aral.de

Checked 21 October 2026, 21:30 UTC · via 8.8.8.8
!Passed with warnings
24 passed 3 warnings 0 failed 2 info

Registration

info

.de country-code

Found

TLD
.de (country-code)
ICANN policies apply
no

Checks

  • i
    .de is a country-code TLD (ccTLD)
    Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.
    #1
  • ✓ TLD delegated and signed #2
    .de is delegated in the root zone and DNSSEC-signed.
  • i
    Registration data not available
    No registration data via RDAP: the registry of .de offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.
    #3

Delegation

pass

damon.ns.cloudflare.com, dns1.ednsglobal.net, dns2.ednsglobal.net, dns3.ednsglobal.net, dns4.ednsglobal.net, naomi.ns.cloudflare.com

Found

Parent zone
de
Delegation from
a.nic.de (194.0.0.53)
NS at the parent
damon.ns.cloudflare.com, dns1.ednsglobal.net, dns2.ednsglobal.net, dns3.ednsglobal.net, dns4.ednsglobal.net, naomi.ns.cloudflare.com
NS in the zone
damon.ns.cloudflare.com, dns1.ednsglobal.net, dns2.ednsglobal.net, dns3.ednsglobal.net, dns4.ednsglobal.net, naomi.ns.cloudflare.com
NameserverAddressesNetwork (AS)Glue
damon.ns.cloudflare.com108.162.193.96 172.64.33.96 173.245.59.96 2606:4700:58::adf5:3b60 2803:f800:50::6ca2:c160 2a06:98c1:50::ac40:2160AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US-
dns1.ednsglobal.net205.251.195.101 2600:9000:5303:6500::1AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US-
dns2.ednsglobal.net205.251.199.63 2600:9000:5307:3f00::1AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US-
dns3.ednsglobal.net205.251.192.166 2600:9000:5300:a600::1AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US-
dns4.ednsglobal.net205.251.197.93 2600:9000:5305:5d00::1AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US-
naomi.ns.cloudflare.com173.245.58.208 108.162.192.208 172.64.32.208 2606:4700:50::adf5:3ad0 2a06:98c1:50::ac40:20d0 2803:f800:50::6ca2:c0d0AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US-

Checks

  • ✓ 6 nameservers #6
    Delegated to damon.ns.cloudflare.com, dns1.ednsglobal.net, dns2.ednsglobal.net, dns3.ednsglobal.net, dns4.ednsglobal.net, naomi.ns.cloudflare.com.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 10 IPv4 /24s and 8 IPv6 /48s.
  • ✓ 2 autonomous systems #11
    The nameservers are spread over: AS13335 (CLOUDFLARENET - Cloudflare, Inc., US): 12 addresses; AS16509 (AMAZON-02 - Amazon.com, Inc., US): 8 addresses.
  • ✓ Nameserver names under 2 TLDs #12
    Nameserver names use the TLDs .com, .net.
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

warn

20 of 20 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
damon.ns.cloudflare.com 108.162.193.96NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
damon.ns.cloudflare.com 172.64.33.96NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
damon.ns.cloudflare.com 173.245.59.96NOERROR, 17 ms, authoritativenoyes / yesrefused2026.10.2
damon.ns.cloudflare.com 2606:4700:58::adf5:3b60NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
damon.ns.cloudflare.com 2803:f800:50::6ca2:c160NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
damon.ns.cloudflare.com 2a06:98c1:50::ac40:2160NOERROR, 16 ms, authoritativenoyes / yesrefused2026.10.2
dns1.ednsglobal.net 205.251.195.101NOERROR, 4 ms, authoritativenoyes / yesrefused-
dns1.ednsglobal.net 2600:9000:5303:6500::1NOERROR, 4 ms, authoritativenoyes / yesrefused-
dns2.ednsglobal.net 205.251.199.63NOERROR, 9 ms, authoritativenoyes / yesrefused-
dns2.ednsglobal.net 2600:9000:5307:3f00::1NOERROR, 9 ms, authoritativenoyes / yesrefused-
dns3.ednsglobal.net 205.251.192.166NOERROR, 9 ms, authoritativenoyes / yesrefused-
dns3.ednsglobal.net 2600:9000:5300:a600::1NOERROR, 9 ms, authoritativenoyes / yesrefused-
dns4.ednsglobal.net 205.251.197.93NOERROR, 3 ms, authoritativenoyes / yesrefused-
dns4.ednsglobal.net 2600:9000:5305:5d00::1NOERROR, 4 ms, authoritativenoyes / yesrefused-
naomi.ns.cloudflare.com 173.245.58.208NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
naomi.ns.cloudflare.com 108.162.192.208NOERROR, 18 ms, authoritativenoyes / yesrefused2026.10.2
naomi.ns.cloudflare.com 172.64.32.208NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
naomi.ns.cloudflare.com 2606:4700:50::adf5:3ad0NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
naomi.ns.cloudflare.com 2a06:98c1:50::ac40:20d0NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
naomi.ns.cloudflare.com 2803:f800:50::6ca2:c0d0NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2

