Domain report: kroger.com

Registration

info

.com generic · Network Solutions, LLC · expires 2027-08-04

Found

TLD: .com (generic)
ICANN policies apply: yes
Registrar: Network Solutions, LLC
Registered: 5 August 1993
Last changed: 5 June 2026
Expires: 4 August 2027
Status: client transfer prohibited
Registry nameservers: sage.kroger.com, thyme.kroger.com
RDAP server: https://rdap.verisign.com/com/v1/

Checks

i

.com is a generic TLD (gTLD)

Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.

#1
✓ TLD delegated and signed #2

.com is delegated in the root zone and DNSSEC-signed.
✓ Expires on 2027-08-04 #3

The registration is valid until 2027-08-04 (285 days).
✓ Transfer locked #4

Registry status: client transfer prohibited.
✓ Registry and delegation match #5

The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

sage.kroger.com, thyme.kroger.com

Found

Parent zone: com
Delegation from: a.gtld-servers.net (192.5.6.30)
NS at the parent: sage.kroger.com, thyme.kroger.com
NS in the zone: sage.kroger.com, thyme.kroger.com

Nameserver	Addresses	Network (AS)	Glue
sage.kroger.com	158.48.6.8	AS32577 KROGER - The Kroger Co., US	158.48.6.8
thyme.kroger.com	158.48.133.8	AS32577 KROGER - The Kroger Co., US	158.48.133.8

Checks

i

2 nameservers

Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: sage.kroger.com, thyme.kroger.com.

#6
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ Glue present and correct #8

Glue is published for the nameservers inside the zone: sage.kroger.com, thyme.kroger.com.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 2 IPv4 /24s and 0 IPv6 /48s.
i

All nameservers in one AS

All nameserver addresses are announced by one network operator (AS32577 (KROGER - The Kroger Co., US): 2 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.

#11
i

All nameserver names under .com

All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

#12
!

No IPv6

None of the nameservers has an IPv6 address, so IPv6-only resolvers can't reach them.

#13

Nameservers

pass

2 of 2 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
sage.kroger.com 158.48.6.8	NOERROR, 123 ms, authoritative	no	yes / yes	refused	-
thyme.kroger.com 158.48.133.8	NOERROR, 107 ms, authoritative	no	yes / yes	refused	-

Checks

✓ All respond #14

All 2 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
✓ No version disclosed #17

The nameservers don't reveal their software version.
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

info

serial 744660729 · primary cdcbcextdmzma.kroger.com

Found

Primary (MNAME): cdcbcextdmzma.kroger.com
Contact (RNAME): abuse.kroger.com
Serial: 744660729
Refresh / retry: 10800 s / 3600 s
Expire: 604800 s
Negative TTL: 86400 s

Serial per nameserver

Nameserver	Serial
sage.kroger.com (158.48.6.8)	744660729
thyme.kroger.com (158.48.133.8)	744660729

Checks

✓ Serial 744660729 everywhere #22

All nameservers serve the same version of the zone.
✓ Timers within recommendations #23

SOA refresh 3h, retry 1h, expire 7d, negative TTL 1d.
i

Hidden master (not resolvable)

The primary nameserver cdcbcextdmzma.kroger.com is not listed as a nameserver and does not resolve publicly: a hidden master, or a placeholder name. Some tools (e.g. dynamic updates) use MNAME to find the primary.

#24
✓ Contact abuse@kroger.com #25

The SOA RNAME abuse.kroger.com means abuse@kroger.com.
✓ Counter serial #26

The serial 744660729 is a plain counter.

