Domain report: adesso.de

Registration

info

.de country-code

Found

TLD: .de (country-code)
ICANN policies apply: no

Checks

i

.de is a country-code TLD (ccTLD)

Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.

#1
✓ TLD delegated and signed #2

.de is delegated in the root zone and DNSSEC-signed.
i

Registration data not available

No registration data via RDAP: the registry of .de offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.

#3

Delegation

info

ns01.adesso-group.com, ns02.adesso-group.com, ns1.domaindiscount24.net

Found

Parent zone: de
Delegation from: a.nic.de (194.0.0.53)
NS at the parent: ns01.adesso-group.com, ns02.adesso-group.com, ns1.domaindiscount24.net
NS in the zone: ns01.adesso-group.com, ns02.adesso-group.com, ns1.domaindiscount24.net

Nameserver	Addresses	Network (AS)	Glue
ns01.adesso-group.com	85.22.68.3	AS15763 ASDOKOM - DOKOM Gesellschaft fuer Telekommunikation mbH, DE	-
ns02.adesso-group.com	85.22.68.67	AS15763 ASDOKOM - DOKOM Gesellschaft fuer Telekommunikation mbH, DE	-
ns1.domaindiscount24.net	193.227.117.34 2a04:2b00:14cc::34	AS1921 RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT AS1921 RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT	-

Checks

✓ 3 nameservers #6

Delegated to ns01.adesso-group.com, ns02.adesso-group.com, ns1.domaindiscount24.net.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 2 IPv4 /24s and 1 IPv6 /48.
✓ 2 autonomous systems #11

The nameservers are spread over: AS15763 (ASDOKOM - DOKOM Gesellschaft fuer Telekommunikation mbH, DE): 2 addresses; AS1921 (RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT): 2 addresses.
✓ Nameserver names under 2 TLDs #12

Nameserver names use the TLDs .com, .net.
i

Partly IPv6

These nameservers have no IPv6 address: ns01.adesso-group.com, ns02.adesso-group.com.

#13

Nameservers

info

4 of 4 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
ns01.adesso-group.com 85.22.68.3	NOERROR, 10 ms, authoritative	no	yes / yes	refused	There Is No Dana Only Zuul
ns02.adesso-group.com 85.22.68.67	NOERROR, 11 ms, authoritative	no	yes / yes	refused	There Is No Dana Only Zuul
ns1.domaindiscount24.net 193.227.117.34	NOERROR, 4 ms, authoritative	no	yes / yes	refused	RcodeZero DNS
ns1.domaindiscount24.net 2a04:2b00:14cc::34	NOERROR, 4 ms, authoritative	no	yes / yes	refused	RcodeZero DNS

Checks

✓ All respond #14

All 4 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
i

Identifying string disclosed

These nameservers answer version queries with a string that is not a version number: ns01.adesso-group.com: "There Is No Dana Only Zuul"; ns02.adesso-group.com: "There Is No Dana Only Zuul"; ns1.domaindiscount24.net: "RcodeZero DNS".

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

info

serial 2026102102 · primary ns-main.adesso-group.com

Found

Primary (MNAME): ns-main.adesso-group.com
Contact (RNAME): hostmaster.adesso-group.com
Serial: 2026102102
Refresh / retry: 10800 s / 3600 s
Expire: 604800 s
Negative TTL: 3600 s

Serial per nameserver

Nameserver	Serial
ns01.adesso-group.com (85.22.68.3)	2026102102
ns02.adesso-group.com (85.22.68.67)	2026102102
ns1.domaindiscount24.net (193.227.117.34)	2026102102
ns1.domaindiscount24.net (2a04:2b00:14cc::34)	2026102102

Checks

✓ Serial 2026102102 everywhere #22

All nameservers serve the same version of the zone.
✓ Timers within recommendations #23

SOA refresh 3h, retry 1h, expire 7d, negative TTL 1h.
i

Hidden master

The primary nameserver ns-main.adesso-group.com is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.

#24
✓ Contact hostmaster@adesso-group.com #25

The SOA RNAME hostmaster.adesso-group.com means hostmaster@adesso-group.com.
✓ Date-based serial #26

