allianz.de

Checked 21 October 2026, 21:28 UTC · via 8.8.8.8
!Passed with warnings
20 passed 4 warnings 0 failed 5 info

Registration

info

.de country-code

Found

TLD
.de (country-code)
ICANN policies apply
no

Checks

  • i
    .de is a country-code TLD (ccTLD)
    Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.
    #1
  • ✓ TLD delegated and signed #2
    .de is delegated in the root zone and DNSSEC-signed.
  • i
    Registration data not available
    No registration data via RDAP: the registry of .de offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.
    #3

Delegation

warn

ns1.allianz.com, ns2.allianz.com, ns3.allianz.de, ns4.allianz.de, ns5.az-ip.net, ns6.az-ip.net

Found

Parent zone
de
Delegation from
a.nic.de (194.0.0.53)
NS at the parent
ns1.allianz.com, ns2.allianz.com, ns3.allianz.de, ns4.allianz.de, ns5.az-ip.net, ns6.az-ip.net
NS in the zone
ns1.allianz.com, ns2.allianz.com, ns3.allianz.de, ns4.allianz.de, ns5.az-ip.net, ns6.az-ip.net
NameserverAddressesNetwork (AS)Glue
ns1.allianz.com194.127.26.151AS15580 UNSPECIFIED - Allianz Technology SE, DE-
ns2.allianz.com95.100.173.67 184.85.248.65 195.253.114.7 2a01:5b0:32::7 2a02:26f0:117::41 2600:1480:d800::43AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS8561 KNIPPWORLDWIDE - Knipp Medien und Kommunikation GmbH, DE AS8561 KNIPPWORLDWIDE - Knipp Medien und Kommunikation GmbH, DE AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
ns3.allianz.de194.127.24.151 2a01:6f8:2004:f0be::1:53AS15580 UNSPECIFIED - Allianz Technology SE, DE AS15580 UNSPECIFIED - Allianz Technology SE, DE194.127.24.151 2a01:6f8:2004:f0be::1:53
ns4.allianz.de195.253.116.8 184.26.160.66 2.16.40.66 2600:1480:f000::42 2600:1403:a::42 2a01:5b0:34::8AS8561 KNIPPWORLDWIDE - Knipp Medien und Kommunikation GmbH, DE AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS8561 KNIPPWORLDWIDE - Knipp Medien und Kommunikation GmbH, DE195.253.116.8 2a01:5b0:34::8
ns5.az-ip.net194.127.74.36 194.127.75.36AS8360 UNSPECIFIED - Allianz Technology SE, DE AS8360 UNSPECIFIED - Allianz Technology SE, DE-
ns6.az-ip.net84.53.139.67 193.108.91.26 195.253.118.9 2a01:5b0:36::9 2600:1401:2::1a 2600:1480:1::43AS20940 AKAMAI-ASN1 - Akamai International B.V., NL AS20940 AKAMAI-ASN1 - Akamai International B.V., NL AS8561 KNIPPWORLDWIDE - Knipp Medien und Kommunikation GmbH, DE AS8561 KNIPPWORLDWIDE - Knipp Medien und Kommunikation GmbH, DE AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-

Checks

  • ✓ 6 nameservers #6
    Delegated to ns1.allianz.com, ns2.allianz.com, ns3.allianz.de, ns4.allianz.de, ns5.az-ip.net, ns6.az-ip.net.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • !
    Glue differs from the zone
    The addresses at the parent (glue) differ from the addresses in the zone: ns4.allianz.de (glue 195.253.116.8, 2a01:5b0:34::8, zone 195.253.116.8, 184.26.160.66, 2.16.40.66, 2600:1480:f000::42, 2600:1403:a::42, 2a01:5b0:34::8). Update the glue at your registrar.
    #8
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 13 IPv4 /24s and 10 IPv6 /48s.
  • ✓ 5 autonomous systems #11
    The nameservers are spread over: AS15580 (UNSPECIFIED - Allianz Technology SE, DE): 3 addresses; AS20940 (AKAMAI-ASN1 - Akamai International B.V., NL): 2 addresses; AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 10 addresses; AS8360 (UNSPECIFIED - Allianz Technology SE, DE): 2 addresses; AS8561 (KNIPPWORLDWIDE - Knipp Medien und Kommunikation GmbH, DE): 6 addresses.
  • ✓ Nameserver names under 3 TLDs #12
    Nameserver names use the TLDs .com, .de, .net.
  • i
    Partly IPv6
    These nameservers have no IPv6 address: ns1.allianz.com, ns5.az-ip.net.
    #13

