kohler.com

Checked 22 October 2026, 09:32 UTC · via 8.8.8.8
!Passed with warnings
22 passed 3 warnings 0 failed 6 info

Registration

info

.com generic · MarkMonitor Inc. · expires 2028-11-07

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
MarkMonitor Inc.
Registered
8 November 1994
Last changed
6 October 2026
Expires
7 November 2028
Status
client delete prohibited, client transfer prohibited, client update prohibited
Registry nameservers
eur7.akam.net, ns1-116.akam.net, ns1-223.akam.net, use10.akam.net, use6.akam.net, usw1.akam.net, usw2.akam.net, usw6.akam.net
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2028-11-07 #3
    The registration is valid until 2028-11-07 (746 days).
  • ✓ Transfer locked #4
    Registry status: client delete prohibited, client transfer prohibited, client update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

eur7.akam.net, ns1-116.akam.net, ns1-223.akam.net, use10.akam.net, use6.akam.net, usw1.akam.net, usw2.akam.net, usw6.akam.net

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
eur7.akam.net, ns1-116.akam.net, ns1-223.akam.net, use10.akam.net, use6.akam.net, usw1.akam.net, usw2.akam.net, usw6.akam.net
NS in the zone
eur7.akam.net, ns1-116.akam.net, ns1-223.akam.net, use10.akam.net, use6.akam.net, usw1.akam.net, usw2.akam.net, usw6.akam.net
NameserverAddressesNetwork (AS)Glue
eur7.akam.net23.74.25.65AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
ns1-116.akam.net193.108.91.116 2600:1401:2::74AS20940 AKAMAI-ASN1 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
ns1-223.akam.net193.108.91.223 2600:1401:2::dfAS20940 AKAMAI-ASN1 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
use10.akam.net23.211.133.64AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
use6.akam.net2.16.40.65AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
usw1.akam.net23.61.199.66AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
usw2.akam.net184.26.161.64AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
usw6.akam.net23.61.199.64AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-

Checks

  • ✓ 8 nameservers #6
    Delegated to eur7.akam.net, ns1-116.akam.net, ns1-223.akam.net, use10.akam.net, use6.akam.net, usw1.akam.net, usw2.akam.net, usw6.akam.net.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • i
    One address family in one network
    all IPv6 addresses are in 2600:1401:2::/48, while the other address family is spread over several networks.
    #10
  • ✓ 2 autonomous systems #11
    The nameservers are spread over: AS20940 (AKAMAI-ASN1 - Akamai International B.V., NL): 2 addresses; AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 8 addresses.
  • i
    All nameserver names under .net
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • i
    Partly IPv6
    These nameservers have no IPv6 address: eur7.akam.net, use10.akam.net, use6.akam.net, usw1.akam.net, usw2.akam.net, usw6.akam.net.
    #13

Nameservers

warn

10 of 10 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
eur7.akam.net 23.74.25.65NOERROR, 3 ms, authoritativenoyes / yesrefused48878.32
ns1-116.akam.net 193.108.91.116NOERROR, 3 ms, authoritativenoyes / yesrefused41824.5
ns1-116.akam.net 2600:1401:2::74NOERROR, 3 ms, authoritativenoyes / yesrefused41824.7
ns1-223.akam.net 193.108.91.223NOERROR, 4 ms, authoritativenoyes / yesrefused41824.10
ns1-223.akam.net 2600:1401:2::dfNOERROR, 4 ms, authoritativenoyes / yesrefused41824.4
use10.akam.net 23.211.133.64NOERROR, 3 ms, authoritativenoyes / yesrefused48878.26
use6.akam.net 2.16.40.65NOERROR, 4 ms, authoritativenoyes / yesrefused48878.33
usw1.akam.net 23.61.199.66NOERROR, 4 ms, authoritativenoyes / yesrefused41824.11
usw2.akam.net 184.26.161.64NOERROR, 4 ms, authoritativenoyes / yesrefused48878.27
usw6.akam.net 23.61.199.64NOERROR, 3 ms, authoritativenoyes / yesrefused41824.10

Checks

  • ✓ All respond #14
    All 10 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: eur7.akam.net: "48878.32"; ns1-116.akam.net: "41824.5"; ns1-116.akam.net: "41824.7"; ns1-223.akam.net: "41824.10"; ns1-223.akam.net: "41824.4"; use10.akam.net: "48878.26"; use6.akam.net: "48878.33"; usw1.akam.net: "41824.11"; usw2.akam.net: "48878.27"; usw6.akam.net: "41824.10". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

info

serial 200705495 · primary ns-west.cerf.net

Found

Primary (MNAME)
ns-west.cerf.net
Contact (RNAME)
hostmaster.attens.com
Serial
200705495
Refresh / retry
3600 s / 1800 s
Expire
604800 s
Negative TTL
300 s