The serial 2026102102 follows the YYYYMMDDnn convention (2026-10-21).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

warn

42 records at the apex

Found

Read from: 85.22.68.3:53

Type	Value	TTL
SOA	ns-main.adesso-group.com. hostmaster.adesso-group.com. 2026102102 10800 3600 604800 3600	3600
NS	ns01.adesso-group.com.	3600
NS	ns02.adesso-group.com.	3600
NS	ns1.domaindiscount24.net.	3600
A	85.22.68.136	60
MX	10 mxa-0060b402.gslb.pphosted.com.	60
MX	10 mxb-0060b402.gslb.pphosted.com.	60
TXT	"MS=ms52226151"	60
TXT	"insomnia-validation=5a6388cad0674f8fb00b9961ec807f9971bf36b05f4d54a0abfcbabee363b9b5"	60
TXT	"atlassian-domain-verification=JgsPkCfs0K6LYQ9GEZBJiX564oNaudBJK8GPtleMHCLNPVocXZNdTaktfm5tc6KU"	60
TXT	"google-site-verification=5j6-hmgeVvEyxpu-aYadtV6pal7wcBlqtlQ9cMxoY5M"	60
TXT	"b3ghk0x872pthyr69zwb52nr0lx2jqwj"	60
TXT	"miro-verification=04786608ed6117918b7aa0f789ea2c349dc0d47c"	60
TXT	"google-site-verification=eW2KWrU15tcRNq1TkYtWv2oTs_4oPf7eAxznLeh_Twg"	60
TXT	"TAILSCALE-OjBwKRahpcBP9qDIE9kr"	60
TXT	"1password-site-verification=P4ZPYDEJFNAGNJFEVVJHL66RQQ"	60
TXT	"docker-verification=ee13283b-9ee9-4da7-842d-070b63266f1e"	60
TXT	"docusign=722fd6a5-7831-41e0-9b6d-fb6ee5b9e7a4"	60
TXT	"krqk67twr0x7mkdg55y8zpqx8zrt0pnv"	60
TXT	"apple-domain-verification=fBgCPE7y7t1pH4en"	60
TXT	"docusign=c1271954-001b-48db-9a70-b0bda7d46ec4"	60
TXT	"jamf-site-verification=MXnrV5wFGy9elLkSt1BfjQ"	60
TXT	"tsckdx1dz0hqwlgbccwzff5m2v7m3xvx"	60
TXT	"d365mktkey=MDhTyEXlSYVlegAzzxxaZM5HEC2XjaPeAauXjNtxhi4x"	60
TXT	"mentimeter-fe192ade-655b-4cca-b01c-d7e66b15aa09"	60
TXT	"y2hl8j8ppsvh68ngzly6jwqxmdhrr910"	60
TXT	"bdww3tg0g2b70svhyjtsx6071kjgdxr7"	60
TXT	"d365mktkey=F6NSuMPpLSS66t6v5UznzE8XyW8x4jB0rCMEWSx8D5Ux"	60
TXT	"brevo-code:e5d26db517fb0a9cc49b34b804c07d6c"	60
TXT	"cisco-ci-domain-verification=6cf3003c6d5efbfa292ce6152a9c0f0abc52bcb487e227cbb9968b568c012260"	60
TXT	"d365mktkey=nCFR5lTA0nzVoM9vFVuj0Nhdz2ryWx7GUj1isC9V3D0x"	60
TXT	"anthropic-domain-verification-y403yf=6OxXwS1873Zyqy572xlf6Tykp"	60
TXT	"ZlVSC4xsRR7hPgpHUOxfthmg17Rc1IVGxRtg9CW9A34C2+WCGJqvB4hQKKAnSAOTDaq3OD6oxPMApABjI6tsCQ=="	60
TXT	"v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com -all"	60
TXT	"google-site-verification=lVvAF3wUqx7FUbkwO8hbz91WU6l3f9DbeqT0ELWHSu0"	60
TXT	"ms-domain-verification=210c93da-57aa-404e-918b-5ec430df23ef"	60
TXT	"atlassian-sending-domain-verification=eb3a64cc-da78-415f-9732-07d386f94642"	60
TXT	"vmd9ywjxbp8pr7sq8l7q2vh6kpvxxw0y"	60
TXT	"RBWhOHmjgQbhT7+vTYbMnlQWEzvYcdbsPkAshC11bAlQo6vCCav8REDyzM2Toybb8Rof6oWM5JJnpY9ExaMhOA=="	60
TXT	"teamviewer-sso-verification=bd24d2d919354a829d41d2b282e47224"	60
TXT	"wrike-verification=MjIwNjE5MzoxOWM4ZGNmN2MzYTMwYTI3YzNlMDAxYjdlOTllZjJlOGUxYzVlNTgwNjhiZTQ3YjQ2ZjE5YTczOGJhNTk3MWQw"	60
TXT	"parallels-domain-verification=904674d67ae54691b8c6aed05f078a9c4e9aa2280eb747f3a679892c655e1b95"	60

Checks

!

Very low TTLs

These records have a TTL below 5m, causing extra queries and slower lookups: A (1m), MX (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 1d and in the zone 1h; resolvers may use either.

#32
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35