Citibank Berhad

The domain has at least one IPv6 address (AAAA DNS record).

✗ No AAAA record found in DNS.

The IPv6 addresses are publicly routable — not link-local, ULA, loopback or documentation ranges.

✗ IPv6 address is not globally routable.

Website reachable on port 80 when connecting via IPv6.

✗ HTTP is not accessible over IPv6.

Website reachable on port 443 when connecting via IPv6.

✗ HTTPS is not accessible over IPv6.

Website responds when connected exclusively over IPv6, with no IPv4 fallback. Simulates what happens when IPv4 is turned off.

✗ Site is not reachable when limited to IPv6-only.

The SSL/TLS certificate is valid, not expired, and matches the domain when connected via IPv6.

✗ TLS certificate is invalid, expired, or hostname mismatch over IPv6.

The domain has both A and AAAA records for backwards compatibility during the IPv6 transition.

✗ Domain is IPv6-only or IPv4-only.

Server advertises HTTP/3 support via the Alt-Svc: h3 header.

✗ No HTTP/3 support detected.

At least one authoritative nameserver has an IPv6 address (AAAA record).

✗ No nameserver has an AAAA record.

Authoritative nameserver accepts TCP connections on port 53 over IPv6.

✗ No nameserver is reachable over IPv6.

Nameserver actually resolves DNS queries when asked over IPv6 — not just TCP open, but functionally answering.

✗ Nameserver does not answer queries over IPv6.

Full DNSSEC chain-of-trust validation passes. Prevents DNS cache poisoning and spoofing.

✗ DNSSEC validation failed or zone is unsigned.

A PTR record exists in ip6.arpa for the IPv6 address. Important for email delivery and network diagnostics.

✗ No PTR record found.

Delegation Signer record exists in the parent zone.

✗ No DS record at parent.

RRSIG signatures are present and not expired.

✗ No valid RRSIG found.

The cryptographic algorithm used for DNSSEC signing.

No DNSKEY record found.

The highest-priority MX server resolves to an IPv6 address (AAAA record).

✗ MX server has no IPv6 address.

The MX server accepts SMTP connections (port 25) over IPv6 and responds with a 220 banner.

✗ SMTP is not reachable over IPv6.

The MX server supports STARTTLS encryption when connected over IPv6.

✗ STARTTLS not available over IPv6.

A DKIM public key is published at a common selector, enabling email signature verification.

No common DKIM selector found.