Domain report: lippstadt.de

Registration

info

.de country-code

Found

TLD: .de (country-code)
ICANN policies apply: no

Checks

i

.de is a country-code TLD (ccTLD)

Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.

#1
✓ TLD delegated and signed #2

.de is delegated in the root zone and DNSSEC-signed.
i

Registration data not available

No registration data via RDAP: the registry of .de offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.

#3

Delegation

pass

dns.globvill.de, dns.globvill.ruhr, dns.voerde.globvill.de, ns.suedwestfalenit.de, ns.suedwestfalenit.nrw

Found

Parent zone: de
Delegation from: a.nic.de (194.0.0.53)
NS at the parent: dns.globvill.de, dns.globvill.ruhr, dns.voerde.globvill.de, ns.suedwestfalenit.de, ns.suedwestfalenit.nrw
NS in the zone: dns.globvill.de, dns.globvill.ruhr, dns.voerde.globvill.de, ns.suedwestfalenit.de, ns.suedwestfalenit.nrw

Nameserver	Addresses	Network (AS)	Glue
dns.globvill.de	212.20.191.2 2001:40b8::22	AS13039 GLOBAL-VILLAGE - Global Village GmbH, DE AS13039 GLOBAL-VILLAGE - Global Village GmbH, DE	-
dns.globvill.ruhr	212.20.161.2 2001:40b8::23	AS13039 GLOBAL-VILLAGE - Global Village GmbH, DE AS13039 GLOBAL-VILLAGE - Global Village GmbH, DE	-
dns.voerde.globvill.de	212.20.160.2 2001:40b8::21	AS13039 GLOBAL-VILLAGE - Global Village GmbH, DE AS13039 GLOBAL-VILLAGE - Global Village GmbH, DE	-
ns.suedwestfalenit.de	185.41.57.11 2a02:100e:bef8:2:0:57:11:1	AS201318 SuedwestfalenIT-AS - Suedwestfalen-IT, DE AS201318 SuedwestfalenIT-AS - Suedwestfalen-IT, DE	185.41.57.11 2a02:100e:bef8:2:0:57:11:1
ns.suedwestfalenit.nrw	185.41.57.12 2a02:100e:bef8:2:0:57:12:1	AS201318 SuedwestfalenIT-AS - Suedwestfalen-IT, DE AS201318 SuedwestfalenIT-AS - Suedwestfalen-IT, DE	-

Checks

✓ 5 nameservers #6

Delegated to dns.globvill.de, dns.globvill.ruhr, dns.voerde.globvill.de, ns.suedwestfalenit.de, ns.suedwestfalenit.nrw.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 4 IPv4 /24s and 2 IPv6 /48s.
✓ 2 autonomous systems #11

The nameservers are spread over: AS13039 (GLOBAL-VILLAGE - Global Village GmbH, DE): 6 addresses; AS201318 (SuedwestfalenIT-AS - Suedwestfalen-IT, DE): 4 addresses.
✓ Nameserver names under 3 TLDs #12

Nameserver names use the TLDs .de, .nrw, .ruhr.
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

Nameservers

fail

8 of 10 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
dns.globvill.de 212.20.191.2	NOERROR, 7 ms, authoritative	no	yes / yes	refused	dns
dns.globvill.de 2001:40b8::22	NOERROR, 8 ms, authoritative	no	yes / yes	refused	dns
dns.globvill.ruhr 212.20.161.2	NOERROR, 7 ms, authoritative	no	yes / yes	refused	dns
dns.globvill.ruhr 2001:40b8::23	NOERROR, 11 ms, authoritative	no	yes / yes	refused	dns
dns.voerde.globvill.de 212.20.160.2	NOERROR, 9 ms, authoritative	no	yes / yes	refused	dns
dns.voerde.globvill.de 2001:40b8::21	NOERROR, 9 ms, authoritative	no	yes / yes	refused	dns
ns.suedwestfalenit.de 185.41.57.11	NOERROR, 12 ms, authoritative	no	yes / yes	refused	[Secured]
ns.suedwestfalenit.de 2a02:100e:bef8:2:0:57:11:1	no response	no	no / no	-	-
ns.suedwestfalenit.nrw 185.41.57.12	NOERROR, 11 ms, authoritative	no	yes / yes	refused	[Secured]
ns.suedwestfalenit.nrw 2a02:100e:bef8:2:0:57:12:1	no response	no	no / no	-	-

Checks

✗

Nameservers not responding

These addresses did not answer, so resolvers waste time on timeouts: ns.suedwestfalenit.de (2a02:100e:bef8:2:0:57:11:1): read udp [2a01:4f8:1c1c:eebf::1]:37135->[2a02:100e:bef8:2:0:57:11:1]:53: i/o timeout; ns.suedwestfalenit.nrw (2a02:100e:bef8:2:0:57:12:1): read udp [2a01:4f8:1c1c:eebf::1]:53712->[2a02:100e:bef8:2:0:57:12:1]:53: i/o timeout.

