insee.fr

Checked 22 October 2026, 03:30 UTC · via 8.8.8.8
✗Problems found
28 passed 2 warnings 1 failed 4 info

Registration

fail

.fr country-code · CSC CORPORATE DOMAINS INC. · expires 2026-10-28

Found

TLD
.fr (country-code)
ICANN policies apply
no
Registrar
CSC CORPORATE DOMAINS INC.
Registered
6 May 1996
Last changed
25 February 2026
Expires
28 October 2026
Status
server update prohibited, server transfer prohibited, server delete prohibited, server recover prohibited
Registry nameservers
ns1.insee.fr, ns2.insee.fr, nsa.perf1.fr, nsb.perf1.com, nsc.perf1.com
RDAP server
https://rdap.nic.fr/

Checks

  • i
    .fr is a country-code TLD (ccTLD)
    Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.
    #1
  • ✓ TLD delegated and signed #2
    .fr is delegated in the root zone and DNSSEC-signed.
  • ✗
    Expires in 6 days
    The registration expires on 2026-10-28. Renew it now or enable auto-renewal.
    #3
  • ✓ Transfer locked #4
    Registry status: server update prohibited, server transfer prohibited, server delete prohibited, server recover prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

ns1.insee.fr, ns2.insee.fr, nsa.perf1.fr, nsb.perf1.com, nsc.perf1.com

Found

Parent zone
fr
Delegation from
d.nic.fr (194.0.9.1)
NS at the parent
ns1.insee.fr, ns2.insee.fr, nsa.perf1.fr, nsb.perf1.com, nsc.perf1.com
NS in the zone
ns1.insee.fr, ns2.insee.fr, nsa.perf1.fr, nsb.perf1.com, nsc.perf1.com
NameserverAddressesNetwork (AS)Glue
ns1.insee.fr194.254.37.129AS2200 FR-RENATER - Renater, FR194.254.37.129
ns2.insee.fr143.196.255.130AS60855 DISIC-RIE-AS - LA DIRECTION INTERMINISTERIELLE DU NUMERIQUE, FR143.196.255.130
nsa.perf1.fr81.92.94.100 2a01:c8:100::100AS20756 NAMESHIELD - NAMESHIELD SAS, FR AS20756 NAMESHIELD - NAMESHIELD SAS, FR81.92.94.100 2a01:c8:100::100
nsb.perf1.com81.92.95.100 2a01:c8:101::100AS20756 NAMESHIELD - NAMESHIELD SAS, FR AS20756 NAMESHIELD - NAMESHIELD SAS, FR-
nsc.perf1.com152.89.172.100 2a09:35c0:102::100AS209510 NAMESHIELDGRP - NAMESHIELD SAS, FR AS209510 NAMESHIELDGRP - NAMESHIELD SAS, FR-

Checks

  • ✓ 5 nameservers #6
    Delegated to ns1.insee.fr, ns2.insee.fr, nsa.perf1.fr, nsb.perf1.com, nsc.perf1.com.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ Glue present and correct #8
    Glue is published for the nameservers inside the zone: ns1.insee.fr, ns2.insee.fr.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 5 IPv4 /24s and 3 IPv6 /48s.
  • ✓ 4 autonomous systems #11
    The nameservers are spread over: AS20756 (NAMESHIELD - NAMESHIELD SAS, FR): 4 addresses; AS209510 (NAMESHIELDGRP - NAMESHIELD SAS, FR): 2 addresses; AS2200 (FR-RENATER - Renater, FR): 1 address; AS60855 (DISIC-RIE-AS - LA DIRECTION INTERMINISTERIELLE DU NUMERIQUE, FR): 1 address.
  • ✓ Nameserver names under 2 TLDs #12
    Nameserver names use the TLDs .com, .fr.
  • i
    Partly IPv6
    These nameservers have no IPv6 address: ns1.insee.fr, ns2.insee.fr.
    #13

Nameservers

info

8 of 8 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns1.insee.fr 194.254.37.129NOERROR, 15 ms, authoritativenoyes / yesrefused-
ns2.insee.fr 143.196.255.130NOERROR, 30 ms, authoritativenoyes / yesrefused-
nsa.perf1.fr 81.92.94.100NOERROR, 4 ms, authoritativenoyes / yesrefusedSecure
nsa.perf1.fr 2a01:c8:100::100NOERROR, 4 ms, authoritativenoyes / yesrefusedSecure
nsb.perf1.com 81.92.95.100NOERROR, 3 ms, authoritativenoyes / yesrefusedSecure
nsb.perf1.com 2a01:c8:101::100NOERROR, 3 ms, authoritativenoyes / yesrefusedSecure
nsc.perf1.com 152.89.172.100NOERROR, 4 ms, authoritativenoyes / yesrefusedSecure
nsc.perf1.com 2a09:35c0:102::100NOERROR, 4 ms, authoritativenoyes / yesrefusedSecure

