kpmg.com

Checked 22 October 2026, 09:32 UTC · via 8.8.8.8
!Passed with warnings
24 passed 3 warnings 0 failed 4 info

Registration

info

.com generic · Nom-iq Ltd. dba COM LAUDE · expires 2027-10-20

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
Nom-iq Ltd. dba COM LAUDE
Registered
21 October 1992
Last changed
4 September 2026
Expires
20 October 2027
Status
client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers
a1-26.akam.net, a10-65.akam.net, a16-66.akam.net, a3-67.akam.net, a4-64.akam.net, a5-65.akam.net
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-10-20 #3
    The registration is valid until 2027-10-20 (362 days).
  • ✓ Transfer locked #4
    Registry status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

a1-26.akam.net, a10-65.akam.net, a16-66.akam.net, a3-67.akam.net, a4-64.akam.net, a5-65.akam.net

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
a1-26.akam.net, a10-65.akam.net, a16-66.akam.net, a3-67.akam.net, a4-64.akam.net, a5-65.akam.net
NS in the zone
a1-26.akam.net, a10-65.akam.net, a16-66.akam.net, a3-67.akam.net, a4-64.akam.net, a5-65.akam.net
NameserverAddressesNetwork (AS)Glue
a1-26.akam.net193.108.91.26 2600:1401:2::1aAS20940 AKAMAI-ASN1 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a10-65.akam.net96.7.50.65 2600:1480:d000::41AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a16-66.akam.net23.211.132.66 2600:1406:1b::42AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a3-67.akam.net96.7.49.67 2600:1408:1c::43AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a4-64.akam.net72.246.46.64 2600:1480:9000::40AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a5-65.akam.net95.100.168.65 2600:1480:b000::41AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-

Checks

  • ✓ 6 nameservers #6
    Delegated to a1-26.akam.net, a10-65.akam.net, a16-66.akam.net, a3-67.akam.net, a4-64.akam.net, a5-65.akam.net.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 6 IPv4 /24s and 6 IPv6 /48s.
  • ✓ 2 autonomous systems #11
    The nameservers are spread over: AS20940 (AKAMAI-ASN1 - Akamai International B.V., NL): 1 address; AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 11 addresses.
  • i
    All nameserver names under .net
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

warn

12 of 12 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
a1-26.akam.net 193.108.91.26NOERROR, 9 ms, authoritativenoyes / yesrefused41824.4
a1-26.akam.net 2600:1401:2::1aNOERROR, 9 ms, authoritativenoyes / yesrefused41824.11
a10-65.akam.net 96.7.50.65NOERROR, 3 ms, authoritativenoyes / yesrefused48878.30
a10-65.akam.net 2600:1480:d000::41NOERROR, 4 ms, authoritativenoyes / yesrefused48878.30
a16-66.akam.net 23.211.132.66NOERROR, 9 ms, authoritativenoyes / yesrefused48878.29
a16-66.akam.net 2600:1406:1b::42NOERROR, 9 ms, authoritativenoyes / yesrefused48878.30
a3-67.akam.net 96.7.49.67NOERROR, 3 ms, authoritativenoyes / yesrefused41824.10
a3-67.akam.net 2600:1408:1c::43NOERROR, 8 ms, authoritativenoyes / yesrefused41824.11
a4-64.akam.net 72.246.46.64NOERROR, 4 ms, authoritativenoyes / yesrefused48878.30
a4-64.akam.net 2600:1480:9000::40NOERROR, 4 ms, authoritativenoyes / yesrefused48878.31
a5-65.akam.net 95.100.168.65NOERROR, 9 ms, authoritativenoyes / yesrefused41824.11
a5-65.akam.net 2600:1480:b000::41NOERROR, 8 ms, authoritativenoyes / yesrefused41824.7

Checks

  • ✓ All respond #14
    All 12 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: a1-26.akam.net: "41824.4"; a1-26.akam.net: "41824.11"; a10-65.akam.net: "48878.30"; a16-66.akam.net: "48878.29"; a16-66.akam.net: "48878.30"; a3-67.akam.net: "41824.10"; a3-67.akam.net: "41824.11"; a4-64.akam.net: "48878.30"; a4-64.akam.net: "48878.31"; a5-65.akam.net: "41824.11"; a5-65.akam.net: "41824.7". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

info

serial 2007603836 · primary yyazrdns03.kworld.kpmg.com

Found

Primary (MNAME)
yyazrdns03.kworld.kpmg.com
Contact (RNAME)
domaintech.kpmg.com
Serial
2007603836
Refresh / retry
10800 s / 3600 s
Expire
2592000 s
Negative TTL
900 s

