huffingtonpost.com

Checked 22 October 2026, 09:13 UTC · via 8.8.8.8
!Passed with warnings
18 passed 4 warnings 0 failed 5 info

Registration

warn

.com generic · MarkMonitor Inc. · expires 2028-03-10

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
MarkMonitor Inc.
Registered
10 March 2005
Last changed
6 February 2026
Expires
10 March 2028
Status
active
Registry nameservers
ns-1205.awsdns-22.org, ns-2006.awsdns-58.co.uk, ns-287.awsdns-35.com, ns-559.awsdns-05.net
RDAP server
https://rdap.verisign.com/com/v1/
Lookup error: DNS query for com failed: read udp 46.225.38.91:54670->8.8.8.8:53: i/o timeout

Checks

  • i
    Could not be checked
    The TLD lookup failed, so this could not be checked: DNS query for com failed: read udp 46.225.38.91:54670->8.8.8.8:53: i/o timeout
    #1
  • !
    TLD not DNSSEC-signed
    The root has no DS record for .com, so DNSSEC for domains under it can't be validated.
    #2
  • ✓ Expires on 2028-03-10 #3
    The registration is valid until 2028-03-10 (505 days).
  • i
    No transfer lock
    The domain has no transfer lock (status: active). A registrar lock protects against unauthorized transfers.
    #4

Delegation

info

finding the parent zone of huffingtonpost.com: DNS query for com failed: read udp 46.225.38.91:41819->8.8.8.8:53: i/o timeout

Found

NS in the zone
ns-1205.awsdns-22.org, ns-2006.awsdns-58.co.uk, ns-287.awsdns-35.com, ns-559.awsdns-05.net
NameserverAddressesNetwork (AS)Glue
ns-1205.awsdns-22.org (zone only)205.251.196.181 2600:9000:5304:b500::1AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US-
ns-2006.awsdns-58.co.uk (zone only)205.251.199.214 2600:9000:5307:d600::1AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US-
ns-287.awsdns-35.com (zone only)205.251.193.31 2600:9000:5301:1f00::1AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US-
ns-559.awsdns-05.net (zone only)205.251.194.47 2600:9000:5302:2f00::1AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US-

Checks

  • i
    Could not be checked
    The delegation lookup failed, so this could not be checked: finding the parent zone of huffingtonpost.com: DNS query for com failed: read udp 46.225.38.91:41819->8.8.8.8:53: i/o timeout
    #6
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 4 IPv4 /24s and 4 IPv6 /48s.
  • i
    All nameservers in one AS
    All nameserver addresses are announced by one network operator (AS16509 (AMAZON-02 - Amazon.com, Inc., US): 8 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.
    #11
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

pass

8 of 8 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns-1205.awsdns-22.org 205.251.196.181NOERROR, 3 ms, authoritativenoyes / yesrefused-
ns-1205.awsdns-22.org 2600:9000:5304:b500::1NOERROR, 4 ms, authoritativenoyes / yesrefused-
ns-2006.awsdns-58.co.uk 205.251.199.214NOERROR, 9 ms, authoritativenoyes / yesrefused-
ns-2006.awsdns-58.co.uk 2600:9000:5307:d600::1NOERROR, 9 ms, authoritativenoyes / yesrefused-
ns-287.awsdns-35.com 205.251.193.31NOERROR, 9 ms, authoritativenoyes / yesrefused-
ns-287.awsdns-35.com 2600:9000:5301:1f00::1NOERROR, 9 ms, authoritativenoyes / yesrefused-
ns-559.awsdns-05.net 205.251.194.47NOERROR, 4 ms, authoritativenoyes / yesrefused-
ns-559.awsdns-05.net 2600:9000:5302:2f00::1NOERROR, 4 ms, authoritativenoyes / yesrefused-

