Domain report: lmz-bw.de

Registration

info

.de country-code

Found

TLD: .de (country-code)
ICANN policies apply: no

Checks

i

.de is a country-code TLD (ccTLD)

Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.

#1
✓ TLD delegated and signed #2

.de is delegated in the root zone and DNSSEC-signed.
i

Registration data not available

No registration data via RDAP: the registry of .de offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.

#3

Delegation

warn

dns-f.lmz-bw.de, dns-z.lmz-bw.de, dns1.belwue.de, dns3.belwue.de

Found

Parent zone: de
Delegation from: a.nic.de (194.0.0.53)
NS at the parent: dns-f.lmz-bw.de, dns-z.lmz-bw.de, dns1.belwue.de, dns3.belwue.de
NS in the zone: dns-f.lmz-bw.de, dns-z.lmz-bw.de, dns3.belwue.de

Nameserver	Addresses	Network (AS)	Glue
dns-f.lmz-bw.de	151.236.17.212 2a03:f80:49:151:236:17:212:53	AS9009 M247 - M247 Europe SRL, RO AS9009 M247 - M247 Europe SRL, RO	151.236.17.212 2a03:f80:49:151:236:17:212:53
dns-z.lmz-bw.de	178.209.52.186 2a02:418:6a04:178:209:52:186:53	AS29691 NINE - Nine Internet Solutions AG, CH AS29691 NINE - Nine Internet Solutions AG, CH	178.209.52.186 2a02:418:6a04:178:209:52:186:53
dns1.belwue.de (parent only)	129.143.2.10 2001:7c0::53:10	AS553 BELWUE - Universitaet Stuttgart, DE AS553 BELWUE - Universitaet Stuttgart, DE	129.143.2.10 2001:7c0::53:10
dns3.belwue.de	129.143.253.133 2001:7c0:0:253::133	AS553 BELWUE - Universitaet Stuttgart, DE AS553 BELWUE - Universitaet Stuttgart, DE	129.143.253.133 2001:7c0:0:253::133

Checks

✓ 4 nameservers #6

Delegated to dns-f.lmz-bw.de, dns-z.lmz-bw.de, dns1.belwue.de, dns3.belwue.de.
!

NS sets differ

The nameservers at the parent and in the zone should be the same. Only at the parent: dns1.belwue.de. dns-f.lmz-bw.de, dns-z.lmz-bw.de, dns1.belwue.de, dns3.belwue.de report NS dns-f.lmz-bw.de dns-z.lmz-bw.de dns3.belwue.de.

#7
✓ Glue present and correct #8

Glue is published for the nameservers inside the zone: dns-f.lmz-bw.de, dns-z.lmz-bw.de.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 4 IPv4 /24s and 3 IPv6 /48s.
✓ 3 autonomous systems #11

The nameservers are spread over: AS29691 (NINE - Nine Internet Solutions AG, CH): 2 addresses; AS553 (BELWUE - Universitaet Stuttgart, DE): 4 addresses; AS9009 (M247 - M247 Europe SRL, RO): 2 addresses.
i

All nameserver names under .de

All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

#12
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

Nameservers

fail

6 of 8 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
dns-f.lmz-bw.de 151.236.17.212	NOERROR, 4 ms, authoritative	no	yes / yes	refused	-
dns-f.lmz-bw.de 2a03:f80:49:151:236:17:212:53	no response	no	no / no	-	-
dns-z.lmz-bw.de 178.209.52.186	NOERROR, 10 ms, authoritative	no	yes / yes	refused	-
dns-z.lmz-bw.de 2a02:418:6a04:178:209:52:186:53	no response	no	no / no	-	-
dns1.belwue.de 129.143.2.10	NOERROR, 7 ms, authoritative	no	yes / yes	refused	PowerDNS Authoritative Server 4.5.5 (built Dec 8 2022 18:24:18 by root@a309361b6303)
dns1.belwue.de 2001:7c0::53:10	NOERROR, 7 ms, authoritative	no	yes / yes	refused	PowerDNS Authoritative Server 4.5.5 (built Dec 8 2022 18:24:18 by root@a309361b6303)
dns3.belwue.de 129.143.253.133	NOERROR, 7 ms, authoritative	no	yes / yes	refused	PowerDNS Authoritative Server 4.5.5 (built Dec 8 2022 18:24:18 by root@a309361b6303)
dns3.belwue.de 2001:7c0:0:253::133	NOERROR, 7 ms, authoritative	no	yes / yes	refused	PowerDNS Authoritative Server 4.5.5 (built Dec 8 2022 18:24:18 by root@a309361b6303)