Serial per nameserver

NameserverSerial
eur7.akam.net (23.74.25.65)200705495
ns1-116.akam.net (193.108.91.116)200705495
ns1-116.akam.net (2600:1401:2::74)200705495
ns1-223.akam.net (193.108.91.223)200705495
ns1-223.akam.net (2600:1401:2::df)200705495
use10.akam.net (23.211.133.64)200705495
use6.akam.net (2.16.40.65)200705495
usw1.akam.net (23.61.199.66)200705495
usw2.akam.net (184.26.161.64)200705495
usw6.akam.net (23.61.199.64)200705495

Checks

  • ✓ Serial 200705495 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 1h, retry 30m, expire 7d, negative TTL 5m.
  • i
    Hidden master
    The primary nameserver ns-west.cerf.net is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.
    #24
  • ✓ Contact hostmaster@attens.com #25
    The SOA RNAME hostmaster.attens.com means hostmaster@attens.com.
  • ✓ Counter serial #26
    The serial 200705495 is a plain counter.

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

44 records at the apex

Found

Read from
23.74.25.65:53
TypeValueTTL
SOAns-west.cerf.net. hostmaster.attens.com. 200705495 3600 1800 604800 300900
NSusw6.akam.net.900
NSns1-116.akam.net.900
NSuse6.akam.net.900
NSns1-223.akam.net.900
NSeur7.akam.net.900
NSusw1.akam.net.900
NSusw2.akam.net.900
NSuse10.akam.net.900
A2.16.204.2520
A2.16.204.2620
MX10 mxb-00174802.gslb.pphosted.com.1800
MX10 mxa-00174802.gslb.pphosted.com.1800
TXT"smartsheet-site-validation=_4v-PWM_l7-NirMOu8uyqj5WYNwto8cL"300
TXT"sending_domain1036673=0453c205964c3a340a39f725ddc035f03749470bc5b8bffdd2e33ed61e8cafec"300
TXT"_juhbvrxlggik1styvo0qf2guu3z7uwp"300
TXT"_5tiusmawyufady551g6ubxp5t5owf8o"300
TXT"fa1eed8f-0f24-41c1-8b40-64d9adfc612e"300
TXT"D6D4-5C08-82FB-C411-E60B-FEB7-B377-CCD9"300
TXT"amazonses:uUJchwuONqaAsoIxLo3eotB4qihToWunZ/lvg7NmJL4="300
TXT"onetrust-domain-verification=7f446d598c7e48b190d257edf03d6f54"300
TXT"Smq+5X4bPYLUHus6ajkrdMjMT2rmRTBYAcn3ZJRut1L77z0AtPzJCUMspx0Ic6ia+x8SYL9gAghdCHtk0hS32A=="300
TXT"uber-domain-verification=fea18a1b-aa27-4af2-8670-44bf221a936a"300
TXT"uber-domain-verification=0737891a-bce7-4ccc-9b08-146f271753d8"300
TXT"google-site-verification=efPFqusX6wdF2ljv2AAByQ-XrCQ7Rb4OISkldxL6naA"300
TXT"ZOOM_verify_JqfVLCgW87qb9947aQySF7"300
TXT"atlassian-domain-verification=Wxj5AXS/efl69vSXke95q/oTHotW6WfRomOZkh5LKFzdxMOfMFW1mbVIw5fafxOT"300
TXT"google-site-verification=L5emBcq847QHyAbHvZkRY0OruTP-xC90VQ3abK3pev0"300
TXT"facebook-domain-verification=0jymhdiepnuuifxa0vr4i3timgmdgq"300
TXT"adobe-idp-site-verification=4bea7180-6208-44a6-b988-506b315e39e7"300
TXT"miro-verification=fab2d739f11e8f82228324553dffa990ef7a6161"300
TXT"webexdomainverification.4C675B8BD55B136E053AB06FC0A3F65=440fa4e0-b028-47bb-8086-4d805286cd52"300
TXT"apple-domain-verification=7PHEW2t4s6vbkwlG"300
TXT"atlassian-domain-verification=YEEtWh7fKODWi7QX+K4ZvuyySxlrxtVxiPIIoFKvd1wOQkNTOoc4UWKsCQqbvdmd"300
TXT"google-site-verification=P3553vniHmGZuOVjWKaZj96kP2NqAGtdhhIKogWcdd0"300
TXT"cisco-ci-domain-verification=6768f3da86759b535230444ede5be13639c9a7a5a0bf6afd9281480a5398b348"300
TXT"amazonses:VjvVxNoq4mj8bgABRVjubII8L8OYR5VazTBXM/uqeQ4="300
TXT"v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all"300
TXT"MS=ms91143410"300
TXT"cloudflare-verify=183447767-818457592"300
TXT"SFMC-lDph42N5oVG8z5DtLK5OujQyAj3QMwO_5p7AEykX"300
TXT"wiz-domain-verification=ce890c61d4a8c45b4c02169f2b631bd6f1bac641de4c5744c289442169168930"300
TXT"hibp-verify=dweb_hnx83elufb8bd0rr42ziwe8r"300
TXT"0ed1fe018a2e7a94ec2845463ca236c5068a290cf0"300

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (20s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 15m; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35