Domain report: eizo.de

Registration

info

.de country-code

Found

TLD: .de (country-code)
ICANN policies apply: no

Checks

i

.de is a country-code TLD (ccTLD)

Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.

#1
✓ TLD delegated and signed #2

.de is delegated in the root zone and DNSSEC-signed.
i

Registration data not available

No registration data via RDAP: the registry of .de offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.

#3

Delegation

warn

dns-b.iij.ad.jp, dns-c.iij.ad.jp

Found

Parent zone: de
Delegation from: a.nic.de (194.0.0.53)
NS at the parent: dns-b.iij.ad.jp, dns-c.iij.ad.jp
NS in the zone: ns020-v1il3tso4odiu1sn.v.d-53.info, ns020-v1il3tso4odiu1sn.v.d-53.jp, ns020-v1il3tso4odiu1sn.v.d-53.net

Nameserver	Addresses	Network (AS)	Glue
dns-b.iij.ad.jp (parent only)	202.32.219.51 2001:240:bb81::28:51	AS2497 IIJ - Internet Initiative Japan Inc., JP AS2497 IIJ - Internet Initiative Japan Inc., JP	-
dns-c.iij.ad.jp (parent only)	210.138.20.111 2001:240:bb81::29:111	AS2497 IIJ - Internet Initiative Japan Inc., JP AS2497 IIJ - Internet Initiative Japan Inc., JP	-
ns020-v1il3tso4odiu1sn.v.d-53.info (zone only)	202.32.219.51 2001:240:bb81::28:51	AS2497 IIJ - Internet Initiative Japan Inc., JP AS2497 IIJ - Internet Initiative Japan Inc., JP	-
ns020-v1il3tso4odiu1sn.v.d-53.jp (zone only)	203.180.146.111 2001:240:bb81::29:1111	AS2497 IIJ - Internet Initiative Japan Inc., JP AS2497 IIJ - Internet Initiative Japan Inc., JP	-
ns020-v1il3tso4odiu1sn.v.d-53.net (zone only)	210.138.20.111 2001:240:bb81::29:111	AS2497 IIJ - Internet Initiative Japan Inc., JP AS2497 IIJ - Internet Initiative Japan Inc., JP	-

Checks

i

2 nameservers

Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: dns-b.iij.ad.jp, dns-c.iij.ad.jp.

#6
!

NS sets differ

The nameservers at the parent and in the zone should be the same. Only at the parent: dns-b.iij.ad.jp, dns-c.iij.ad.jp; only in the zone: ns020-v1il3tso4odiu1sn.v.d-53.info, ns020-v1il3tso4odiu1sn.v.d-53.jp, ns020-v1il3tso4odiu1sn.v.d-53.net. dns-b.iij.ad.jp, dns-c.iij.ad.jp, ns020-v1il3tso4odiu1sn.v.d-53.info, ns020-v1il3tso4odiu1sn.v.d-53.jp, ns020-v1il3tso4odiu1sn.v.d-53.net report NS ns020-v1il3tso4odiu1sn.v.d-53.info ns020-v1il3tso4odiu1sn.v.d-53.jp ns020-v1il3tso4odiu1sn.v.d-53.net.

#7
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
i

One address family in one network

all IPv6 addresses are in 2001:240:bb81::/48, while the other address family is spread over several networks.

#10
i

All nameservers in one AS

All nameserver addresses are announced by one network operator (AS2497 (IIJ - Internet Initiative Japan Inc., JP): 10 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.

#11
i

All nameserver names under .jp

All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

#12
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

Nameservers

fail

10 of 10 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
dns-b.iij.ad.jp 202.32.219.51	NOERROR, 207 ms, authoritative	no	yes / yes	refused	-
dns-b.iij.ad.jp 2001:240:bb81::28:51	NOERROR, 237 ms, authoritative	no	yes / yes	refused	-
dns-c.iij.ad.jp 210.138.20.111	NOERROR, 17 ms, authoritative	no	yes / yes	refused	IIJ_DNS_PLATFORM_SERVICE_K
dns-c.iij.ad.jp 2001:240:bb81::29:111	NOERROR, 22 ms, authoritative	no	no / yes	refused	IIJ_DNS_PLATFORM_SERVICE_K
ns020-v1il3tso4odiu1sn.v.d-53.info 202.32.219.51	NOERROR, 207 ms, authoritative	no	yes / yes	refused	-
ns020-v1il3tso4odiu1sn.v.d-53.info 2001:240:bb81::28:51	NOERROR, 238 ms, authoritative	no	yes / yes	refused	-
ns020-v1il3tso4odiu1sn.v.d-53.jp 203.180.146.111	NOERROR, 20 ms, authoritative	no	yes / yes	refused	IIJ_DNS_PLATFORM_SERVICE_K
ns020-v1il3tso4odiu1sn.v.d-53.jp 2001:240:bb81::29:1111	NOERROR, 24 ms, authoritative	no	no / yes	refused	IIJ_DNS_PLATFORM_SERVICE_K
ns020-v1il3tso4odiu1sn.v.d-53.net 210.138.20.111	NOERROR, 17 ms, authoritative	no	yes / yes	refused	IIJ_DNS_PLATFORM_SERVICE_K
ns020-v1il3tso4odiu1sn.v.d-53.net 2001:240:bb81::29:111	NOERROR, 21 ms, authoritative	no	no / yes	refused	IIJ_DNS_PLATFORM_SERVICE_K

Checks

✓ All respond #14

All 10 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
i

Identifying string disclosed

These nameservers answer version queries with a string that is not a version number: dns-c.iij.ad.jp: "IIJ_DNS_PLATFORM_SERVICE_K"; ns020-v1il3tso4odiu1sn.v.d-53.jp: "IIJ_DNS_PLATFORM_SERVICE_K"; ns020-v1il3tso4odiu1sn.v.d-53.net: "IIJ_DNS_PLATFORM_SERVICE_K".

