Domain report: alkmaar.nl

Registration

info

.nl country-code · Realtime Register

Found

TLD: .nl (country-code)
ICANN policies apply: no
Registrar: Realtime Register
Registered: 28 August 1995
Last changed: 13 January 2025
Status: active
Registry nameservers: anycast-eu.dns.sqr.nl, anycast-global.dns.sqr.cloud, unicast-eu.dns.sqr.domains
RDAP server: https://rdap.sidn.nl/

Checks

i

.nl is a country-code TLD (ccTLD)

Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.

#1
✓ TLD delegated and signed #2

.nl is delegated in the root zone and DNSSEC-signed.
i

Expiry date not published

The registry does not publish the expiry date in RDAP. Check it with your registrar.

#3
i

No transfer lock

The domain has no transfer lock (status: active). A registrar lock protects against unauthorized transfers.

#4
✓ Registry and delegation match #5

The nameservers registered at the registry are the ones published in DNS.

Delegation

pass

anycast-eu.dns.sqr.nl, anycast-global.dns.sqr.cloud, unicast-eu.dns.sqr.domains

Found

Parent zone: nl
Delegation from: ns1.dns.nl (194.0.28.53)
NS at the parent: anycast-eu.dns.sqr.nl, anycast-global.dns.sqr.cloud, unicast-eu.dns.sqr.domains
NS in the zone: anycast-eu.dns.sqr.nl, anycast-global.dns.sqr.cloud, unicast-eu.dns.sqr.domains

Nameserver	Addresses	Network (AS)	Glue
anycast-eu.dns.sqr.nl	194.58.196.57 2a01:3f1:857::53	AS8674 NETNOD-IX - Netnod AB, SE AS8674 NETNOD-IX - Netnod AB, SE	-
anycast-global.dns.sqr.cloud	194.58.198.57 2a01:3f1:3057::53	AS56908 NETNOD-NDS - Netnod AB, SE AS56908 NETNOD-NDS - Netnod AB, SE	-
unicast-eu.dns.sqr.domains	185.42.137.109 2a01:3f0:400::57	AS8674 NETNOD-IX - Netnod AB, SE AS8674 NETNOD-IX - Netnod AB, SE	-

Checks

✓ 3 nameservers #6

Delegated to anycast-eu.dns.sqr.nl, anycast-global.dns.sqr.cloud, unicast-eu.dns.sqr.domains.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 3 IPv4 /24s and 3 IPv6 /48s.
✓ 2 autonomous systems #11

The nameservers are spread over: AS56908 (NETNOD-NDS - Netnod AB, SE): 2 addresses; AS8674 (NETNOD-IX - Netnod AB, SE): 4 addresses.
✓ Nameserver names under 3 TLDs #12

Nameserver names use the TLDs .cloud, .domains, .nl.
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

Nameservers

pass

6 of 6 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
anycast-eu.dns.sqr.nl 194.58.196.57	NOERROR, 9 ms, authoritative	no	yes / yes	refused	-
anycast-eu.dns.sqr.nl 2a01:3f1:857::53	NOERROR, 9 ms, authoritative	no	yes / yes	refused	-
anycast-global.dns.sqr.cloud 194.58.198.57	NOERROR, 9 ms, authoritative	no	yes / yes	refused	-
anycast-global.dns.sqr.cloud 2a01:3f1:3057::53	NOERROR, 10 ms, authoritative	no	yes / yes	refused	-
unicast-eu.dns.sqr.domains 185.42.137.109	NOERROR, 28 ms, authoritative	no	yes / yes	refused	-
unicast-eu.dns.sqr.domains 2a01:3f0:400::57	NOERROR, 25 ms, authoritative	no	yes / yes	refused	-

Checks

✓ All respond #14

All 6 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
✓ No version disclosed #17

The nameservers don't reveal their software version.
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

info

serial 2026101501 · primary ns1.sqr.nl

Found

Primary (MNAME): ns1.sqr.nl
Contact (RNAME): hostmaster.alkmaar.nl
Serial: 2026101501
Refresh / retry: 16384 s / 2048 s
Expire: 1048576 s
Negative TTL: 300 s