Checks

  • ✓ All respond #14
    All 8 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • ✓ No version disclosed #17
    The nameservers don't reveal their software version.
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

warn

serial 1 · primary huffingtonpost.com

Found

Primary (MNAME)
huffingtonpost.com
Contact (RNAME)
awsdns-hostmaster.amazon.com
Serial
1
Refresh / retry
28800 s / 900 s
Expire
604800 s
Negative TTL
60 s

Serial per nameserver

NameserverSerial
ns-1205.awsdns-22.org (205.251.196.181)1
ns-1205.awsdns-22.org (2600:9000:5304:b500::1)1
ns-2006.awsdns-58.co.uk (205.251.199.214)1
ns-2006.awsdns-58.co.uk (2600:9000:5307:d600::1)1
ns-287.awsdns-35.com (205.251.193.31)1
ns-287.awsdns-35.com (2600:9000:5301:1f00::1)1
ns-559.awsdns-05.net (205.251.194.47)1
ns-559.awsdns-05.net (2600:9000:5302:2f00::1)1

Checks

  • ✓ Serial 1 everywhere #22
    All nameservers serve the same version of the zone.
  • !
    Unusual SOA timers
    negative caching TTL (minimum) 1m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 8h, retry 15m, expire 7d, negative TTL 1m.
    #23
  • i
    Hidden master
    The primary nameserver huffingtonpost.com is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.
    #24
  • ✓ Contact awsdns-hostmaster@amazon.com #25
    The SOA RNAME awsdns-hostmaster.amazon.com means awsdns-hostmaster@amazon.com.
  • ✓ Counter serial #26
    The serial 1 is a plain counter.

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

27 records at the apex

Found

Read from
205.251.196.181:53
TypeValueTTL
SOAhuffingtonpost.com. awsdns-hostmaster.amazon.com. 1 28800 900 604800 6030
NSns-1205.awsdns-22.org.172800
NSns-2006.awsdns-58.co.uk.172800
NSns-287.awsdns-35.com.172800
NSns-559.awsdns-05.net.172800
A13.32.121.7660
A13.32.121.2060
A13.32.121.7960
A13.32.121.3960
MX1 aspmx.l.google.com.3600
MX10 alt3.aspmx.l.google.com.3600
MX10 alt4.aspmx.l.google.com.3600
MX5 alt1.aspmx.l.google.com.3600
MX5 alt2.aspmx.l.google.com.3600
TXT"_amazonses.huffingtonpost.com:Ymj5A72/0+8fWyJoUb4+sbAmempNyKaefa5cPtM7+fo="12096000
TXT"docusign=803bb1d1-ca00-4828-9d0d-958294911d50"12096000
TXT"dropbox-domain-verification=uncn7ru3lk5v"12096000
TXT"facebook-domain-verification=g0p5wv14z89jccwlf5dsz1kprzffff"12096000
TXT"google-site-verification=2gqirxtTfQnbuBxqItMEYhPDLHI3aETO2cuv4TZ5gI4"12096000
TXT"sjvw8kcp29jmrzqy6w30vj9xxcw0l2lt"12096000
TXT"spf2.0/pra include:_spf.createsend.com include:aspmx.sailthru.com include:_spf.google.com include:amazonses.com ip4:74.205.21.242 ip4:149.174.0.0/16 ip4:64.236.0.0/16 ip4:204.29.186.0/23 ~all"12096000
TXT"v=spf1 mx include:_spf.createsend.com include:aspmx.sailthru.com include:_spf.google.com include:amazonses.com ip4:74.205.21.242 ip4:149.174.0.0/16 ip4:64.236.0.0/16 ip4:204.29.186.0/23 ip4:148.163.135.35/32 ip4:148.163.139.55/32 ~all"12096000
CAA0 iodef "mailto:security@verizonmedia.com"3600
CAA0 issue "amazon.com"3600
CAA0 issue "digicert.com"3600
CAA0 issue "globalsign.com"3600
CAA0 issue "letsencrypt.org"3600

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (1m). Low TTLs are useful just before a planned change.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • ✓ CAA restricts issuance #35
    Certificates may be issued by: amazon.com, digicert.com, globalsign.com, letsencrypt.org.