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

info

43 records at the apex

Found

Read from: 158.48.6.8:53

Type	Value	TTL
SOA	cdcbcextdmzma.kroger.com. abuse.kroger.com. 744660729 10800 3600 604800 86400	3600
NS	sage.kroger.com.	86400
NS	thyme.kroger.com.	86400
A	158.48.16.240	3600
A	158.48.152.240	3600
MX	10 mxa-0019e702.gslb.pphosted.com.	1800
MX	10 mxb-0019e702.gslb.pphosted.com.	1800
TXT	"google-site-verification=vpRahkM09Pr7VTjDl9hD8n974ctkex2qLgivSJNRXD4"	3600
TXT	"jamf-site-verification=R4zvoOqc3MV81qrARsrzKQ"	3600
TXT	"70717e92ddc943aaa7238081794436b4"	3600
TXT	"JDDoZrraxU7yklLU8GAp2yqBlcT4ZDCXC4uyF6zqqNL+HbsZgdzpHKUMo1niYxnN8cBHnAdaVgq8MaFOnatcHw=="	3600
TXT	"atlassian-domain-verification=bdVO40jH4ATZiIS4pPIs8m3RwIdFsRXSAw6F9Hl1DaaIIaCcZ62nKgK8bK6tjlPN"	3600
TXT	"google-site-verification=mLDjWodVihPJXvMAL0-8hcbuNludulWFtLJ5FFFMbyk"	3600
TXT	"KWmtwAf-n7Mq3UNHUNsr_Ul-Kg"	3600
TXT	"v=spf1 include:spf.kroger.com -all"	3600
TXT	"infor-cloudsuite-domain-verification=33MJHR2FVUKH7TPGKPLXRAMS9EFSYNPX6SZZ4KHPSVEE7BCDYMVJ76QMEK38ACSG"	3600
TXT	"docker-verification=d36e09cb-195f-4bca-8bf8-f1ed95552f72"	3600
TXT	"Cpzp5yJI3ldAW+ZlaMBqULrLHJzc2qlLejUURaPDRYg="	3600
TXT	"apple-domain-verification=g8KoBfTlmZIuHOj7"	3600
TXT	"atlassian-domain-verification=U8fA30AGhBpe9yPDNKsrwu6nEExWMa5DeFax27szGB1jZDWUlbp4O3Hix0ymGNSg"	3600
TXT	"Dynatrace-site-verification=9f0af9a3-4954-4373-a72d-6cd30683182a__mvv4dvie6irh609ol0r4m77thp"	3600
TXT	"google-site-verification=bnfvHayHQ2jQkGmtScZK2KgomlO0a7UJ8V_IhmWzvLg"	3600
TXT	"workplace-domain-verification=PQI6FA3vlXLG98pIgupDEEYAPRGVUH"	3600
TXT	"adobe-idp-site-verification=c5c029ed-7f1f-4e42-8fd8-a90b1c53a5ac"	3600
TXT	"smartsheet-site-validation=83C7WI64A5BQGdkwSZQzEuCrFAg_6yuG"	3600
TXT	"eNJzRIRn+OkIRXgt5CUw9kFrQLfVR5Q4MVxX2NHuWMZm3D3mebso0EhmWd1q04WWmWdi9xtL+oiuXMcM1MOUFQ=="	3600
TXT	"MS=ms60357803"	3600
TXT	"facebook-domain-verification=6s7n2adfhcy5qwww5s22mylzdgtoyr"	3600
TXT	"OSSRH-88137"	3600
TXT	"MS=819FE6AB074386D353FE2ECC8C433C6EF5144689"	3600
TXT	"google-site-verification=0EU2GG5S__fWmOghkN3I_mb0VCo7LSZgO67K_88b-TQ"	3600
TXT	"pardot1030131=6c9961b27b422a967ae622d2a981565b6e065ce9f3f0cbd9a3c23ecd0eba6169"	3600
TXT	"vmware-cloud-verification-1fe39ea6-66d2-4916-b75a-702e6fe98843"	3600
TXT	"sending_domain1030131=337af9a1413e6c035e0fd8ae271f8e49b49badb84ecf578e2d2d8ec61b1ad850"	3600
TXT	"google-site-verification=rgDzgIpd5mFsGFKJvG0O6QJe1lg0BSEIT9MVuOnqs9s"	3600
TXT	"MS=ms80224375"	3600
TXT	"atlassian-domain-verification=afLTO7rm2v/GQfDpfREFuTuFq/6ebw9MSs5mpGfDHS7YavnzxZLyLKy/6V/aHXN2"	3600
TXT	"h699m0pm31lnv2ntd7p629qcfn0r806r"	3600
TXT	"postman-domain-verification=0d890111276400f743c2d406ce13d6171315eb1644c452719764be530691e536981ba0292a841813b053245690a241729e13ce71849da9a4dd05ad81f794238f"	3600
TXT	"atlassian-domain-verification=v4TK5rkkwwaaqAtHmH1hsiC9adR6rfRdeiakdzB7aQSSI5MPCwSoEBlgiHKPzaKa"	3600
TXT	"sprout-social-6607f837-cf05-49b9-93ad-7f949f1bf050"	3600
TXT	"prodpad-domain-verification=8pJwXbpJfebSZoXSkzJs8DDkt/G4OrfAKBc+lZ4Xu0g="	3600
TXT	"apple-domain-verification=IGzWOFI8A5IH2bFp-y4DiLX4mlOlk6ERvnfr_zadl4I"	3600

Checks

✓ TTLs within range #32

TTLs: A 1h, MX 30m, NS 1d. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35