Serial per nameserver

Nameserver	Serial
anycast-eu.dns.sqr.nl (194.58.196.57)	2026101501
anycast-eu.dns.sqr.nl (2a01:3f1:857::53)	2026101501
anycast-global.dns.sqr.cloud (194.58.198.57)	2026101501
anycast-global.dns.sqr.cloud (2a01:3f1:3057::53)	2026101501
unicast-eu.dns.sqr.domains (185.42.137.109)	2026101501
unicast-eu.dns.sqr.domains (2a01:3f0:400::57)	2026101501

Checks

✓ Serial 2026101501 everywhere #22

All nameservers serve the same version of the zone.
✓ Timers within recommendations #23

SOA refresh 4h33m4s, retry 34m8s, expire 291h16m16s, negative TTL 5m.
i

Hidden master

The primary nameserver ns1.sqr.nl is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.

#24
✓ Contact hostmaster@alkmaar.nl #25

The SOA RNAME hostmaster.alkmaar.nl means hostmaster@alkmaar.nl.
✓ Date-based serial #26

The serial 2026101501 follows the YYYYMMDDnn convention (2026-10-15).

DNSSEC

info

Signed, DS published at parent

Found

Validated by resolver: yes
Denial of existence: NSEC
Signatures valid until: 29 October 2026

DS at the parent

Key tag	Algorithm	Digest	Matches a key
36311	ECDSAP256SHA256 (13)	SHA256 A11537E382241FE9…	yes

DNSKEY in the zone

Key tag	Role	Algorithm
36311	KSK (257)	ECDSAP256SHA256 (13)

Checks

✓ Signed and validated #27

The zone is signed, the parent publishes a DS record, and the resolver validates the answers.
✓ DS matches a key #28

The DS record at the parent matches a key in the zone: key tag 36311 (SHA256).
✓ Modern algorithms #29

Key algorithms: ECDSAP256SHA256 (13).
✓ Signatures valid until 2026-10-29 #30

The earliest DNSKEY/SOA signature expires at 2026-10-29 00:00 UTC.
i

NSEC

The zone uses NSEC, so its full contents can be listed by walking the NSEC chain. That is fine unless the names are sensitive.

