hema.nl

Checked 21 October 2026, 21:21 UTC · via 8.8.8.8
!Passed with warnings
26 passed 3 warnings 0 failed 6 info

Registration

warn

.nl country-code · Novagraaf Nederland B.V.

Found

TLD
.nl (country-code)
ICANN policies apply
no
Registrar
Novagraaf Nederland B.V.
Registered
19 June 1995
Last changed
11 December 2025
Status
locked
Registry nameservers
ns01.brandshelter.com, ns02.brandshelter.net
RDAP server
https://rdap.sidn.nl/
Lookup error: DNS query for nl failed: read udp 46.225.38.91:55657->8.8.8.8:53: i/o timeout

Checks

  • i
    Could not be checked
    The TLD lookup failed, so this could not be checked: DNS query for nl failed: read udp 46.225.38.91:55657->8.8.8.8:53: i/o timeout
    #1
  • !
    TLD not DNSSEC-signed
    The root has no DS record for .nl, so DNSSEC for domains under it can't be validated.
    #2
  • i
    Expiry date not published
    The registry does not publish the expiry date in RDAP. Check it with your registrar.
    #3
  • ✓ Transfer locked #4
    Registry status: locked.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

ns01.brandshelter.com, ns02.brandshelter.net

Found

Parent zone
nl
Delegation from
ns1.dns.nl (2001:678:2c:0:194:0:28:53)
NS at the parent
ns01.brandshelter.com, ns02.brandshelter.net
NS in the zone
ns01.brandshelter.com, ns02.brandshelter.net
NameserverAddressesNetwork (AS)Glue
ns01.brandshelter.com193.227.117.15 2a04:2b00:14cc::15- AS1921 RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT-
ns02.brandshelter.net194.50.187.16 2a04:2b00:14dd::16- AS1921 RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT-

Checks

  • i
    2 nameservers
    Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: ns01.brandshelter.com, ns02.brandshelter.net.
    #6
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 2 IPv4 /24s and 2 IPv6 /48s.
  • i
    All nameservers in one AS
    All nameserver addresses are announced by one network operator (AS1921 (RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT): 2 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.
    #11
  • ✓ Nameserver names under 2 TLDs #12
    Nameserver names use the TLDs .com, .net.
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

info

4 of 4 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns01.brandshelter.com 193.227.117.15NOERROR, 5 ms, authoritativenoyes / yesrefusedRcodeZero DNS
ns01.brandshelter.com 2a04:2b00:14cc::15NOERROR, 4 ms, authoritativenoyes / yesrefusedRcodeZero DNS
ns02.brandshelter.net 194.50.187.16NOERROR, 12 ms, authoritativenoyes / yesrefusedreg-wie1
ns02.brandshelter.net 2a04:2b00:14dd::16NOERROR, 12 ms, authoritativenoyes / yesrefusedreg-wie1

Checks

  • ✓ All respond #14
    All 4 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • i
    Identifying string disclosed
    These nameservers answer version queries with a string that is not a version number: ns01.brandshelter.com: "RcodeZero DNS"; ns02.brandshelter.net: "reg-wie1".
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 2026104864 · primary ns01.brandshelter.com

Found

Primary (MNAME)
ns01.brandshelter.com
Contact (RNAME)
tech.brandshelter.com
Serial
2026104864
Refresh / retry
10800 s / 3600 s
Expire
604800 s
Negative TTL
300 s

Serial per nameserver

NameserverSerial
ns01.brandshelter.com (193.227.117.15)2026104864
ns01.brandshelter.com (2a04:2b00:14cc::15)2026104864
ns02.brandshelter.net (194.50.187.16)2026104864
ns02.brandshelter.net (2a04:2b00:14dd::16)2026104864

Checks

  • ✓ Serial 2026104864 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 3h, retry 1h, expire 7d, negative TTL 5m.
  • ✓ Primary is a public nameserver #24
    The primary nameserver ns01.brandshelter.com is one of the listed nameservers.
  • ✓ Contact tech@brandshelter.com #25
    The SOA RNAME tech.brandshelter.com means tech@brandshelter.com.
  • ✓ Timestamp serial #26
    The serial 2026104864 is a Unix timestamp (2034-03-16 06:54 UTC).

