kerkrade.nl

Checked 22 October 2026, 14:02 UTC · via 8.8.8.8
!Passed with warnings
29 passed 1 warning 0 failed 5 info

Registration

info

.nl country-code · Solido IT voor overheden

Found

TLD
.nl (country-code)
ICANN policies apply
no
Registrar
Solido IT voor overheden
Registered
19 August 1997
Last changed
23 June 2025
Status
active
Registry nameservers
ns1.d-zone.ca, ns2.d-zone.ca, sec1.rcode0.net, sec2.rcode0.net
RDAP server
https://rdap.sidn.nl/

Checks

  • i
    .nl is a country-code TLD (ccTLD)
    Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.
    #1
  • ✓ TLD delegated and signed #2
    .nl is delegated in the root zone and DNSSEC-signed.
  • i
    Expiry date not published
    The registry does not publish the expiry date in RDAP. Check it with your registrar.
    #3
  • i
    No transfer lock
    The domain has no transfer lock (status: active). A registrar lock protects against unauthorized transfers.
    #4
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

pass

ns1.d-zone.ca, ns2.d-zone.ca, sec1.rcode0.net, sec2.rcode0.net

Found

Parent zone
nl
Delegation from
ns1.dns.nl (194.0.28.53)
NS at the parent
ns1.d-zone.ca, ns2.d-zone.ca, sec1.rcode0.net, sec2.rcode0.net
NS in the zone
ns1.d-zone.ca, ns2.d-zone.ca, sec1.rcode0.net, sec2.rcode0.net
NameserverAddressesNetwork (AS)Glue
ns1.d-zone.ca162.219.54.2 2620:10a:80eb::2AS55195 CIRA-CLOUD1 - CIRA Canadian Internet Registration Authority Autorit Canadienne pour les enregistrements Internet, CA AS55195 CIRA-CLOUD1 - CIRA Canadian Internet Registration Authority Autorit Canadienne pour les enregistrements Internet, CA-
ns2.d-zone.ca162.219.55.2 2620:10a:80ec::2AS394354 CIRA-CLOUD2 - CIRA Canadian Internet Registration Authority Autorit Canadienne pour les enregistrements Internet, CA AS394354 CIRA-CLOUD2 - CIRA Canadian Internet Registration Authority Autorit Canadienne pour les enregistrements Internet, CA-
sec1.rcode0.net192.174.68.100 2001:67c:1bc::100AS1921 RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT AS1921 RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT-
sec2.rcode0.net176.97.158.100 2001:67c:10b8::100AS1921 RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT AS1921 RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT-

Checks

  • ✓ 4 nameservers #6
    Delegated to ns1.d-zone.ca, ns2.d-zone.ca, sec1.rcode0.net, sec2.rcode0.net.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 4 IPv4 /24s and 4 IPv6 /48s.
  • ✓ 3 autonomous systems #11
    The nameservers are spread over: AS1921 (RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT): 4 addresses; AS394354 (CIRA-CLOUD2 - CIRA Canadian Internet Registration Authority Autorit Canadienne pour les enregistrements Internet, CA): 2 addresses; AS55195 (CIRA-CLOUD1 - CIRA Canadian Internet Registration Authority Autorit Canadienne pour les enregistrements Internet, CA): 2 addresses.
  • ✓ Nameserver names under 2 TLDs #12
    Nameserver names use the TLDs .ca, .net.
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

info

8 of 8 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns1.d-zone.ca 162.219.54.2NOERROR, 13 ms, authoritativenoyes / yesrefusedCIRA Server
ns1.d-zone.ca 2620:10a:80eb::2NOERROR, 13 ms, authoritativenoyes / yesrefusedCIRA Server
ns2.d-zone.ca 162.219.55.2NOERROR, 4 ms, authoritativenoyes / yesrefusedCIRA Server
ns2.d-zone.ca 2620:10a:80ec::2NOERROR, 4 ms, authoritativenoyes / yesrefusedFRA D-ZONE nameserver
sec1.rcode0.net 192.174.68.100NOERROR, 9 ms, authoritativenoyes / yesrefusedRcodeZero DNS
sec1.rcode0.net 2001:67c:1bc::100NOERROR, 9 ms, authoritativenoyes / yesrefusedRcodeZero DNS
sec2.rcode0.net 176.97.158.100NOERROR, 13 ms, authoritativenoyes / yesrefusedreg-wie1
sec2.rcode0.net 2001:67c:10b8::100NOERROR, 12 ms, authoritativenoyes / yesrefusedreg-wie1

