Domain report: atlantic-hotels.de

Registration

info

.de country-code

Found

TLD: .de (country-code)
ICANN policies apply: no

Checks

i

.de is a country-code TLD (ccTLD)

Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.

#1
✓ TLD delegated and signed #2

.de is delegated in the root zone and DNSSEC-signed.
i

Registration data not available

No registration data via RDAP: the registry of .de offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.

#3

Delegation

info

ns1.plutex.de, ns2.plutex.de, ns3.plutex.de

Found

Parent zone: de
Delegation from: a.nic.de (194.0.0.53)
NS at the parent: ns1.plutex.de, ns2.plutex.de, ns3.plutex.de
NS in the zone: ns1.plutex.de, ns2.plutex.de, ns3.plutex.de

Nameserver	Addresses	Network (AS)	Glue
ns1.plutex.de	91.202.40.53 2a02:16d0:0:1::53	AS49855 PLUTEX - PLUTEX GmbH, DE AS49855 PLUTEX - PLUTEX GmbH, DE	91.202.40.53 2a02:16d0:0:1::53
ns2.plutex.de	91.202.41.53 2a02:16d0:0:1::1:53	AS49855 PLUTEX - PLUTEX GmbH, DE AS49855 PLUTEX - PLUTEX GmbH, DE	91.202.41.53 2a02:16d0:0:1::1:53
ns3.plutex.de	116.203.36.144 2a01:4f8:c2c:df5b::1	AS24940 HETZNER-AS - Hetzner Online GmbH, DE AS24940 HETZNER-AS - Hetzner Online GmbH, DE	116.203.36.144 2a01:4f8:c2c:df5b::1

Checks

✓ 3 nameservers #6

Delegated to ns1.plutex.de, ns2.plutex.de, ns3.plutex.de.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 3 IPv4 /24s and 2 IPv6 /48s.
✓ 2 autonomous systems #11

The nameservers are spread over: AS24940 (HETZNER-AS - Hetzner Online GmbH, DE): 2 addresses; AS49855 (PLUTEX - PLUTEX GmbH, DE): 4 addresses.
i

All nameserver names under .de

All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

#12
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

Nameservers

info

6 of 6 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
ns1.plutex.de 91.202.40.53	NOERROR, 12 ms, authoritative	no	yes / yes	refused	DNS Service
ns1.plutex.de 2a02:16d0:0:1::53	NOERROR, 13 ms, authoritative	no	yes / yes	refused	DNS Service
ns2.plutex.de 91.202.41.53	NOERROR, 9 ms, authoritative	no	yes / yes	refused	DNS Service
ns2.plutex.de 2a02:16d0:0:1::1:53	NOERROR, 10 ms, authoritative	no	yes / yes	refused	DNS Service
ns3.plutex.de 116.203.36.144	NOERROR, 5 ms, authoritative	no	yes / yes	refused	DNS Service
ns3.plutex.de 2a01:4f8:c2c:df5b::1	NOERROR, 5 ms, authoritative	no	yes / yes	refused	DNS Service

Checks

✓ All respond #14

All 6 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
i

Identifying string disclosed

These nameservers answer version queries with a string that is not a version number: ns1.plutex.de: "DNS Service"; ns2.plutex.de: "DNS Service"; ns3.plutex.de: "DNS Service".

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

warn

serial 2026102001 · primary ns2.plutex.de

Found

Primary (MNAME): ns2.plutex.de
Contact (RNAME): domains.zech-group.com
Serial: 2026102001
Refresh / retry: 60 s / 60 s
Expire: 604800 s
Negative TTL: 60 s

Serial per nameserver

Nameserver	Serial
ns1.plutex.de (91.202.40.53)	2026102001
ns1.plutex.de (2a02:16d0:0:1::53)	2026102001
ns2.plutex.de (91.202.41.53)	2026102001
ns2.plutex.de (2a02:16d0:0:1::1:53)	2026102001
ns3.plutex.de (116.203.36.144)	2026102001
ns3.plutex.de (2a01:4f8:c2c:df5b::1)	2026102001

Checks

✓ Serial 2026102001 everywhere #22

All nameservers serve the same version of the zone.
!

Unusual SOA timers

refresh 1m is outside 20m–1d; retry 1m should be shorter than refresh 1m; negative caching TTL (minimum) 1m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 1m, retry 1m, expire 7d, negative TTL 1m.