Nameservers

warn

23 of 23 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns1.allianz.com 194.127.26.151NOERROR, 15 ms, authoritativenoyes / yesrefused-
ns2.allianz.com 95.100.173.67NOERROR, 5 ms, authoritativenoyes / yesrefused48878.26
ns2.allianz.com 184.85.248.65NOERROR, 5 ms, authoritativenoyes / yesrefused41824.6
ns2.allianz.com 195.253.114.7NOERROR, 20 ms, authoritativenoyes / yesrefused-
ns2.allianz.com 2a01:5b0:32::7NOERROR, 22 ms, authoritativenoyes / yesrefused-
ns2.allianz.com 2a02:26f0:117::41NOERROR, 5 ms, authoritativenoyes / yesrefused41824.8
ns2.allianz.com 2600:1480:d800::43NOERROR, 5 ms, authoritativenoyes / yesrefused48878.30
ns3.allianz.de 194.127.24.151NOERROR, 5 ms, authoritativenoyes / yesrefused-
ns3.allianz.de 2a01:6f8:2004:f0be::1:53NOERROR, 6 ms, authoritativenoyes / yesrefused-
ns4.allianz.de 195.253.116.8NOERROR, 86 ms, authoritativenoyes / yesrefused-
ns4.allianz.de 184.26.160.66NOERROR, 5 ms, authoritativenoyes / yesrefused48878.26
ns4.allianz.de 2.16.40.66NOERROR, 5 ms, authoritativenoyes / yesrefused48878.32
ns4.allianz.de 2600:1480:f000::42NOERROR, 5 ms, authoritativenoyes / yesrefused48878.26
ns4.allianz.de 2600:1403:a::42NOERROR, 5 ms, authoritativenoyes / yesrefused48878.29
ns4.allianz.de 2a01:5b0:34::8NOERROR, 86 ms, authoritativenoyes / yesrefused-
ns5.az-ip.net 194.127.74.36NOERROR, 110 ms, authoritativenoyes / yesrefused-
ns5.az-ip.net 194.127.75.36NOERROR, 97 ms, authoritativenoyes / yesrefused-
ns6.az-ip.net 84.53.139.67NOERROR, 3 ms, authoritativenoyes / yesrefused41824.7
ns6.az-ip.net 193.108.91.26NOERROR, 3 ms, authoritativenoyes / yesrefused41824.5
ns6.az-ip.net 195.253.118.9NOERROR, 14 ms, authoritativenoyes / yesrefused-
ns6.az-ip.net 2a01:5b0:36::9NOERROR, 14 ms, authoritativenoyes / yesrefused-
ns6.az-ip.net 2600:1401:2::1aNOERROR, 4 ms, authoritativenoyes / yesrefused41824.4
ns6.az-ip.net 2600:1480:1::43NOERROR, 4 ms, authoritativenoyes / yesrefused41824.6

Checks

  • ✓ All respond #14
    All 23 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: ns2.allianz.com: "48878.26"; ns2.allianz.com: "41824.6"; ns2.allianz.com: "41824.8"; ns2.allianz.com: "48878.30"; ns4.allianz.de: "48878.26"; ns4.allianz.de: "48878.32"; ns4.allianz.de: "48878.29"; ns6.az-ip.net: "41824.7"; ns6.az-ip.net: "41824.5"; ns6.az-ip.net: "41824.4"; ns6.az-ip.net: "41824.6". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

info

serial 2026101600 · primary ns.allianz.com

Found

Primary (MNAME)
ns.allianz.com
Contact (RNAME)
hostmaster.allianz.com
Serial
2026101600
Refresh / retry
10800 s / 1800 s
Expire
3600000 s
Negative TTL
300 s