Checks

  • ✓ All respond #14
    All 8 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • i
    Identifying string disclosed
    These nameservers answer version queries with a string that is not a version number: nsa.perf1.fr: "Secure"; nsb.perf1.com: "Secure"; nsc.perf1.com: "Secure".
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

warn

serial 2026068506 · primary ns1.insee.fr

Found

Primary (MNAME)
ns1.insee.fr
Contact (RNAME)
postmaster.insee.fr
Serial
2026068506
Refresh / retry
43200 s / 7200 s
Expire
2400000 s
Negative TTL
86400 s

Serial per nameserver

NameserverSerial
ns1.insee.fr (194.254.37.129)2026068506
ns2.insee.fr (143.196.255.130)2026068507
nsa.perf1.fr (81.92.94.100)2026068506
nsa.perf1.fr (2a01:c8:100::100)2026068506
nsb.perf1.com (81.92.95.100)2026068506
nsb.perf1.com (2a01:c8:101::100)2026068506
nsc.perf1.com (152.89.172.100)2026068506
nsc.perf1.com (2a09:35c0:102::100)2026068506

Checks

  • !
    Serials differ
    The nameservers serve different versions of the zone: 2026068506 on ns1.insee.fr (194.254.37.129), nsa.perf1.fr (81.92.94.100), nsa.perf1.fr (2a01:c8:100::100), nsb.perf1.com (81.92.95.100), nsb.perf1.com (2a01:c8:101::100), nsc.perf1.com (152.89.172.100), nsc.perf1.com (2a09:35c0:102::100); 2026068507 on ns2.insee.fr (143.196.255.130). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.
    #22
  • ✓ Timers within recommendations #23
    SOA refresh 12h, retry 2h, expire 40000m, negative TTL 1d.
  • ✓ Primary is a public nameserver #24
    The primary nameserver ns1.insee.fr is one of the listed nameservers.
  • ✓ Contact postmaster@insee.fr #25
    The SOA RNAME postmaster.insee.fr means postmaster@insee.fr.
  • ✓ Timestamp serial #26
    The serial 2026068506 is a Unix timestamp (2034-03-15 20:48 UTC).

DNSSEC

warn

Signed, DS published at parent

Found

Validated by resolver
yes
Denial of existence
NSEC3
NSEC3
0 iterations, 16-byte salt
Signatures valid until
13 November 2026

DS at the parent

Key tagAlgorithmDigestMatches a key
52761ECDSAP256SHA256 (13)SHA256 A239048EC3354BF7…yes
15493ECDSAP256SHA256 (13)SHA256 8CC206CC114BFBDD…yes

DNSKEY in the zone

Key tagRoleAlgorithm
47480ZSK (256)ECDSAP256SHA256 (13)
35702ZSK (256)ECDSAP256SHA256 (13)
52761KSK (257)ECDSAP256SHA256 (13)
19673ZSK (256)ECDSAP384SHA384 (14)
35175ZSK (256)ECDSAP384SHA384 (14)
15493KSK (257)ECDSAP256SHA256 (13)

Checks

  • ✓ Signed and validated #27
    The zone is signed, the parent publishes a DS record, and the resolver validates the answers.
  • ✓ DS matches a key #28
    The DS record at the parent matches a key in the zone: key tag 52761 (SHA256), key tag 15493 (SHA256).
  • ✓ Modern algorithms #29
    Key algorithms: ECDSAP256SHA256 (13), ECDSAP384SHA384 (14).
  • ✓ Signatures valid until 2026-11-13 #30
    The earliest DNSKEY/SOA signature expires at 2026-11-13 17:41 UTC.
  • !
    NSEC3 with extra iterations or salt
    NSEC3 uses 0 iterations and a 16-byte salt. RFC 9276 recommends 0 iterations and no salt: extra iterations cost resolvers CPU and add no real protection, and some validators treat high counts as insecure.
    #31

Records

info

16 records at the apex

Found

Read from
194.254.37.129:53
TypeValueTTL
SOAns1.insee.fr. postmaster.insee.fr. 2026068506 43200 7200 2400000 86400900
NSnsa.perf1.fr.900
NSns1.insee.fr.900
NSnsb.perf1.com.900
NSnsc.perf1.com.900
NSns2.insee.fr.900
A194.254.37.163900
MX10 freyja2.insee.fr.900
MX10 freyja.insee.fr.900
MX10 heimdall2.insee.fr.900
MX10 heimdall.insee.fr.900
TXT"v=spf1 ip4:194.254.37.152 ip4:143.196.255.150 ip4:194.254.37.232 ip4:143.196.255.183 ip4:194.254.37.151 ip4:143.196.255.151 ip4:194.254.37.153 ip4:143.196.255.153 -all"900
TXT"_github-challenge-inseefr"900
TXT"google-site-verification=53P2IH4qpas0FyydHON7c4SPIw3tfivf_gQfxIFZWdM"900
TXT"ZOOM_verify_1-v6iuNwQ4Od26zPcC_5rA"900
TXT"intranet"900

Checks

  • ✓ TTLs within range #32
    TTLs: A 15m, MX 15m, NS 15m. The NS TTL at the parent is 1h and in the zone 15m; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35