#23
✓ Primary is a public nameserver #24

The primary nameserver ns2.plutex.de is one of the listed nameservers.
✓ Contact domains@zech-group.com #25

The SOA RNAME domains.zech-group.com means domains@zech-group.com.
✓ Date-based serial #26

The serial 2026102001 follows the YYYYMMDDnn convention (2026-10-20).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

warn

21 records at the apex

Found

Read from: 91.202.40.53:53

Type	Value	TTL
SOA	ns2.plutex.de. domains.zech-group.com. 2026102001 60 60 604800 60	60
NS	ns2.plutex.de.	300
NS	ns3.plutex.de.	300
NS	ns1.plutex.de.	300
A	31.24.146.137	60
MX	50 mx01.reservision.com.	60
MX	50 mx03.reservision.com.	60
MX	0 atlantichotels-de02b.mail.protection.outlook.com.	60
MX	50 mx02.reservision.com.	60
TXT	"d316b1a2aa729b5348ad1e50dc81e0e9c55abb31747784a186e39ff2ef4d575"	60
TXT	"v=spf1 include:spf.rexx-suite.com ip4:85.25.89.5 ip4:85.25.89.0/24 ip4:91.250.95.64/26 ip4:87.230.74.128/28 ip4:91.250.74.128/27 ip4:80.237.187.32/28 ip4:92.51.187.64/27 ip4:83.169.51.224/27 ip4:104.47.14.36 ip4:104.47.12.36 ip4:213.23.90.98 ip4:129.146.1" "23.44 ip4:129.146.58.65 ip4:151.193.20.41 ip4:45.132.247.71 ip4:45.90.5.136 ip4:45.90.5.139 ip4:83.136.84.37 ip4:80.149.46.2 ip4:151.193.18.41 ip4:87.253.232.0/21 ip4:185.189.236.0/22 ip4:185.211.120.0/22 ip4:185.250.236.0/22 ip4:31.24.145.37 include:spf." "myzechit.com include:spf.protection.outlook.com include:spf.synxis.com include:spf.myincert.com ip4:212.53.206.155/29 ip4:209.61.151.0/24 ip4:166.78.68.0/22 ip4:198.61.254.0/23 ip4:192.237.158.0/23 ip4:23.253.182.0/23 ip4:104.130.96.0/28 ip4:146.20.113.0/" "24 ip4:146.20.191.0/24 ip4:159.135.224.0/20 ip4:69.72.32.0/20 ip4:104.130.122.0/23 ip4:146.20.112.0/26 ip4:161.38.192.0/20 ip4:143.55.224.0/21 ip4:143.55.232.0/22 ip4:159.112.240.0/20 ip4:198.244.48.0/20 ip4:204.220.168.0/21 ip4:204.220.176.0/20 ip4:141.1" "93.32.0/23 ip4:159.135.140.80/29 ip4:159.135.132.128/25 ip4:161.38.204.0/22 ip4:87.253.232.0/21 ip4:185.189.236.0/22 ip4:185.211.120.0/22 ip4:185.250.236.0/22 ip4:143.55.236.0/22 ip4:198.244.60.0/22 ip4:204.220.160.0/21 include:sendgrid.net -all"	60
TXT	"google-site-verification=48KjzSM1qsrOmPqJAUq0eL2bV58AX7yrptbABAJP4IM"	60
TXT	"_globalsign-domain-verification=9ADxkDPGrU_vYCNFXjYKcglMXYNHAeGeij1kz7nium"	60
TXT	"_globalsign-domain-verification=KDSOX9n8IUhl5NtRC70o6i2Nb76gxnAwurv76jmxFN"	60
TXT	"globalsign-domain-verification=83acb489d578b655a4ae524715d8f408"	60
TXT	"fv0e6UXYxwMLG5BGdwVdhdA/SHsCgwCHbV18qYKqghRNe3xR2L23lhgqUX0UBRFRCarcnUOoGv2A88HHepUTkA=="	60
TXT	"apple-domain-verification=oJYF7qNTluhoOeIU"	60
TXT	"MS=ms28608971"	60
TXT	"canva-site-verification=mmGggQtIJ5Fd7Na0_tBC4A"	60
TXT	"_globalsign-domain-verification=l_YwjjdREFC8vcy1KZoK3GALuARbbXwdh-iFyeDXEE"	60
TXT	"ms-domain-verification=11ae2926-7ae5-431d-bbbb-3ce91b7e5632"	60

Checks

!

Very low TTLs

These records have a TTL below 5m, causing extra queries and slower lookups: A (1m), MX (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 1d and in the zone 5m; resolvers may use either.

#32
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35