DNSSEC

warn

Signed, DS published at parent

Found

Validated by resolver
no
Denial of existence
NSEC3
NSEC3
0 iterations, 0-byte salt
Signatures valid until
29 October 2026

DS at the parent

Key tagAlgorithmDigestMatches a key
40110ECDSAP256SHA256 (13)SHA256 AC2EDDEF08FB29E6…yes

DNSKEY in the zone

Key tagRoleAlgorithm
37528ZSK (256)ECDSAP256SHA256 (13)
12449ZSK (256)ECDSAP256SHA256 (13)
40110KSK (257)ECDSAP256SHA256 (13)

Checks

  • !
    Signed, not validated by the resolver
    The zone is signed and has a DS record, but the resolver did not mark the answer as validated. The resolver may not validate, or the TLD is not signed.
    #27
  • ✓ DS matches a key #28
    The DS record at the parent matches a key in the zone: key tag 40110 (SHA256).
  • ✓ Modern algorithms #29
    Key algorithms: ECDSAP256SHA256 (13).
  • ✓ Signatures valid until 2026-10-29 #30
    The earliest DNSKEY/SOA signature expires at 2026-10-29 00:00 UTC.
  • ✓ NSEC3 as recommended #31
    The zone uses NSEC3 with 0 iterations and no salt (RFC 9276).