Serial per nameserver

NameserverSerial
ns1.allianz.com (194.127.26.151)2026101600
ns2.allianz.com (95.100.173.67)2026101600
ns2.allianz.com (184.85.248.65)2026101600
ns2.allianz.com (195.253.114.7)2026101600
ns2.allianz.com (2a01:5b0:32::7)2026101600
ns2.allianz.com (2a02:26f0:117::41)2026101600
ns2.allianz.com (2600:1480:d800::43)2026101600
ns3.allianz.de (194.127.24.151)2026101600
ns3.allianz.de (2a01:6f8:2004:f0be::1:53)2026101600
ns4.allianz.de (195.253.116.8)2026101600
ns4.allianz.de (184.26.160.66)2026101600
ns4.allianz.de (2.16.40.66)2026101600
ns4.allianz.de (2600:1480:f000::42)2026101600
ns4.allianz.de (2600:1403:a::42)2026101600
ns4.allianz.de (2a01:5b0:34::8)2026101600
ns5.az-ip.net (194.127.74.36)2026101600
ns5.az-ip.net (194.127.75.36)2026101600
ns6.az-ip.net (84.53.139.67)2026101600
ns6.az-ip.net (193.108.91.26)2026101600
ns6.az-ip.net (195.253.118.9)2026101600
ns6.az-ip.net (2a01:5b0:36::9)2026101600
ns6.az-ip.net (2600:1401:2::1a)2026101600
ns6.az-ip.net (2600:1480:1::43)2026101600

Checks

  • ✓ Serial 2026101600 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 3h, retry 30m, expire 1000h, negative TTL 5m.
  • i
    Hidden master
    The primary nameserver ns.allianz.com is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.
    #24
  • ✓ Contact hostmaster@allianz.com #25
    The SOA RNAME hostmaster.allianz.com means hostmaster@allianz.com.
  • ✓ Date-based serial #26
    The serial 2026101600 follows the YYYYMMDDnn convention (2026-10-16).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

27 records at the apex

Found

Read from
194.127.26.151:53
TypeValueTTL
SOAns.allianz.com. hostmaster.allianz.com. 2026101600 10800 1800 3600000 30010800
NSns4.allianz.de.10800
NSns3.allianz.de.10800
NSns6.az-ip.net.10800
NSns1.allianz.com.10800
NSns2.allianz.com.10800
NSns5.az-ip.net.10800
A166.117.146.12860
A166.117.24.22160
TXT"anthropic-domain-verification-4y4na9=06ssgl8N287T6WDySMTAIuTA7"3600
TXT"cn7fmb6r95hx7819lhrghh4cjyn5dd99"3600
TXT"knowbe4-site-verification=f1240e138bc0e8a4353c98eda4d16d2c"3600
TXT"adobe-idp-site-verification=456f241d9c1a22ac9b1daec656d2cdd4c3f30b2e17ce43c0f230ba3f0340964f"3600
TXT"009M0000000cpC1=1TB9M00000004Rp"3600
TXT"cisco-ci-domain-verification=3c21fb4b04b8d1a45bfefe98232472b66e02223bb4bed86bd44beb02deffea2c"3600
TXT"_fmnpt1m2ulv868zqjowjpebvlegmbz6"3600
TXT"onetrust-domain-verification=00d954f59523481c869572f2b0e346c1"3600
TXT"onetrust-domain-verification=1a6cec33b21446b6a9d0251ff34e0e78"3600
TXT"009M000000000cpC1=1TB9M00000004D0"3600
TXT"AKTsiRKiGZHghsQThJlvO0bBzNZaxt+uvek++eWbkPMO3IXlj4DRJXHQKrp9Hp56mEo1kEDNWLhwVU67+Dv5Wg=="3600
TXT"miro-verification=9df906535d1b3bfbf3c5481f7b5a4229dfff9944"3600
TXT"onetrust-domain-verification=5841736d21cf475c89933c07eea21e56"3600
TXT"00DFg00000KhcGF=1TBFg0000002e6D"3600
TXT"facebook-domain-verification=u7mtd4jhvuneyrpzuwifp5o45q0zpc"3600
TXT"webexdomainverification.J0T4=bf44e859-0e88-4f77-8a22-d5acd25869d9"3600
TXT"canva-site-verification=lOwCIZvxm9dORq6-LgxhYw"3600
TXT"v=spf1 include:spf.allianz.com include:_spf.allianz.de ip4:87.230.97.144/28 ip4:62.113.218.4/30 ip4:83.133.158.241 ip4:178.77.89.84 ip4:131.124.92.11 include:_spf-dc33.sapsf.eu -all"3600

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 1d and in the zone 3h; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35