Serial per nameserver

NameserverSerial
a1-26.akam.net (193.108.91.26)2007603836
a1-26.akam.net (2600:1401:2::1a)2007603836
a10-65.akam.net (96.7.50.65)2007603836
a10-65.akam.net (2600:1480:d000::41)2007603836
a16-66.akam.net (23.211.132.66)2007603836
a16-66.akam.net (2600:1406:1b::42)2007603836
a3-67.akam.net (96.7.49.67)2007603836
a3-67.akam.net (2600:1408:1c::43)2007603836
a4-64.akam.net (72.246.46.64)2007603836
a4-64.akam.net (2600:1480:9000::40)2007603836
a5-65.akam.net (95.100.168.65)2007603836
a5-65.akam.net (2600:1480:b000::41)2007603836

Checks

  • ✓ Serial 2007603836 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 3h, retry 1h, expire 30d, negative TTL 15m.
  • i
    Hidden master
    The primary nameserver yyazrdns03.kworld.kpmg.com is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.
    #24
  • ✓ Contact domaintech@kpmg.com #25
    The SOA RNAME domaintech.kpmg.com means domaintech@kpmg.com.
  • ✓ Timestamp serial #26
    The serial 2007603836 is a Unix timestamp (2033-08-14 03:43 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

114 records at the apex

Found

Read from
193.108.91.26:53
TypeValueTTL
SOAyyazrdns03.kworld.kpmg.com. domaintech.kpmg.com. 2007603836 10800 3600 2592000 90086400
NSa10-65.akam.net.86400
NSa1-26.akam.net.86400
NSa16-66.akam.net.86400
NSa5-65.akam.net.86400
NSa4-64.akam.net.86400
NSa3-67.akam.net.86400
A2.16.204.2620
A2.16.204.1420
MX2 mxa-00120b02.gslb.pphosted.com.300
MX2 mxb-00120b02.gslb.pphosted.com.300
MX4 mxa-00120b03.gslb.pphosted.com.300
MX4 mxb-00120b03.gslb.pphosted.com.300
TXT"_saml-domain-challenge.388a55f4-b312-4876-a7a2-ad855855bb3a.4ed2079f-05cf-4314-9040-534a2584c2b6=5c49032e-8cd8-4831-a4d8-cd2542b6c764"300
TXT"lovable_verification=6013e60d58fd65a9ca9968c66ccced8aa81c39a0310d6f626845846e80def127"300
TXT"lmy2rcqwbbbcs0f010chrgm4h84183pg"300
TXT"17nb118fdl48kmkibsbdqnestm"300
TXT"facebook-domain-verification=c76lagctm3xnxv58p872raxzgk612t"300
TXT"dtkg66noe1e1deo0kgacbocma0"300
TXT"_globalsign-domain-verification=D_1syNtfbLghXytGyLs6ba-OZVmwdxZoLf5UH9o0eF"300
TXT"3vgmgghz3lwm416mfdcv00nsy4ny4h2n"300
TXT"72am62j8s66v23uao60djgpja8"300
TXT"5cfgo9iij7a271mvf893hj2a66"300
TXT"_p4wplmgveklhlp0qkyqqsur5alyzf1z"300
TXT"wiz-domain-verification=2539a64191bf41f68bfd5ab1c53c96c0566a1b82a8ef9ee9e8640f6f8adb5015"300
TXT"KoKNAowh10Ke2v66dHUMAM3MoRwqc63xKu9zz0pK2wHyze2Nbj2DfAzMqGM3pJazAoCdi3U0a52beTVhNF2CZw=="300
TXT"d365mktkey=KKya8mnxxoHLyxfnsxXYCup6cO5BshILMfiNX13AMcIx"300
TXT"UDJ6ZHJnSFJmOUdNN0E3SW15TnNhVEt0ajRqci1jMTVmZWJmOS01NDYyLTRmYWMtOGNjMy04ZDM3NDdiODMwZDY="300