Checks

✗

Nameservers not responding

These addresses did not answer, so resolvers waste time on timeouts: dns-f.lmz-bw.de (2a03:f80:49:151:236:17:212:53): read udp [2a01:4f8:1c1c:eebf::1]:47775->[2a03:f80:49:151:236:17:212:53]:53: i/o timeout; dns-z.lmz-bw.de (2a02:418:6a04:178:209:52:186:53): read udp [2a01:4f8:1c1c:eebf::1]:49215->[2a02:418:6a04:178:209:52:186:53]:53: i/o timeout.

#14
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
!

Software version disclosed

These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: dns1.belwue.de: "PowerDNS Authoritative Server 4.5.5 (built Dec 8 2022 18:24:18 by root@a309361b6303)"; dns3.belwue.de: "PowerDNS Authoritative Server 4.5.5 (built Dec 8 2022 18:24:18 by root@a309361b6303)". Hide or replace the version string.

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

pass

serial 2026101904 · primary dns-f.lmz-bw.de

Found

Primary (MNAME): dns-f.lmz-bw.de
Contact (RNAME): hostmaster.lmz-bw.de
Serial: 2026101904
Refresh / retry: 3600 s / 900 s
Expire: 3456000 s
Negative TTL: 300 s

Serial per nameserver

Nameserver	Serial
dns-f.lmz-bw.de (151.236.17.212)	2026101904
dns-z.lmz-bw.de (178.209.52.186)	2026101904
dns1.belwue.de (129.143.2.10)	2026101904
dns1.belwue.de (2001:7c0::53:10)	2026101904
dns3.belwue.de (129.143.253.133)	2026101904
dns3.belwue.de (2001:7c0:0:253::133)	2026101904

Checks

✓ Serial 2026101904 everywhere #22

All nameservers serve the same version of the zone.
✓ Timers within recommendations #23

SOA refresh 1h, retry 15m, expire 40d, negative TTL 5m.
✓ Primary is a public nameserver #24

The primary nameserver dns-f.lmz-bw.de is one of the listed nameservers.
✓ Contact hostmaster@lmz-bw.de #25

The SOA RNAME hostmaster.lmz-bw.de means hostmaster@lmz-bw.de.
✓ Date-based serial #26

The serial 2026101904 follows the YYYYMMDDnn convention (2026-10-19).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

