Editing 430.ch Reconnaissance Report (section)

== DNS Findings ==

=== Apex DNS ===

Observed DNS records:

<pre>
430.ch. A     83.228.241.21
430.ch. AAAA  2001:1600:18:102::167

430.ch. NS    ns11.infomaniak.ch.
430.ch. NS    ns12.infomaniak.ch.

430.ch. SOA   ns11.infomaniak.ch. hostmaster.infomaniak.ch. 2026070901 10800 3600 605800 3600

430.ch. MX 10 aspmx1.migadu.com.
430.ch. MX 20 aspmx2.migadu.com.

430.ch. TXT "v=spf1 include:spf.migadu.com -all"
430.ch. TXT "hosted-email-verify=rr8nx23r"
</pre>

DNSSEC material observed:

<pre>
430.ch. DNSKEY 257 3 13 jEm3bqIc72OUI4WxLeIbjruJjSEsc7+1+owlZ7nNA0TQQXM48U6QmFEC d5NBgwCpbw4CD/NO0Eb8CHYwjULKVg==
430.ch. DNSKEY 256 3 13 ytZkmQTTXPEwaXQAsxneIoPYayM4WAdxJ6rR2N411+PptsaPPyDSYSCw WzLI1lYAXdrPWBQ9yjgiBsskkPbBOQ==
430.ch. DS     7440 13 2 5A7F7CC05DE155C279B8F23093633694415BAABACA92F4B93D7C514C DB9F10B4
</pre>

=== Mail-Related DNS ===

Observed:

<pre>
_dmarc.430.ch TXT "v=DMARC1; p=quarantine;"
autoconfig.430.ch CNAME autoconfig.migadu.com.
autoconfig.migadu.com A    141.94.97.141
autoconfig.migadu.com AAAA 2001:41d0:403:488d::
</pre>

Not found:

* <code>_mta-sts.430.ch TXT</code>
* <code>_smtp._tls.430.ch TXT</code>
* <code>mta-sts.430.ch</code>
* <code>mail.430.ch</code>
* <code>smtp.430.ch</code>
* <code>imap.430.ch</code>
* <code>autodiscover.430.ch</code>
* <code>CAA</code> at the apex

Interpretation:

* SPF is strict because of <code>-all</code>.
* DMARC is present but not at the strictest enforcement level (<code>quarantine</code>, not <code>reject</code>).
* MTA-STS and TLS-RPT are not configured.
* No CAA means any publicly trusted CA can issue for the domain, subject to normal CA validation.

=== Zone Transfer ===

AXFR was attempted against both authoritative nameservers:

<pre>
dig AXFR 430.ch @ns11.infomaniak.ch
dig AXFR 430.ch @ns12.infomaniak.ch
</pre>

Result:

<pre>
Transfer failed.
</pre>

This is the desired behavior.