#14
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
i

Identifying string disclosed

These nameservers answer version queries with a string that is not a version number: dns.globvill.de: "dns"; dns.globvill.ruhr: "dns"; dns.voerde.globvill.de: "dns"; ns.suedwestfalenit.de: "[Secured]"; ns.suedwestfalenit.nrw: "[Secured]".

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

pass

serial 2026102100 · primary ns.suedwestfalenit.de

Found

Primary (MNAME): ns.suedwestfalenit.de
Contact (RNAME): domainverwaltung.sit.nrw
Serial: 2026102100
Refresh / retry: 86400 s / 7200 s
Expire: 2592000 s
Negative TTL: 43200 s

Serial per nameserver

Nameserver	Serial
dns.globvill.de (212.20.191.2)	2026102100
dns.globvill.de (2001:40b8::22)	2026102100
dns.globvill.ruhr (212.20.161.2)	2026102100
dns.globvill.ruhr (2001:40b8::23)	2026102100
dns.voerde.globvill.de (212.20.160.2)	2026102100
dns.voerde.globvill.de (2001:40b8::21)	2026102100
ns.suedwestfalenit.de (185.41.57.11)	2026102100
ns.suedwestfalenit.nrw (185.41.57.12)	2026102100

Checks

✓ Serial 2026102100 everywhere #22

All nameservers serve the same version of the zone.
✓ Timers within recommendations #23

SOA refresh 1d, retry 2h, expire 30d, negative TTL 12h.
✓ Primary is a public nameserver #24

The primary nameserver ns.suedwestfalenit.de is one of the listed nameservers.
✓ Contact domainverwaltung@sit.nrw #25

The SOA RNAME domainverwaltung.sit.nrw means domainverwaltung@sit.nrw.
✓ Date-based serial #26

The serial 2026102100 follows the YYYYMMDDnn convention (2026-10-21).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

warn

24 records at the apex

Found

Read from: 212.20.191.2:53

Type	Value	TTL
SOA	ns.suedwestfalenit.de. domainverwaltung.sit.nrw. 2026102100 86400 7200 2592000 43200	2592000
NS	dns.globvill.de.	86400
NS	dns.voerde.globvill.de.	86400
NS	dns.globvill.ruhr.	86400
NS	ns.suedwestfalenit.nrw.	86400
NS	ns.suedwestfalenit.de.	86400
A	185.41.57.136	60
AAAA	2a02:100e:bef8:2:0:57:136:1	60
MX	10 mx-in.kommunale.it.	60
TXT	"apple-domain-verification=oYytuSxlSmZsoxfX"	60
TXT	"v=spf1 include:_spf.kommunale.it include:_spf.nol-is.de include:spf.owl-it.de a:vhs.stadt-lippstadt.de ~all"	60
TXT	"f749d5b11f23d3d7c7bd1d7d462189686973a3b8d2cd5693d1dd1bb9b28a6a6"	60
TXT	"5a3fe579562433a98f191c6aef8043abab6c809e65dd582bb30764c873ba312"	60
TXT	"apple-domain-verification=gX5YjSftXKoXtpRY"	60
TXT	"google-site-verification=hoOv7VkYaCBKEfycrGB-qsfNgAURn2zQ7-n_OmrhlBs"	60
TXT	"6fa34db2ed46c9349343bd7167c624421564b23d6dc570bfdad7e0338bb275a"	60
TXT	"3b17923290874332334dcf944a5c9615660fbcf2c50ceff15cb33465adfc9b2"	60
TXT	"618b0444c0d577cedd68a798e2c1a9376146d72ff52270385cc8b8624c7cc08"	60
TXT	"42064a188598d07587632dc053ec479278370bcc7afc1464e9d76b33f5792ea"	60
TXT	"n2l70tao7pi48il9e0u9gsdebg"	60
TXT	"f8d21bf7daa863ba943bad79ea7f17c46b86f1081dff784621d49c13b57be3a"	60
TXT	"zone-ownership-verification-e13ca55c3e2c8c0a921c7836e623e3e2d63953ec7942737bb8b7c2384782837e"	60
TXT	"MS=6B2650DAE38497C3707DC0596B8E7FE27E0E6867"	60
TXT	"293e297555696a271491e960b123980f3fc802a6495163a37deeea1f4365f45"	60

Checks

!

Very low TTLs

These records have a TTL below 5m, causing extra queries and slower lookups: A (1m), AAAA (1m), MX (1m). Low TTLs are useful just before a planned change.

#32
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35