info

21 records at the apex

Found

Read from: 151.236.17.212:53

Type	Value	TTL
SOA	dns-f.lmz-bw.de. hostmaster.lmz-bw.de. 2026101904 3600 900 3456000 300	600
NS	dns-f.lmz-bw.de.	600
NS	dns-z.lmz-bw.de.	600
NS	dns3.belwue.de.	600
A	89.146.234.130	600
MX	0 lmzbw-de0i.mail.protection.outlook.com.	600
TXT	"v=spf1 mx ip4:88.99.223.27 ip4:89.146.234.130 ip4:62.146.8.31 ip4:92.205.196.5 ip4:193.196.128.254 ip4:89.19.228.100 ip4:89.19.228.101 ip4:89.19.228.77 ip4:188.40.58.247 ip4:5.35.234.234 " "ip4:195.66.99.135 ip4:62.75.247.44 ip4:212.227.89.57 ip4:217.160.226.166 ip4:82.165.193.1 ip4:85.25.144.9 ip4:54.194.192.132 ip4:87.79.30.25 ip4:87.79.30.30 ip4:91.217.141.0/24 " "ip4:195.34.176.144/28 ip4:195.34.183.168/29 ip4:89.146.242.9 ip4:195.34.176.148 ip4:195.34.176.149 ip6:2a01:130:195::34:183:160/123 ip6:2a01:130:8495:1002::1002 ip6:2a01:130:8495:1002::1003 ip6:2a01:130:8495:1002::/64 " "ip4:5.35.225.0/24 ip4:5.35.226.0/24 ip4:5.35.232.0/22 ip4:5.175.14.0/24 ip4:50.63.8.0/22 ip4:52.26.164.15/32 ip4:52.89.65.132/32 " "ip4:54.184.82.65/32 ip4:54.214.222.76/32 ip4:68.178.181.0/24 ip4:68.178.213.0/24 ip4:68.178.252.0/24 ip4:72.167.168.0/24 " "ip4:72.167.172.0/24 ip4:72.167.218.0/24 ip4:72.167.234.0/24 ip4:72.167.238.0/24 ip4:80.67.16.0/20 ip4:80.237.130.0/24 ip4:80.237.132.0/23 ip4:80.237.137.0/24 " "ip4:80.237.138.0/24 ip4:83.169.24.0/21 ip4:87.230.40.0/21 ip4:87.230.60.0/22 ip4:87.230.104.0/22 ip4:91.216.90.0/24 ip4:91.250.64.0/21 " "ip4:92.51.170.64/27 ip4:92.204.65.0/28 ip4:92.204.71.0/24 ip4:92.204.81.0/24 ip4:97.74.135.0/24 ip4:132.148.124.0/24 ip4:134.119.224.0/19 ip4:173.201.192.0/23 " "ip4:176.28.32.0/21 ip4:178.77.80.0/21 ip4:178.77.104.0/21 ip4:178.77.112.0/21 ip4:182.50.132.0/24 ip4:184.168.128.0/24 ip4:184.168.131.0/24 ip4:184.168.200.0/24 ip4:184.168.224.0/24 ip4:188.121.52.0/24 " "ip4:188.121.53.0/24 ip4:198.71.224.0/19 ip4:208.109.80.0/24 ip4:208.109.194.0/24 ip4:216.69.139.0/24 ip4:193.196.128.220 " "a:mail01.fwu.de " "ip6:2a00:1158:400:1::/120 include:spf.protection.outlook.com include:_spf.belwue.de include:sendgrid.net include:_spf1.mailgun.org include:_spf2.mailgun.org include:_spf.eu.mailgun.org include:spf.crsend.com ip4:5.35.234.0/24 -all"	60
TXT	"openai-domain-verification=dv-GMHKqcrjRwC1g594MGSrRs6k"	60
TXT	"_2iryligi495khckfmepb41dkyqijcai"	60
TXT	"have-i-been-pwned-verification=f597f739c1ff6e95c861ac21049a25a3"	60
TXT	"apple-domain-verification=vDhE85EENsV79tUR"	60
TXT	"samsung-domain-verification=0a36f5e5-3161-44ca-a75e-7622d5cfca42"	60
TXT	"apple-domain-verification=ogpMsvmyOqrbCI6B"	60
TXT	"miro-verification=dbf76982d96ec6343413ef7bdf418179b57be40b"	60
TXT	"Landesmedienzentrum Baden-Wuerttemberg, Rotenbergstr. 111, D-70190 Stuttgart"	60
TXT	"apple-domain-verification=RoPxnicY06IP4O7c"	60
TXT	"apple-domain-verification=QvJmhsVS05BVKPKE"	60
TXT	"_uwhdg4n8a38ojebmmyvtra2fn3tzwxi"	60
TXT	"Uj7zARAfL09In3xGgfAyu370Fyt+BPou9SEcRl1VVKsxBSlTDEUOryxz5MFaIzhebbnujhApHfrhoBzIRx/SXg=="	60
TXT	"_q9r5rpmznqelor4a4cmhggvs68wjhon"	60
TXT	"apple-domain-verification=9q1bZAAfZhF3uNmD"	60

Checks

✓ TTLs within range #32

TTLs: A 10m, MX 10m, NS 10m. The NS TTL at the parent is 1d and in the zone 10m; resolvers may use either.
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35