Domain report: lloydsbank.com

Registration

info

.com generic · CSC Corporate Domains, Inc. · expires 2027-06-20

Found

TLD: .com (generic)
ICANN policies apply: yes
Registrar: CSC Corporate Domains, Inc.
Registered: 21 June 1994
Last changed: 14 September 2026
Expires: 20 June 2027
Status: client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers: ns2.lloydstsb.co.uk, ns5.lloydstsb.net, ns7.lloydsbanking.com, ns8.lloydsbanking.co.uk
RDAP server: https://rdap.verisign.com/com/v1/

Checks

i

.com is a generic TLD (gTLD)

Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.

#1
✓ TLD delegated and signed #2

.com is delegated in the root zone and DNSSEC-signed.
✓ Expires on 2027-06-20 #3

The registration is valid until 2027-06-20 (240 days).
✓ Transfer locked #4

Registry status: client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
✓ Registry and delegation match #5

The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

ns2.lloydstsb.co.uk, ns5.lloydstsb.net, ns7.lloydsbanking.com, ns8.lloydsbanking.co.uk

Found

Parent zone: com
Delegation from: a.gtld-servers.net (192.5.6.30)
NS at the parent: ns2.lloydstsb.co.uk, ns5.lloydstsb.net, ns7.lloydsbanking.com, ns8.lloydsbanking.co.uk
NS in the zone: ns2.lloydstsb.co.uk, ns5.lloydstsb.net, ns7.lloydsbanking.com, ns8.lloydsbanking.co.uk

Nameserver	Addresses	Network (AS)	Glue
ns2.lloydstsb.co.uk	141.92.25.25	AS8435 LBG_INTERNET_EDGE - Lloyds Banking Group PLC, GB	-
ns5.lloydstsb.net	141.92.29.29	AS8435 LBG_INTERNET_EDGE - Lloyds Banking Group PLC, GB	-
ns7.lloydsbanking.com	108.59.171.1	AS31898 ORACLE-BMC-31898 - Oracle Corporation, US	108.59.171.1
ns8.lloydsbanking.co.uk	108.59.173.1	AS31898 ORACLE-BMC-31898 - Oracle Corporation, US	-

Checks

✓ 4 nameservers #6

Delegated to ns2.lloydstsb.co.uk, ns5.lloydstsb.net, ns7.lloydsbanking.com, ns8.lloydsbanking.co.uk.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 4 IPv4 /24s and 0 IPv6 /48s.
✓ 2 autonomous systems #11

The nameservers are spread over: AS31898 (ORACLE-BMC-31898 - Oracle Corporation, US): 2 addresses; AS8435 (LBG_INTERNET_EDGE - Lloyds Banking Group PLC, GB): 2 addresses.
✓ Nameserver names under 3 TLDs #12

Nameserver names use the TLDs .com, .net, .uk.
!

No IPv6

None of the nameservers has an IPv6 address, so IPv6-only resolvers can't reach them.

#13

Nameservers

pass

4 of 4 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
ns2.lloydstsb.co.uk 141.92.25.25	NOERROR, 17 ms, authoritative	no	yes / yes	refused	-
ns5.lloydstsb.net 141.92.29.29	NOERROR, 17 ms, authoritative	no	yes / yes	refused	-
ns7.lloydsbanking.com 108.59.171.1	NOERROR, 66 ms, authoritative	no	yes / yes	refused	-
ns8.lloydsbanking.co.uk 108.59.173.1	NOERROR, 4 ms, authoritative	no	yes / yes	refused	-

Checks

✓ All respond #14

All 4 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
✓ No version disclosed #17

The nameservers don't reveal their software version.
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

info

serial 347257 · primary llgb-rka3-nsvl-gm0x.machine.group

Found

Primary (MNAME): llgb-rka3-nsvl-gm0x.machine.group
Contact (RNAME): infobloxadmin.lloydsbanking.com
Serial: 347257
Refresh / retry: 10800 s / 1080 s
Expire: 2592000 s
Negative TTL: 900 s

Serial per nameserver

Nameserver	Serial
ns2.lloydstsb.co.uk (141.92.25.25)	347257
ns5.lloydstsb.net (141.92.29.29)	347257
ns7.lloydsbanking.com (108.59.171.1)	347257
ns8.lloydsbanking.co.uk (108.59.173.1)	347257

Checks

✓ Serial 347257 everywhere #22

All nameservers serve the same version of the zone.
✓ Timers within recommendations #23

SOA refresh 3h, retry 18m, expire 30d, negative TTL 15m.
i

Hidden master (not resolvable)

The primary nameserver llgb-rka3-nsvl-gm0x.machine.group is not listed as a nameserver and does not resolve publicly: a hidden master, or a placeholder name. Some tools (e.g. dynamic updates) use MNAME to find the primary.