TXT"swisssign-check=5gx937BZyDEwppr7-1KfZSLuCxw"300
TXT"atlassian-domain-verification=1be3aDpvpkZaguwBickLNbwLB3CtIhdyOUsbgVbJLxzRXd26K8HQ5wgQjesMLjbn"300
TXT"flexera-domain-verification-ifeigriavchxwjkt"300
TXT"_l635za1nmul3vkh9q2m5rfyfl6xlqmi"300
TXT"lpb3gdc1g7i68eg5nt97oje0uj"300
TXT"flexera-domain-verification-fhbjdsqvvdjvdjxa"300
TXT"_pw89btkub2plggpiodni3d0xp7slkhz"300
TXT"+Ss1ybvbvf29NCOS1jI7ZytSUGu+6KWfqEAaAoSt09g="300
TXT"_hucxcqf90j11u8g0rt1xvgxhr592599"300
TXT""300
TXT"jp2prm8agf3q7etdsiaq74dfmq"300
TXT"blitzy-domain-verification-7fvdxr=0V18OfwU4fhi61AckGccSv4OC"300
TXT"l4ts07sbxky1vdl8vwgqdrjrk7fqn01r"300
TXT"onetrust-domain-verification=5b7c197372a74fc9827f3b4d0ce69e1b"300
TXT"bl5rur97lfb6l62u2pagairnjg"300
TXT"_pkfwe99vhdbnjxyorriafcot86ozg3p"300
TXT"d365mktkey=xzrDqkjbwpjlZ0KRa5sIdspWBlnjUT8JEU3O4QPsMzox"300
TXT"d365mktkey=tRbXxJdxNdjousDzjlHLNKGP8XCcH7OPtrzpqvJ7dFYx"300
TXT"_r9nboj36pic2bztjvp11gpd7nlybjzo"300
TXT"msfpkey=6fidazg52izz1f7qxiepcwx9n"300
TXT"notion-domain-verification=DirNMkhmK9c9y31fbchlvbz3WHMd9qJlnPFaANXAcKj"300
TXT"docker-verification=4f024ce7-ef36-4683-bf3e-ab7ddf85f9e8"300
TXT"77h9is96kfj0irg6l7can75kh5"300
TXT"_w1sejvhd404jpcw53q598ff9d4dwvqz"300
TXT"34ghdn8hqr6xjx9r0l0ljt97946nm5tb"300
TXT"figma-domain-verification=6920bdb003a7c2a7f04c26028bb2aaf63f679c6afa950e570485f8a383d748de-1777297702"300
TXT"j2a0ink153u6mnckfff0b4p5g"300
TXT"smartsheet-site-validation=diZ_HtoZQq_LKPCJPXBw7FsNoanU9gWH"300
TXT"kvo55gfd8ri85tlrjugislosvq"300
TXT"d365mktkey=3Ot5GQ4n4slcBkw35CvAZxTOR8jLnlGxCdxN2FXNHxcx"300
TXT"9ukhci54e7nra88tsrfb9rn7sg"300
TXT"swisssign-check=jQUx73C9e_333gVkk8Xs9Rdf7k8"300
TXT"d365mktkey=SLspPxqDlHoj3JXhWGKxcU69r6jK4tCArlc6EtedFW0x"300
TXT"DomainVerification=GVRY6PQAYN5HR0IAMXJNAABFX3GMID468F5660B9147F8KU9IGHUFEFNQDFPYFX5"300
TXT"sending_domain788803=65d4a339d1b319e135ad20a966bf2a1ef5a4c1c14d1a2f0c77e3b2d7a4aa9840"300
TXT"_euei94tj6t6qx9ke9qkjygd7qygtw3q"300
TXT"_c4ucmm0nr7ebfr5dgbnq8q820agjmxx"300
TXT"elevenlabs=Bu5qN1ro7vNuAonN8PC067VgxDWUhk4B05i_IW0Bfko"300
TXT"google-site-verification=KJuIbH28rHmzDspb4c0WjPHI9AQKKVcBFiCvQeXPgRc"300
TXT"_globalsign-domain-verification=jIdaeuXlX0O07OqRmdC5bLZ3MTxt7uuGJs2crTNPfu"300
TXT"_xndb7jsx4pm7e5uiu9vmh6fk0atf3uw"300
TXT"smartsheet-site-validation=jy6DWPStTCSXIKQD5gxLT11TjXmGgTnT"300
TXT"scpl06frf4bh8jhmfs2k6cdupp"300
TXT"3dlb3d4qfq61dakbii6v0p61sa"300
TXT"cnm5dlfjlk0mko63fc5v39dv34"300
TXT"plm4h5/RjPEBIQxvCwHhwbzTNPJwQKwxmqRzD/2cGp99m9JGYOJIdmAUABNLiPfbfAr0GZOK3dCsLIaGfk+UnA=="300