#31

Records

warn

47 records at the apex

Found

Read from: 194.58.196.57:53

Type	Value	TTL
SOA	ns1.sqr.nl. hostmaster.alkmaar.nl. 2026101501 16384 2048 1048576 300	2560
NS	anycast-eu.dns.sqr.nl.	900
NS	unicast-eu.dns.sqr.domains.	900
NS	anycast-global.dns.sqr.cloud.	900
A	31.7.0.60	3600
A	31.7.6.87	3600
A	185.144.224.28	3600
AAAA	2a03:9700:8000:1::24	3600
AAAA	2a03:9700:8000:1::25	3600
AAAA	2a03:9700:8000:1::23	3600
MX	10 alkmaar-nl.p-v1.mx.microsoft.	60
TXT	"g4EpC+UXbLTGSGfgX0v5ptR/GLUyQHdZ+o5MbvsAvaycwe8LJtJ6XS6OP2G5YWigqCP0OdH7f4eCg5t0Ycs9Aw=="	3600
TXT	"v=NTA7516-1;startdate=2025-09;enddate=2030-09;provider=smartlockr;ntamx=10 ntamx.smartlockr.eu"	3600
TXT	"v=spf1 include:spf.protection.outlook.com ip4:51.136.120.10 ip4:185.249.220.0/24 ip4:40.95.64.0/22 ip4:185.225.161.0/24 ip4:51.105.148.248 ip4:20.50.169.50 ip4:185.92.61.0/24 ip4:31.7.1.29 ip4:195.225.101.66 ip6:2a03:9700:8000:1::29 include:spf.afas.onlin" "e include:_spf.mailrelay.zorgring.nl include:_spf.service.centric.eu include:spf_servers.yard.nl include:spf_cluster.yard.nl include:spf.zaaksysteem.nl -all"	3600
TXT	"MS=ms64896671"	3600
TXT	"msfpkey=2fwqhlcny0dcybmhpun7hkjmv"	3600
TXT	"apple-domain-verification=Bpj8oc50o2lOvirO"	3600
TXT	"canva-site-verification=ret3bNF9xrwek4wAe6QxZA"	3600
TXT	"autodesk-domain-verification=dY8UMZYd6mRO-wy8isW1"	3600
TXT	"adobe-sign-verification=fe83651d96e78e4eb829c16324ad4606"	3600
TXT	"facebook-domain-verification=2v9kc9tghyhv40r18dmdgaz7gim9um"	3600
TXT	"1f57235d0661f004876fec9629ae9c41d2906e7ef2c3c8df4bc16e3af66594a0"	3600
TXT	"30rWMIK0I4NihosjBMPDtAnbMP4LRobfxTuiYXhkqVBbuH8UcAeaPv1PZuIE9Vog"	3600
TXT	"3HRwy5CBKMe98Ryd5J3pxeL7MzQ6GtUQAB33K5Mg7XD4OcEKwHhuk9lPhICfxysl"	3600
TXT	"6pFzkFyN12ru0F2TjC5VHYteep8ZOPeRewQofzawCNd8ohSB8DVr3mxjOLz0vMEe"	3600
TXT	"FPRg4WgOkAuKvmT7nTCYucvQvvmXtlA8qd8V2pOEQa5uL7YjbyfkncLalfdxhQVL"	3600
TXT	"HzvWNoPhv8ra9TMSIPW7Nm47GPi2yPLafeO6s9YKyE7bcPJR7nCBgH3ooNWmeBrJ"	3600
TXT	"KarJyuXDnQxpkmRo2L45TNHnxfc2gNAJs8arEuWuwYrQuK2QutmLGqBipDJOiynO"	3600
TXT	"N2TTUEA5atz2veK8dL6Q3ZhldHigdjEA3E8Sb6Y1fNDMAzGYWg2ABBj2Icb9WfFc"	3600
TXT	"OSvr7dEXUSuKbkvXR0xtbTj5ajmlLGHHkUBh3WS1hBzDLFRrkCxYEw9ZcRMQTmFf"	3600
TXT	"QICNcmNVKIa5XmpRHbg4rO0m7GuALhBuEO68pTcaNQI8kwutjjDPD4HXo8oXEpqq"	3600
TXT	"a4OsdRG4q9nZxTsUCKjxwNCJ0D3ebdpLPFl9YogmxUCu8g7ttBkbLuRjGQGn67Og"	3600
TXT	"b5f8f9a1f12a43c3ea9ddc36707564b5aa06007a60287434fb19423265c639f5"	3600
TXT	"d697235c8997268846ec5a433bac93fdab3eb004dd6d898f9cb48c3cdfa380ca"	3600
TXT	"g4eES8RbwML9B227QSitLgXJgzqlEWoWa8rIl5ELkmcffuKkhbVsdsDwCEZx5h9F"	3600
TXT	"gJvXFp5RIYiKEkUsNIrkBxSHjdiCZKqokNmyoOGkU9H0Y0S76bTh939zWOAFauf4"	3600
TXT	"hGQLkKVn5mFNvjiC6kjIpAMB8W9VF6B7tQzQbdN8oh6nPeSr6PTB4NSoCYHZPxsy"	3600
TXT	"hsfyWtB6nHIguQ8sLCQ5ldRq4DshiwYq8FPMy9s0PQOzkWhRcwjnYQGk8HPf1Avu"	3600
TXT	"mPlmHLBmRLhaLpmuUCarP0FIptorKqxyFR8WKKqzqmWybWTAbwlPn7aLjJNsc0Ux"	3600
TXT	"s0TqgfBqivWswNE8v6CKdhtacwoc6XP0r7izR3vO6hqL7xtXT08DRkpEEjCldrzJ"	3600
TXT	"tnhaDydzOIv7JO4PZmaC2OrPOlWIM3wHG458gim6voynyInFRPMW1imiHfTqAIhv"	3600
TXT	"vSZbMUEmGb8Z7ChEPKnxBxHVz2ihRd6vHI1iEKFDdRkTpaWRxnYSkke5TisE9JRo"	3600
CAA	0 issue "certsign.ro"	300
CAA	0 issue "kpn.com"	300
CAA	0 issue "letsencrypt.org"	300
CAA	0 issue "sectigo.com"	300
CAA	0 issuewild ";"	300

Checks

!

Very low TTLs

These records have a TTL below 5m, causing extra queries and slower lookups: MX (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 1h and in the zone 15m; resolvers may use either.

#32
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
✓ CAA restricts issuance #35

Certificates may be issued by: certsign.ro, kpn.com, letsencrypt.org, sectigo.com, none (issuance forbidden).