Checks

  • ✓ All respond #14
    All 20 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: damon.ns.cloudflare.com: "2026.10.2"; naomi.ns.cloudflare.com: "2026.10.2". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

warn

serial 2416952136 · primary damon.ns.cloudflare.com

Found

Primary (MNAME)
damon.ns.cloudflare.com
Contact (RNAME)
dns.cloudflare.com
Serial
2416952136
Refresh / retry
10000 s / 2400 s
Expire
604800 s
Negative TTL
1800 s

Serial per nameserver

NameserverSerial
damon.ns.cloudflare.com (108.162.193.96)2416952136
damon.ns.cloudflare.com (172.64.33.96)2416952136
damon.ns.cloudflare.com (173.245.59.96)2416952136
damon.ns.cloudflare.com (2606:4700:58::adf5:3b60)2416952136
damon.ns.cloudflare.com (2803:f800:50::6ca2:c160)2416952136
damon.ns.cloudflare.com (2a06:98c1:50::ac40:2160)2416952136
dns1.ednsglobal.net (205.251.195.101)2023042403
dns1.ednsglobal.net (2600:9000:5303:6500::1)2023042403
dns2.ednsglobal.net (205.251.199.63)2023042403
dns2.ednsglobal.net (2600:9000:5307:3f00::1)2023042403
dns3.ednsglobal.net (205.251.192.166)2023042403
dns3.ednsglobal.net (2600:9000:5300:a600::1)2023042403
dns4.ednsglobal.net (205.251.197.93)2023042403
dns4.ednsglobal.net (2600:9000:5305:5d00::1)2023042403
naomi.ns.cloudflare.com (173.245.58.208)2416952136
naomi.ns.cloudflare.com (108.162.192.208)2416952136
naomi.ns.cloudflare.com (172.64.32.208)2416952136
naomi.ns.cloudflare.com (2606:4700:50::adf5:3ad0)2416952136
naomi.ns.cloudflare.com (2a06:98c1:50::ac40:20d0)2416952136
naomi.ns.cloudflare.com (2803:f800:50::6ca2:c0d0)2416952136

