Fix guides
Every finding code whois.me.uk can raise, what it means and how to put it right.
Registry
- DOMAIN-EXPIREDThe domain registration has expired
- DOMAIN-EXPIRES-SOONThe domain expires within 30 days
- DOMAIN-NO-NAMESERVERSNo nameservers are delegated
- DOMAIN-NO-TRANSFER-LOCKTransfer lock is off
- DOMAIN-STATUS-CLIENTHOLDDomain status clientHold
- DOMAIN-STATUS-SERVERHOLDDomain status serverHold
- DOMAIN-STATUS-PENDINGDELETEDomain status pendingDelete
- DOMAIN-STATUS-REDEMPTIONPERIODDomain status redemptionPeriod
- DOMAIN-STATUS-INACTIVEDomain status inactive
- RDAP-UNAVAILABLEThe registry RDAP service did not answer
DNS
- DNS-NXDOMAINThe domain does not exist in DNS
- DNS-NO-NSNo NS records returned
- DNS-LAME-DELEGATIONA nameserver is not authoritative for the zone
- DNS-SERIAL-MISMATCHSOA serial differs between nameservers
- DNS-NS-SET-MISMATCHThe NS set inside the zone differs from the delegation
- DNS-SINGLE-NSOnly one nameserver is delegated
- DNS-APEX-CNAMECNAME at the zone apex
- DNS-SOA-REFRESHSOA refresh outside the recommended range
- DNS-SOA-EXPIRESOA expire is shorter than a week
- DNS-SOA-RNAMESOA responsible mailbox looks malformed
- DNS-NO-WWWwww does not resolve
- DNS-NO-MXNo MX records
- DNS-NO-CAANo CAA record
- DNSSEC-NOT-VALIDATEDDNSSEC records exist but validation fails
- DNSSEC-DS-WITHOUT-KEYDS published but no DNSKEY in the zone
- DNSSEC-UNSECURED-DELEGATIONDNSKEY present but no DS at the parent
- DNSSEC-OFFDNSSEC is not enabled
- DNS-AXFR-OPENA nameserver allows zone transfers to anyone
- DNS-NO-AAAANo IPv6 address for the domain
- DNS-NO-APEX-AThe bare domain has no address
- MX-MISSINGNo MX records for the domain
- MX-UNRESOLVABLEAn MX host does not resolve
- MX-NO-PTRMX host without reverse DNS
- MX-CNAME-TARGETMX target is a CNAME
- MX-IP-LITERALMX points at an IP address
- SMTP-CONNECT-FAILEDCould not connect to the mail server on port 25
- SMTP-NO-STARTTLSThe mail server does not offer STARTTLS
- SMTP-CERT-MISMATCHMail server certificate does not match the MX hostname
- SMTP-CERT-INVALIDMail server certificate does not verify
- SMTP-OLD-TLSMail server negotiates TLS 1.0 or 1.1
- SMTP-SLOW-GREETINGSlow SMTP greeting
- SPF-MISSINGNo SPF record
- SPF-MULTIPLEMore than one SPF record
- SPF-LOOKUPS-EXCEEDEDSPF exceeds the 10 DNS lookup limit
- SPF-LOOKUPS-NEAR-LIMITSPF is close to the lookup limit
- SPF-PLUS-ALLSPF ends with +all
- SPF-NEUTRAL-ALLSPF ends with ?all
- SPF-NO-ALLSPF has no all mechanism
- SPF-PTR-MECHANISMSPF uses the ptr mechanism
- SPF-SYNTAXSPF record has a syntax problem
- DKIM-NOT-DISCOVEREDNo DKIM key found under common selectors
- DKIM-WEAK-KEYDKIM key shorter than 1024 bits
- DKIM-1024DKIM key is 1024 bits
- DKIM-REVOKEDDKIM selector is revoked
- DMARC-MISSINGNo DMARC record
- DMARC-P-NONEDMARC policy is p=none
- DMARC-PCT-PARTIALDMARC applies to only part of your mail
- DMARC-NO-RUANo DMARC aggregate report address
- DMARC-RUA-UNAUTHORISEDExternal report address has not authorised your domain
- DMARC-SP-NONESubdomains are exempt from DMARC
- DMARC-MULTIPLEMultiple DMARC records
- DMARC-INVALIDDMARC record is malformed
- MTASTS-POLICY-UNREACHABLEMTA-STS policy file cannot be fetched
