denhaag.nl

Checked 21 October 2026, 21:00 UTC · via 8.8.8.8
!Passed with warnings
26 passed 2 warnings 0 failed 5 info

Registration

info

.nl country-code

Found

TLD
.nl (country-code)
ICANN policies apply
no
Lookup error: https://rdap.sidn.nl/domain/denhaag.nl returned HTTP 429

Checks

  • i
    .nl is a country-code TLD (ccTLD)
    Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.
    #1
  • ✓ TLD delegated and signed #2
    .nl is delegated in the root zone and DNSSEC-signed.
  • i
    Could not be checked
    The RDAP lookup failed, so this could not be checked: https://rdap.sidn.nl/domain/denhaag.nl returned HTTP 429
    #3

Delegation

info

a1-207.akam.net, a13-64.akam.net, a16-64.akam.net, a22-64.akam.net, a5-64.akam.net, a8-65.akam.net

Found

Parent zone
nl
Delegation from
ns1.dns.nl (194.0.28.53)
NS at the parent
a1-207.akam.net, a13-64.akam.net, a16-64.akam.net, a22-64.akam.net, a5-64.akam.net, a8-65.akam.net
NS in the zone
a1-207.akam.net, a13-64.akam.net, a16-64.akam.net, a22-64.akam.net, a5-64.akam.net, a8-65.akam.net
NameserverAddressesNetwork (AS)Glue
a1-207.akam.net193.108.91.207 2600:1401:2::cfAS20940 AKAMAI-ASN1 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a13-64.akam.net2.22.230.64 2600:1480:800::40AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a16-64.akam.net23.211.132.64 2600:1406:1b::40AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a22-64.akam.net23.211.61.64 2600:1480:7800::40AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a5-64.akam.net95.100.168.64 2600:1480:b000::40AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a8-65.akam.net2.16.40.65 2600:1403:a::41AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-

Checks

  • ✓ 6 nameservers #6
    Delegated to a1-207.akam.net, a13-64.akam.net, a16-64.akam.net, a22-64.akam.net, a5-64.akam.net, a8-65.akam.net.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 6 IPv4 /24s and 6 IPv6 /48s.
  • ✓ 2 autonomous systems #11
    The nameservers are spread over: AS20940 (AKAMAI-ASN1 - Akamai International B.V., NL): 1 address; AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 11 addresses.
  • i
    All nameserver names under .net
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

warn

12 of 12 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
a1-207.akam.net 193.108.91.207NOERROR, 3 ms, authoritativenoyes / yesrefused41824.6
a1-207.akam.net 2600:1401:2::cfNOERROR, 4 ms, authoritativenoyes / yesrefused41824.4
a13-64.akam.net 2.22.230.64NOERROR, 3 ms, authoritativenoyes / yesrefused41824.9
a13-64.akam.net 2600:1480:800::40NOERROR, 4 ms, authoritativenoyes / yesrefused41824.6
a16-64.akam.net 23.211.132.64NOERROR, 3 ms, authoritativenoyes / yesrefused48878.27
a16-64.akam.net 2600:1406:1b::40NOERROR, 4 ms, authoritativenoyes / yesrefused48878.26
a22-64.akam.net 23.211.61.64NOERROR, 3 ms, authoritativenoyes / yesrefused48878.29
a22-64.akam.net 2600:1480:7800::40NOERROR, 4 ms, authoritativenoyes / yesrefused48878.27
a5-64.akam.net 95.100.168.64NOERROR, 4 ms, authoritativenoyes / yesrefused41824.4
a5-64.akam.net 2600:1480:b000::40NOERROR, 4 ms, authoritativenoyes / yesrefused41824.11
a8-65.akam.net 2.16.40.65NOERROR, 5 ms, authoritativenoyes / yesrefused48878.26
a8-65.akam.net 2600:1403:a::41NOERROR, 5 ms, authoritativenoyes / yesrefused48878.27

Checks

  • ✓ All respond #14
    All 12 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: a1-207.akam.net: "41824.6"; a1-207.akam.net: "41824.4"; a13-64.akam.net: "41824.9"; a13-64.akam.net: "41824.6"; a16-64.akam.net: "48878.27"; a16-64.akam.net: "48878.26"; a22-64.akam.net: "48878.29"; a22-64.akam.net: "48878.27"; a5-64.akam.net: "41824.4"; a5-64.akam.net: "41824.11"; a8-65.akam.net: "48878.26"; a8-65.akam.net: "48878.27". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

info

serial 2020939817 · primary ns1.denhaag.nl

Found

Primary (MNAME)
ns1.denhaag.nl
Contact (RNAME)
noc.haagnet.net
Serial
2020939817
Refresh / retry
36000 s / 3600 s
Expire
604800 s
Negative TTL
3600 s

Serial per nameserver

NameserverSerial
a1-207.akam.net (193.108.91.207)2020939817
a1-207.akam.net (2600:1401:2::cf)2020939817
a13-64.akam.net (2.22.230.64)2020939817
a13-64.akam.net (2600:1480:800::40)2020939817
a16-64.akam.net (23.211.132.64)2020939817
a16-64.akam.net (2600:1406:1b::40)2020939817
a22-64.akam.net (23.211.61.64)2020939817
a22-64.akam.net (2600:1480:7800::40)2020939817
a5-64.akam.net (95.100.168.64)2020939817
a5-64.akam.net (2600:1480:b000::40)2020939817
a8-65.akam.net (2.16.40.65)2020939817
a8-65.akam.net (2600:1403:a::41)2020939817

Checks

  • ✓ Serial 2020939817 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 10h, retry 1h, expire 7d, negative TTL 1h.
  • i
    Hidden master
    The primary nameserver ns1.denhaag.nl is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.
    #24
  • ✓ Contact noc@haagnet.net #25
    The SOA RNAME noc.haagnet.net means noc@haagnet.net.
  • ✓ Timestamp serial #26
    The serial 2020939817 is a Unix timestamp (2034-01-15 12:10 UTC).