Records

warn

39 records at the apex

Found

Read from
193.227.117.15:53
TypeValueTTL
SOAns01.brandshelter.com. tech.brandshelter.com. 2026104864 10800 3600 604800 3003600
NSns01.brandshelter.com.3600
NSns02.brandshelter.net.3600
A104.18.35.8260
A172.64.152.17460
MX50 hema-nl.mail.protection.outlook.com.300
TXT"MS=ms94111838"300
TXT"cenuts613ecroj2ljvhto5bn5l"300
TXT"flnnbp6rge5mreb9neq3f29grh"300
TXT"s8o0972mgjlqa2e88bmghtf55i"300
TXT"6f68faf895f64bc16553b181033121ba.hema.nl"300
TXT"apple-domain-verification=JUJC2KdlNBWkUkVJ"300
TXT"docusign=72d61cd3-47da-4998-8808-beaf53a769bb"300
TXT"airtable-verification=d2908e00af7d626afc213b228f3a0dde"300
TXT"amazonses:yaZg1a7njIbNAhIQvU7IxOjXVrlGiu4WVjPGTDrU/lI="300
TXT"openai-domain-verification=dv-KGiXtPpcoaFXtZO3Dvh2X994"300
TXT"miro-verification=39fbc1e6894e7e9dc4a92550aa2d58cb04c8a004"300
TXT"facebook-domain-verification=hxw42zbs0dtvs52twttz0wxzxie65s"300
TXT"anthropic-domain-verification-f57w7x=X74BevZbRqsOPimbEvYsZYcXC"300
TXT"google-site-verification=-Tt8lLNNk_ypS5CsFMBnjfFJlNsZGYl81ELH3NJIkeQ"300
TXT"google-site-verification=-kLzlLddDxdH4DoKJwJOXQnov9hQ_JuswT5_W8zb7jU"300
TXT"google-site-verification=0Oh7Ig9mWflKc-DCBIUSPTtkj8IUdoJfM5b_8qaUn7o"300
TXT"google-site-verification=0m9Qx2ygi5v6OX4xF5PsbaUca8NWfGtVXOTDgOG34g0"300
TXT"google-site-verification=1bbqclOHes_tqySNnhY6qMqDGSN3svewKNe_j28PtNs"300
TXT"google-site-verification=GZTwbsNQMhn8R5YCtOOJT1XtF1D9r8Bubg0F4ecSYbU"300
TXT"google-site-verification=GqZkYCQGI7rdm3LlxjwfKPdEITAty8DHVy0f9RSA9UY"300
TXT"google-site-verification=Ht0Lpc3sG4S9r4ieaQvGwI6sxXjuOaN7_Vpaqej9uQE"300
TXT"google-site-verification=af0yp9cx-ospknnnymltckxylbykkwwldyeh5pmzqde"300
TXT"google-site-verification=dZyhLps3ksLW1Rm-x0HJhK1gwh3OpeVN2gUTDT5GnCI"300
TXT"google-site-verification=hPU11ksrs2NWw89Hjkidwuu8WXvxxbpT273kP2ylNzw"300
TXT"google-site-verification=mbRgAwBRxbBM-WScRSmYeYDoTQFZ1nL0G-RWrMMJFfk"300
TXT"google-site-verification=pMw9npE3W21XQLRTJHgk8QS0Q7xq1teZ4r6cP5A6828"300
TXT"google-site-verification=t9EHcsmn2_KKEo5ok0LxMwtwq9zkkHseJ6-DZay2HM4"300
TXT"apple-domain-verification=2hbjdcWq-S6FhixaX5Gax6nPrvlfUIE8hqSU6UWaXss"300
TXT"atlassian-sending-domain-verification=3c3a162c-9934-4cf0-ac4d-7c639c704c7c"300
TXT"atlassian-sending-domain-verification=eaf185a6-1d01-434f-add9-1ba50ddeab63"300
TXT"pzu5m5QTMeJVcUYoMimWThN02FRWaS8nynBBCSJA5V4m4SNLL94cKaSpL1Kg3pUy0BLIkEewB2jweeq0nNHW5A=="300
TXT"atlassian-domain-verification=cNLKyjAr2m6jakHaSxFyQdSo2qDoXyf7mdhYYdbZmoraHb2sO//C4tqLZ2t3l9kA"300
TXT"v=spf1 mx ip4:87.233.130.50 ip4:87.233.130.51 ip4:87.233.74.18 ip4:87.233.206.102 ip4:87.233.206.103 ip4:89.146.27.182 ip4:212.23.130.0/28 ip4:217.115.148.192/27 ip4:5.196.102.96/28 ip4:37.58.122.100 ip4:104.40.199.180 ip4:62.204.93.131 ip4:13.69.10.134 i" "p4:192.113.181.33 ip4:151.106.158.193 ip4:160.8.43.116 ip4:207.244.98.227 ip4:83.149.98.72 ip4:83.149.98.73 ip4:40.115.66.46 ip4:13.94.232.90 ip4:191.238.213.99 ip4:213.227.138.96/28 ip4:83.149.67.64/27 ip4:178.162.177.128/27 ip4:192.254.121.79 ip4:85.222" ".130.224/28 ip4:85.222.138.224/28 ip4:85.222.150.192/28 ip4:85.222.150.208/28 ip4:85.222.150.224/28 ip4:85.222.158.192/28 ip4:85.222.158.208/28 ip4:85.222.158.224/28 ip4:161.71.6.224/28 ip4:161.71.14.224/28 include:spf.emsecure.net include:sendgrid.net ip" "4:217.114.96.34/32 ip4:84.241.129.64/27 ip4:84.241.136.96/27 ip4:84.241.172.160/27 ip6:2001:1690:22:a00::/56 ip4:217.114.105.25 ip4:192.113.239.50 ip4:81.17.56.1 ip4:13.88.226.191 ip4:35.156.137.161 ip4:3.126.49.211 ip4:3.125.176.117 ip4:51.13.102.144 inc" "lude:spf.protection.outlook.com include:spf.flowmailer.net -all"300

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (1m). Low TTLs are useful just before a planned change.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35