Checks

  • ✓ All respond #14
    All 8 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • i
    Identifying string disclosed
    These nameservers answer version queries with a string that is not a version number: ns1.d-zone.ca: "CIRA Server"; ns2.d-zone.ca: "CIRA Server"; ns2.d-zone.ca: "FRA D-ZONE nameserver"; sec1.rcode0.net: "RcodeZero DNS"; sec2.rcode0.net: "reg-wie1".
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 86064 · primary sec1.rcode0.net

Found

Primary (MNAME)
sec1.rcode0.net
Contact (RNAME)
hostmaster.as38915.net
Serial
86064
Refresh / retry
43200 s / 4320 s
Expire
2419200 s
Negative TTL
28800 s

Serial per nameserver

NameserverSerial
ns1.d-zone.ca (162.219.54.2)86064
ns1.d-zone.ca (2620:10a:80eb::2)86064
ns2.d-zone.ca (162.219.55.2)86064
ns2.d-zone.ca (2620:10a:80ec::2)86064
sec1.rcode0.net (192.174.68.100)86064
sec1.rcode0.net (2001:67c:1bc::100)86064
sec2.rcode0.net (176.97.158.100)86064
sec2.rcode0.net (2001:67c:10b8::100)86064

Checks

  • ✓ Serial 86064 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 12h, retry 72m, expire 28d, negative TTL 8h.
  • ✓ Primary is a public nameserver #24
    The primary nameserver sec1.rcode0.net is one of the listed nameservers.
  • ✓ Contact hostmaster@as38915.net #25
    The SOA RNAME hostmaster.as38915.net means hostmaster@as38915.net.
  • ✓ Counter serial #26
    The serial 86064 is a plain counter.

DNSSEC

warn

Signed, DS published at parent

Found

Validated by resolver
yes
Denial of existence
NSEC3
NSEC3
0 iterations, 0-byte salt
Signatures valid until
29 October 2026

DS at the parent

Key tagAlgorithmDigestMatches a key
18454ECDSAP256SHA256 (13)SHA256 318FD623408A05F1…yes

DNSKEY in the zone

Key tagRoleAlgorithm
11853ZSK (256)ECDSAP256SHA256 (13)
42626ZSK (256)ECDSAP256SHA256 (13)
13702ZSK (256)ECDSAP256SHA256 (13)
18454KSK (257)ECDSAP256SHA256 (13)

Checks

  • ✓ Signed and validated #27
    The zone is signed, the parent publishes a DS record, and the resolver validates the answers.
  • ✓ DS matches a key #28
    The DS record at the parent matches a key in the zone: key tag 18454 (SHA256).
  • ✓ Modern algorithms #29
    Key algorithms: ECDSAP256SHA256 (13).
  • !
    Signatures expire soon
    The earliest signature expires at 2026-10-29 10:50 UTC (in 165h0m0s). Check that automatic re-signing works.
    #30
  • ✓ NSEC3 as recommended #31
    The zone uses NSEC3 with 0 iterations and no salt (RFC 9276).