#24
✓ Contact infobloxadmin@lloydsbanking.com #25

The SOA RNAME infobloxadmin.lloydsbanking.com means infobloxadmin@lloydsbanking.com.
✓ Counter serial #26

The serial 347257 is a plain counter.

DNSSEC

warn

Signed, DS published at parent

Found

Validated by resolver: yes
Denial of existence: NSEC3
NSEC3: 10 iterations, 7-byte salt
Signatures valid until: 26 October 2026

DS at the parent

Key tag	Algorithm	Digest	Matches a key
14750	RSASHA256 (8)	SHA256 2FA86EB177336ECF…	yes
62120	RSASHA256 (8)	SHA256 8E1E3F2B704FD598…	yes

DNSKEY in the zone

Key tag	Role	Algorithm
14750	KSK (257)	RSASHA256 (8)
17926	ZSK (256)	RSASHA256 (8)
62120	KSK (257)	RSASHA256 (8)
10239	ZSK (256)	RSASHA256 (8)

Checks

✓ Signed and validated #27

The zone is signed, the parent publishes a DS record, and the resolver validates the answers.
✓ DS matches a key #28

The DS record at the parent matches a key in the zone: key tag 14750 (SHA256), key tag 62120 (SHA256).
✓ Modern algorithms #29

Key algorithms: RSASHA256 (8).
✓ Short-lived signatures (online signing) #30

Signatures are valid for 97h0m0s and created on demand; the current one was made at 2026-10-22 04:17 UTC and expires at 2026-10-26 05:05 UTC.
!

NSEC3 with extra iterations or salt

NSEC3 uses 10 iterations and a 7-byte salt. RFC 9276 recommends 0 iterations and no salt: extra iterations cost resolvers CPU and add no real protection, and some validators treat high counts as insecure.

#31

Records

info

23 records at the apex

Found

Read from: 141.92.25.25:53

Type	Value	TTL
SOA	llgb-rka3-nsvl-gm0x.machine.group. infobloxadmin.lloydsbanking.com. 347257 10800 1080 2592000 900	28800
NS	ns5.lloydstsb.net.	28800
NS	ns2.lloydstsb.co.uk.	28800
NS	ns8.lloydsbanking.co.uk.	28800
NS	ns7.lloydsbanking.com.	28800
A	34.160.35.241	28800
A	34.149.7.15	28800
MX	0 lloydsbank-com.mail.protection.outlook.com.	28800
TXT	"L0L0O17646"	28800
TXT	"facebook-domain-verification=28rkx0zxw8evdo6nc0d1w8f2t6a2hj"	28800
TXT	"QuoVadis=9c3ce124-3a4a-4945-bea6-0cc8fb9ed6ed"	28800
TXT	"62dgmygmlskmd4y3cl9mggymztztq5nv"	28800
TXT	"cisco-ci-domain-verification=2adb560af593ecae3aee33d9f0cd74d3be5d58cbaa858f7701cb2749a23b78d3"	28800
TXT	"8z63npbdvwj3c9hlb6klmg79fg9hl2sp"	28800
TXT	"_mim76zuk4scvrhfwmsb66k7pkl7rpw0"	28800
TXT	"_nlb0chv19p3bdd5ajbwddslnaa8w4oj"	28800
TXT	"google-site-verification=QKUer40ijzdw6JAyOri7Cbvnlo0rEgzYjk4MYfY5uEU"	28800
TXT	"_swy989c4j6lx0xicsu26sdl908590a2"	28800
TXT	"v=spf1 mx include:spf.protection.outlook.com include:spf.messagelabs.com include:_spf.vsn.voltage.com ip4:141.92.30.96/28 ip4:141.92.25.96/28 -all"	28800
TXT	"714A06EB-592D-458E-B870-524AA5AA8629.120618"	28800
TXT	"webexdomainverification.JF3U=832ef206-4ee5-4b08-8b4d-e1fc7f7321bc"	28800
TXT	"UifNJixYRrzzngcy/u2KMwqhXcZu91oo21F/MfWwj1vbDFFiCGYAdfftQNlknv+fQderttFRvpNeWRctYn1D+g=="	28800
TXT	"MS=ms45549862"	28800

Checks

✓ TTLs within range #32

TTLs: A 8h, MX 8h, NS 8h. The NS TTL at the parent is 2d and in the zone 8h; resolvers may use either.
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35