Checks

  • !
    Serials differ
    The nameservers serve different versions of the zone: 2023042403 on dns1.ednsglobal.net (205.251.195.101), dns1.ednsglobal.net (2600:9000:5303:6500::1), dns2.ednsglobal.net (205.251.199.63), dns2.ednsglobal.net (2600:9000:5307:3f00::1), dns3.ednsglobal.net (205.251.192.166), dns3.ednsglobal.net (2600:9000:5300:a600::1), dns4.ednsglobal.net (205.251.197.93), dns4.ednsglobal.net (2600:9000:5305:5d00::1); 2416952136 on damon.ns.cloudflare.com (108.162.193.96), damon.ns.cloudflare.com (172.64.33.96), damon.ns.cloudflare.com (173.245.59.96), damon.ns.cloudflare.com (2606:4700:58::adf5:3b60), damon.ns.cloudflare.com (2803:f800:50::6ca2:c160), damon.ns.cloudflare.com (2a06:98c1:50::ac40:2160), naomi.ns.cloudflare.com (173.245.58.208), naomi.ns.cloudflare.com (108.162.192.208), naomi.ns.cloudflare.com (172.64.32.208), naomi.ns.cloudflare.com (2606:4700:50::adf5:3ad0), naomi.ns.cloudflare.com (2a06:98c1:50::ac40:20d0), naomi.ns.cloudflare.com (2803:f800:50::6ca2:c0d0). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.
    #22
  • ✓ Timers within recommendations #23
    SOA refresh 2h46m40s, retry 40m, expire 7d, negative TTL 30m.
  • ✓ Primary is a public nameserver #24
    The primary nameserver damon.ns.cloudflare.com is one of the listed nameservers.
  • ✓ Contact dns@cloudflare.com #25
    The SOA RNAME dns.cloudflare.com means dns@cloudflare.com.
  • ✓ Timestamp serial #26
    The serial 2416952136 is a Unix timestamp (2046-08-03 23:35 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

pass

31 records at the apex

Found

Read from
108.162.193.96:53
TypeValueTTL
SOAdamon.ns.cloudflare.com. dns.cloudflare.com. 2416952136 10000 2400 604800 18001800
NSdns1.ednsglobal.net.86400
NSdns4.ednsglobal.net.86400
NSdns3.ednsglobal.net.86400
NSdns2.ednsglobal.net.86400
NSdamon.ns.cloudflare.com.86400
NSnaomi.ns.cloudflare.com.86400
A54.72.215.1891800
MX10 aral-de.mail.protection.outlook.com.300
MX50 aral-de.mail.protection.outlook.com.300
TXT"MS=ms51824374"300
TXT"SFMC-RPVfOsbKQCkJf69puMnSbXYoEVZCIWLdnlCvGBly"300
TXT"VjWpNWgAEsrV96CPD51XCWRX+K/3dWQLiYACR4urcH0Csxba/B5P2rHBTUBk0R44dZVYVvQKT1o1KUjHIHwX+Q=="300
TXT"_58ta5245xo8zi27vkq5k1gba3p9hxdu"300
TXT"pardot242293=1f1ab881cd2f01828c5b2bb6eb7a6b9fcdd2ec37a3e0c87c5eb9c07fa2667a65"300
TXT"pardot902921=1fd2b0948c5bbc35ac6e1d2bbf3be71148a4654f45111cd88d4286867270ed5d"300
TXT"pardot902921=bb6335bfda7943c338a1a9adda2e7aeb2efd0bf5a6a5579d64e41752ccd0013c"300
TXT"sI20yDb0i5fmQGI5KskAhzd7jkqPsFWM2kShKXrHAAWx1Q4YT88xLshscpzDhS4qjTb3ZQls8RwMDD0uVvTpow=="300
TXT"v=spf1 include:_u.aral.de._spf.smart.ondmarc.com ~all"300
CAA0 iodef "mailto:certificateservices@bp.com"300
CAA0 issue "comodoca.com"300
CAA0 issue "digicert.com; cansignhttpexchanges=yes"300
CAA0 issue "letsencrypt.org"300
CAA0 issue "pki.goog; cansignhttpexchanges=yes"300
CAA0 issue "ssl.com"300
CAA0 issue "www.digicert.com"300
CAA0 issuewild "comodoca.com"300
CAA0 issuewild "digicert.com; cansignhttpexchanges=yes"300
CAA0 issuewild "letsencrypt.org"300
CAA0 issuewild "pki.goog; cansignhttpexchanges=yes"300
CAA0 issuewild "ssl.com"300

Checks

  • ✓ TTLs within range #32
    TTLs: A 30m, MX 5m, NS 1d.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • ✓ CAA restricts issuance #35
    Certificates may be issued by: comodoca.com, digicert.com, letsencrypt.org, pki.goog, ssl.com, www.digicert.com.