Records

info

47 records at the apex

Found

Read from
162.219.54.2:53
TypeValueTTL
SOAsec1.rcode0.net. hostmaster.as38915.net. 86064 43200 4320 2419200 2880028800
NSsec1.rcode0.net.28800
NSns2.d-zone.ca.28800
NSns1.d-zone.ca.28800
NSsec2.rcode0.net.28800
A54.72.60.20028800
A52.51.241.728800
A54.72.84.24328800
AAAA2a05:d018:995:4606:11:a561:a662:66bb28800
AAAA2a05:d018:995:4605:10:9b54:cd72:76b428800
AAAA2a05:d018:995:4607:12:4151:981a:a98328800
MX5 fm01.as38915.net.28800
MX5 fm02.as38915.net.28800
TXT"_17y6f6r8zxy1yhsim3wjiivp4rqwcpc"28800
TXT"GfHIQpsJfsw5srCeKgapiHRXvDJ3d6F2wWXu6LRzOoqrvcMkRZSxoXKcTrL5u9JL"28800
TXT"a53cd3b045ba7f4609110d0a82b232384c79346df3c4af1fc8cf8d9eda5134ea"28800
TXT"MS=ms37881788"28800
TXT"13d95357971ff3b32ad6933bf30b26e0bdc348846f866657bee1d78298b50af7"28800
TXT"bea97c67f68ff1cc64ddeff4417b16b6fb289c7f2a0087119b8847c8f58fcfd5"28800
TXT"PHtd1Xc9d7JlqatF6HIEfVqrWvrpA5dUgHKmQP6OY3tKYkHHUAFqLI3MdTCB3p4t"28800
TXT"aFfCzpi00qY2JuWODeFSCQyHIMDBMGgO56POFmmSDRERm1z2ULkcDlwSsSem7yXd"28800
TXT"4sS1y8mdoRhIWocUx8SSisb8o4gJzUAw4q6mPxZnsb0="28800
TXT"bastion365-domain-validation=6c353550d179f"28800
TXT"UCpRbCDAuVJOOyu7QAUxglBTQDOSGcQ7RAH5OoUUOXo2lIvC8y5O29GMgeKROuHm"28800
TXT"Uh1Lw8RX2OVuujU8fPDRwLAJJJwgQ4Q6jTGxH3YyjUxlOiH03C7irmFF2w3nbI4l"28800
TXT"Md7bOepuVz4sckX6fuX6EsEZ8NxPd2qtlctLaFERPHnD32KRTnzETNjS1D33fPXh"28800
TXT"oCpaKdMaJf6RlCEJEHUEshwYzkMcJpBMB223Dn0IzxlWZyeYLgYkShWXWcmuBoWl"28800
TXT"iKv0OEFDSnwTdYpcwmNIDCJBQJgRFiFcyLdneQsFELO7fiuknoB0GEF0uL2uWmPr"28800
TXT"27aa847d6d8724e19dd6b900d0ed1b9261b3beb9f05b5154417b61a5778848f3"28800
TXT"v=NTA7516-1;startdate=2019-06;enddate=2029-09;provider=bastionic;ntamx=10 mx.bastion365.net"28800
TXT"v=spf1 mx include:_u.kerkrade.nl._spf.dmarcly.com include:spf.eprov.nl include:spf.bctcloud.eu include:_spf.mail.services.bastion365.net -all"28800
TXT"CXHYbAzanHgMxThYMtYqzqiF9FVyFyAUoWQ2fONNrm8XO9xE1Y9sAduLDDxPaa6L"28800
TXT"c8vqsft774lkz789jn53383rgddzhh85"28800
TXT"rOeDhhGidjpOcDe2yhEHvP5e8jMLVF69lYeHnpilGj2Iyzz7wPlGClGy91pdVLqz"28800
TXT"e1722256822409d250428294bc50b7458b40f6000d0539485a1c9616480264a6"28800
TXT"af0486238d6b9d753979ec121a8c9e2862710f344d7fbfd06c4762f39a674be5"28800
TXT"gagPUP83Sc2rKSM8mC0VEcykWEPGdfXjS8iaoJbYYFB3YMAldhuhjyNcP7w966lK"28800
TXT"google-site-verification=xzkO6RhNyIYhVSf6iU1Z3CBBeYIXRqQqSu8PfP9DT2Q"28800
CAA0 issue "certsign.ro"28800
CAA0 issue "globalsign.com"28800
CAA0 issue "kpn.com"28800
CAA0 issuewild "kpn.com"28800
CAA0 issuewild "letsencrypt.org"28800
CAA0 issue "amazon.com"28800
CAA0 issue "letsencrypt.org"28800
CAA0 issuewild "digicert.com"28800
CAA0 issue "digicert.com"28800

Checks

  • ✓ TTLs within range #32
    TTLs: A 8h, AAAA 8h, MX 8h, NS 8h. The NS TTL at the parent is 1h and in the zone 8h; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • i
    Wildcard record
    A random name under the zone resolves, so there is a wildcard (*) record. Typos and non-existent hosts resolve too, which can confuse mail and certificate checks.
    #34
  • ✓ CAA restricts issuance #35
    Certificates may be issued by: certsign.ro, globalsign.com, kpn.com, letsencrypt.org, amazon.com, digicert.com.