- MTASTS-MX-MISMATCHAn MX host is not listed in the MTA-STS policy
- SPOOF-EXPOSEDThe domain can be spoofed
- SPOOF-PARTIALSpoofing protection is monitoring only
- MX-NULLNull MX: the domain accepts no mail
- MX-NXDOMAINAn MX host does not exist
- MX-SINGLEOnly one mail server
- SMTP-PTR-NOT-CONFIRMEDReverse DNS for the mail server is missing or does not confirm forward
- SMTP-STARTTLS-FAILEDSTARTTLS is offered but the handshake fails
- SPF-SOFTFAIL-ALLSPF ends with ~all
- SPF-LONGSPF record longer than 255 characters
- DMARC-RPT-NONENo DMARC report could be read
- DMARC-RPT-ALIGNEDSome mail fails DMARC alignment
- DMARC-RPT-FAILING-SOURCESSources mostly failing DMARC
- DMARC-RPT-SPOOFINGSomeone is sending as your domain
Web
- WEB-NO-HTTPSNo working HTTPS
- WEB-HTTPS-ERRORHTTPS answers with an error status
- WEB-HTTP-NO-REDIRECTPlain HTTP does not redirect to HTTPS
- WEB-REDIRECT-LOOPRedirect loop
- WEB-SLOW-TTFBSlow time to first byte
- HSTS-MISSINGNo HTTP Strict Transport Security
- TLS-EXPIREDThe TLS certificate has expired
- TLS-EXPIRES-SOONThe TLS certificate expires soon
- TLS-NOT-TRUSTEDThe certificate chain does not verify
- TLS-HOSTNAME-MISMATCHThe certificate does not cover this hostname
- TLS-OLD-PROTOCOLSTLS 1.0 or 1.1 still accepted
- TLS-WEAK-KEYWeak certificate key
- TLS-HANDSHAKE-FAILEDTLS handshake failed
- TLS-SCORETLS configuration loses points
- TLS-SHA1Certificate signed with SHA-1
- WEB-REDIRECT-CHAIN-LONGToo many redirects before the final page
- WEB-UNRESOLVABLEThe host name does not resolve
Reputation
Other
- EMAIL-SYNTAXThe address is not well-formed
- EMAIL-DOMAIN-NXDOMAINThe address uses a domain that does not exist
- EMAIL-NULL-MXThe domain declares that it receives no mail
- EMAIL-NO-MXNo MX record for the domain
- EMAIL-NO-MAIL-SERVERNothing can receive mail for this domain
- EMAIL-DISPOSABLEDisposable (throwaway) mailbox provider
- EMAIL-CATCH-ALLThe domain accepts every address
- EMAIL-MAILBOX-REJECTEDThe mail server rejected this mailbox
- EMAIL-GREYLISTEDTemporary refusal (greylisting)
- EMAIL-SMTP-NO-ANSWERCould not talk SMTP to the mail server
- AI-ROBOTS-UNREADABLErobots.txt could not be read
- AI-LLMS-HTML/llms.txt returns HTML
- AI-LLMS-NO-TITLEllms.txt does not start with a title
- CT-STALE-NAMESOld host names in certificate logs no longer resolve
- LOOKALIKE-MXA lookalike domain can receive mail
- PORT-RISKY-OPENA database, cache or remote-desktop port is open to the internet
- PORT-FTP-OPENFTP is reachable
- PROP-INCONSISTENTResolvers disagree about this record
- PROP-NO-ANSWERSNo resolver returned an answer
- SEC-HEADERS-GRADESecurity headers below good practice
- CSP-MISSINGNo Content-Security-Policy
- XFO-MISSINGPages can be framed by other sites
- NOSNIFF-MISSINGBrowsers may guess content types
- SERVER-VERSION-EXPOSEDThe server advertises its software version
- COMPRESSION-OFFResponses are not compressed
- PING-LOSSPacket loss on ping
- HDR-HOP-DELAYA long delay at one hop
- HDR-TOTAL-DELAYThe message took a long time end to end
- HDR-NO-DKIM-SIGNATUREThe message carries no DKIM signature
- HDR-REPLYTO-DIFFERSReply-To points somewhere else
- HDR-FROM-RETURNPATH-MISMATCHFrom and Return-Path use different domains