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✗

No DNS over TCP

DNS over TCP is required (RFC 7766); without it, large answers such as DNSSEC responses fail. Not answering over TCP: dns-c.iij.ad.jp (2001:240:bb81::29:111): read tcp [2a01:4f8:1c1c:eebf::1]:33818->[2001:240:bb81::29:111]:53: read: connection reset by peer; ns020-v1il3tso4odiu1sn.v.d-53.jp (2001:240:bb81::29:1111): read tcp [2a01:4f8:1c1c:eebf::1]:52284->[2001:240:bb81::29:1111]:53: read: connection reset by peer; ns020-v1il3tso4odiu1sn.v.d-53.net (2001:240:bb81::29:111): read tcp [2a01:4f8:1c1c:eebf::1]:33834->[2001:240:bb81::29:111]:53: read: connection reset by peer.

#19
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

info

serial 359 · primary ns000.d-53.net

Found

Primary (MNAME): ns000.d-53.net
Contact (RNAME): dns-managers.iij.ad.jp
Serial: 359
Refresh / retry: 3600 s / 600 s
Expire: 604800 s
Negative TTL: 900 s

Serial per nameserver

Nameserver	Serial
dns-b.iij.ad.jp (202.32.219.51)	359
dns-b.iij.ad.jp (2001:240:bb81::28:51)	359
dns-c.iij.ad.jp (210.138.20.111)	359
dns-c.iij.ad.jp (2001:240:bb81::29:111)	359
ns020-v1il3tso4odiu1sn.v.d-53.info (202.32.219.51)	359
ns020-v1il3tso4odiu1sn.v.d-53.info (2001:240:bb81::28:51)	359
ns020-v1il3tso4odiu1sn.v.d-53.jp (203.180.146.111)	359
ns020-v1il3tso4odiu1sn.v.d-53.jp (2001:240:bb81::29:1111)	359
ns020-v1il3tso4odiu1sn.v.d-53.net (210.138.20.111)	359
ns020-v1il3tso4odiu1sn.v.d-53.net (2001:240:bb81::29:111)	359

Checks

✓ Serial 359 everywhere #22

All nameservers serve the same version of the zone.
✓ Timers within recommendations #23

SOA refresh 1h, retry 10m, expire 7d, negative TTL 15m.
i

Hidden master (not resolvable)

The primary nameserver ns000.d-53.net is not listed as a nameserver and does not resolve publicly: a hidden master, or a placeholder name. Some tools (e.g. dynamic updates) use MNAME to find the primary.

#24
✓ Contact dns-managers@iij.ad.jp #25

The SOA RNAME dns-managers.iij.ad.jp means dns-managers@iij.ad.jp.
✓ Counter serial #26

The serial 359 is a plain counter.

DNSSEC

warn

Signed, but no DS at parent

Found

Validated by resolver: no
Denial of existence: NSEC3
NSEC3: 0 iterations, 0-byte salt
Signatures valid until: 5 November 2026

DNSKEY in the zone

Key tag	Role	Algorithm
13000	ZSK (256)	ECDSAP256SHA256 (13)
33003	KSK (257)	ECDSAP256SHA256 (13)

Checks

!

Signed but not delegated securely

The zone is signed but the parent has no DS record, so the signatures are not used. Publish the DS record at your registrar.

#27
✓ Modern algorithms #29

Key algorithms: ECDSAP256SHA256 (13).
✓ Signatures valid until 2026-11-05 #30

The earliest DNSKEY/SOA signature expires at 2026-11-05 18:16 UTC.
✓ NSEC3 as recommended #31

The zone uses NSEC3 with 0 iterations and no salt (RFC 9276).

Records

info

8 records at the apex

Found

Read from: 202.32.219.51:53

Type	Value	TTL
SOA	ns000.d-53.net. dns-managers.iij.ad.jp. 359 3600 600 604800 900	300
NS	ns020-v1il3tso4odiu1sn.v.d-53.info.	300
NS	ns020-v1il3tso4odiu1sn.v.d-53.jp.	300
NS	ns020-v1il3tso4odiu1sn.v.d-53.net.	300
A	77.220.253.77	300
MX	0 eizo-de.mail.protection.outlook.com.	3600
TXT	"MS=ms27662554"	3600
TXT	"v=spf1 ip4:217.89.41.122 ip4:12.9.139.96 ip4:77.220.252.115 include:spf.protection.outlook.com ~all"	3600

Checks

✓ TTLs within range #32

TTLs: A 5m, MX 1h, NS 5m. The NS TTL at the parent is 1d and in the zone 5m; resolvers may use either.
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35