommends its own dnsmadeeasy.com for DNS hosting. Dnsmadeeasy.com offers yet another free service DNS Stuff, a suite of DNS, IP, hostname, and miscellaneous networking tests that are also invaluable.