TXT"cisco-ci-domain-verification=4ddf75ea9c7641350cc094fcd50f85523b563f4abefb2ea174c368479c1dd7ed"300
TXT"a0df0ed7-9760-47a0-9ced-760e213b91f7"300
TXT"_ico0vm6o7e8xhcih0t4al2m2b5rxsbr"300
TXT"db5674qekl626fs5jeotbghts6"300
TXT"_eabdrhtsjnkv635ppn49gyrrjtd8nuh"300
TXT"jwk77vj7ndm1d758cddr85kp84ygcv70"300
TXT"successfactors-site-verification=NzNlNjdkZGY2ZjQ1NWY4Y2I1ZTkzODQxZDViMzQ1MDZlNTA1ZWQ0NjFlZDU3YjVlYmNmZDgwYmM3ZTkzMDkzZA=="300
TXT"_404t94h49418jftajimmb17x860bwy8"300
TXT"jhlfjcaiakogfvqtd7o6ni3is5"300
TXT"_rls3v9kfo34z3zyhe36f5p7ktiea946"300
TXT"notion-domain-verification=P8Awoy0hrqOCEi9Eq6CiBXMfv3TsBEdHg4gGD4KoPUQ"300
TXT"_9k8cqmdaazii9h6laiiea691bzisxve"300
TXT"flexera-domain-verification-rysaorskldiffwmc"300
TXT"cobua5285drag2eoj4mngflal8"300
TXT"paloaltonetworks-site-verification=49390c49e9d930e1dd229c0fb93329a10854c77a595b7052a0287bc87f948fcf"300
TXT"hxpktv20301qrqzkj7v7g9917vhb4kvt"300
TXT"access-domain-verification=1756dd6e4dfd33a5788e72d9fb51d9bccb1c129535a514a8a67894a5aa38c7a0"300
TXT"y1tdd07113swctkf39cm82xrc1zkh8bj"300
TXT"d365mktkey=7rUtGsQjup9Pqb0oseJRe45CAUyv0BCEgKUUCiWXMowx"300
TXT"b9bvdpv8ffedcs6bj5ud53nu4i"300
TXT"docusign=a5faf54f-16e6-4e54-b356-7a7d1c519563"300
TXT"google-gws-recovery-domain-verification=47166815"300
TXT"wiz-domain-verification=da339a3f289111bcb27e4e9eae4fbd55434caf2fac71a66c5611d9c65b3c86fd"300
TXT"google-site-verification=403G4jqbyF-G0c_JncQdmifIs49o8LcWFgTQ5Ggukew"300
TXT"v=spf1 include:_spf.kpmg.com ip4:205.220.184.29 ip4:185.183.31.56 ip4:205.220.179.146 ip4:205.220.167.145 include:_spf1.kpmg.com include:service-now.com include:_spf.qualtrics.com -all"300
TXT"zscaler-verification-187514329-8282026-zB8l7"300
TXT"963ujm3ohgcbbprv2h5ee0fevl"300
TXT"google-site-verification=BrCQ3GoaWvXCMcNgj-llWtYLup-A5sO0bQuSADQaZrs"300
TXT"facebook-domain-verification=zyzferd0kpm04en8wn4jnu4ooen5ct"300
TXT"google-site-verification=bJEhTqvZQtNkRRN2FSErdH6x883Psi31KkKdYkxQXec"300
TXT"domain-verification=UDJ6ZTExeDJzcEJHeXZnTjR6MUFvVUdkRTRoNS1iOTMxYjYzNi0yNzVlLTQyNjMtYjI0NS1kMGY5MTBlZjU2MTE="300
TXT"_validation-contactemail.kpmg.com"300
TXT"vertexinc-cloud-54e12f84-56bd-4ced-bc9f-8eff989d96ec"300
TXT"nioqnq398evc8ssjc5916rm23v"300
TXT"docusign=2ef4e2b3-dee1-4f09-8df2-b4659fa1562f"300
TXT"_sznwxs321thia4cblyh5pfzw47q4eq2"300
TXT"_zx3fcpu37xkh8r5jbt2km5b4ykdajhy"300
TXT"pardot788803=7ec388cf2ade1d67018859d8f52d8094292c1d0688accba8443fc9a3b8153662"300
TXT"00D2p0000013VVQ=1TBQu0000000hMj"300
TXT"m42veer0drrci68lh8buuina1s"300

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (20s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35