DNSSEC

warn

Signed, DS published at parent

Found

Validated by resolver
yes
Denial of existence
NSEC3
NSEC3
10 iterations, 13-byte salt
Signatures valid until
25 October 2026

DS at the parent

Key tagAlgorithmDigestMatches a key
22780RSASHA256 (8)SHA256 4712D48F75BDA37F…yes
32282RSASHA256 (8)SHA256 3F1F25C38469A32A…yes

DNSKEY in the zone

Key tagRoleAlgorithm
22780KSK (257)RSASHA256 (8)
32282KSK (257)RSASHA256 (8)
18801ZSK (256)RSASHA256 (8)
3219ZSK (256)RSASHA256 (8)
27835ZSK (256)RSASHA256 (8)

Checks

  • ✓ Signed and validated #27
    The zone is signed, the parent publishes a DS record, and the resolver validates the answers.
  • ✓ DS matches a key #28
    The DS record at the parent matches a key in the zone: key tag 22780 (SHA256), key tag 32282 (SHA256).
  • ✓ Modern algorithms #29
    Key algorithms: RSASHA256 (8).
  • ✓ Short-lived signatures (online signing) #30
    Signatures are valid for 97h0m0s and created on demand; the current one was made at 2026-10-21 17:16 UTC and expires at 2026-10-25 17:49 UTC.
  • !
    NSEC3 with extra iterations or salt
    NSEC3 uses 10 iterations and a 13-byte salt. RFC 9276 recommends 0 iterations and no salt: extra iterations cost resolvers CPU and add no real protection, and some validators treat high counts as insecure.
    #31

Records

info

34 records at the apex

Found

Read from
193.108.91.207:53
TypeValueTTL
SOAns1.denhaag.nl. noc.haagnet.net. 2020939817 36000 3600 604800 360028800
NSa8-65.akam.net.28800
NSa16-64.akam.net.28800
NSa22-64.akam.net.28800
NSa13-64.akam.net.28800
NSa1-207.akam.net.28800
NSa5-64.akam.net.28800
A95.101.74.17300
MX10 smtp.denhaag.nl.28800
TXT"00Dbh000002D8bJ=1TBbh00000003Nh"300
TXT"infoblox-domain-mastery=fa06d48909ffd2e20879a7b0d7fa150278f1ce9d33df74db9b5eeb4adac78e986d"300
TXT"v=spf1 include:amazonses.com include:servers.mcsv.net include:_spf.zorgmail.nl include:_spf.zivver.com include:_spf.services.centric.eu ip4:89.250.189.21 exists:%{i}._spf.mta.salesforce.com redirect=_policy1.denhaag.nl"300
TXT"DomainVerification=EURZBCKGAU2I2I3NRI2GVMBFVS3TJYWAKNA5PREI1CBBDLKT3SD6JUBU09XN7T79"300
TXT"adobe-idp-site-verification=218a39393ad64b671c6f528f7feac505273946e61c5a0ef03b6eb04fadf86d40"300
TXT"_xibemoizkbcs1nxyn8dchygipbivwpz"300
TXT"MS=ms47332452"300
TXT"mentimeter-26eab613-6d53-414a-ba97-a22660da4100"300
TXT"00D3V000000um37=1TBaV00000001Yn"300
TXT"QuoVadis=a2ab8336-ffb8-46fe-b8e3-82a0eed40054"300
TXT"apple-domain-verification=ca5JKKtARwfuJfG3"300
TXT"_szgurufho63f197sc6e7nbu31u21d24"300
TXT"atlassian-domain-verification=Nz+Tr/Nn9zsLZzWkkS4qhU/8E/O03XBO3jaGrPuxLWSA0axexAmUAPQEToH15L0T"300
TXT"QuoVadis=99bce19e-3069-4f65-a121-611b5e2a0960"300
TXT"miro-verification=d01b7c7818a32092794c1c9295a643abba3c5830"300
TXT"TnmZ+iMMD5BrgAnpjfJVTwg2aw8u9z6/x2Aw+Cv4HYXngF3jiG3KJ17DZOhdGlqMcpTQeKhbXOWaIb5bPBc9KA=="300
TXT"_w0bnlrt4rd2tr9cy1bh0qd6ojpo7qu1"300
TXT"8267db70-4405-4aa5-b038-d6c35ae58822-09082018"300
TXT"8PQ1xPhmWiP5elQnksDmma2q3iegXL7CUiJeRJI22KM="300
TXT"TodkDN6h5rqDXELDXuSSdSuI8KpY9byshDGnkExsqkK9jWX0oOS2vfvxL/0FnoAmvpbvXCHzuqJ/yZV6A6maIQ=="300
TXT"QuoVadis=deff4805-90a6-465d-b17a-5afc5423d9a1"300
TXT"_toe9qk71x823q6vlnaasyuqgbpngjyu"300
TXT"Dynatrace-site-verification=389d9739-a33a-4d96-9cf0-0067ff075548__brti5cfbhatu7c60oo9j5pebn"300
TXT"_v7nehon49slkcpzom29yh91fgbpwyj8"300
TXT"QuoVadis=a497d1e0-9ffd-48a1-a5bd-effa5d2a8790"300

Checks

  • ✓ TTLs within range #32
    TTLs: A 5m, MX 8h, NS 8h. The NS TTL at the parent is 1h and in the zone 8h; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35