maersk.com

Checked 22 October 2026, 09:42 UTC · via 8.8.8.8
!Passed with warnings
22 passed 4 warnings 0 failed 5 info

Registration

info

.com generic · CSC Corporate Domains, Inc. · expires 2027-10-09

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
CSC Corporate Domains, Inc.
Registered
10 October 1995
Last changed
5 October 2026
Expires
9 October 2027
Status
client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers
a1-4.akam.net, a13-67.akam.net
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-10-09 #3
    The registration is valid until 2027-10-09 (351 days).
  • ✓ Transfer locked #4
    Registry status: client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

a1-4.akam.net, a13-67.akam.net

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
a1-4.akam.net, a13-67.akam.net
NS in the zone
a1-4.akam.net, a13-67.akam.net, a18-64.akam.net, a22-65.akam.net, a3-66.akam.net, a8-67.akam.net
NameserverAddressesNetwork (AS)Glue
a1-4.akam.net193.108.91.4 2600:1401:2::4AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a13-67.akam.net2.22.230.67 2600:1480:800::43AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a18-64.akam.net (zone only)95.101.36.64 2600:1480:4800::40AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a22-65.akam.net (zone only)23.211.61.65 2600:1480:7800::41AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a3-66.akam.net (zone only)96.7.49.66 2600:1408:1c::42AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a8-67.akam.net (zone only)2.16.40.67 2600:1403:a::43AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-

Checks

  • i
    2 nameservers
    Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: a1-4.akam.net, a13-67.akam.net.
    #6
  • !
    NS sets differ
    The nameservers at the parent and in the zone should be the same. Only in the zone: a18-64.akam.net, a22-65.akam.net, a3-66.akam.net, a8-67.akam.net. a1-4.akam.net, a13-67.akam.net, a18-64.akam.net, a22-65.akam.net, a3-66.akam.net, a8-67.akam.net report NS a1-4.akam.net a13-67.akam.net a18-64.akam.net a22-65.akam.net a3-66.akam.net a8-67.akam.net.
    #7
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 6 IPv4 /24s and 6 IPv6 /48s.
  • i
    All nameservers in one AS
    All nameserver addresses are announced by one network operator (AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 12 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.
    #11
  • i
    All nameserver names under .net
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

warn

12 of 12 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
a1-4.akam.net 193.108.91.4NOERROR, 3 ms, authoritativenoyes / yesrefused41824.8
a1-4.akam.net 2600:1401:2::4NOERROR, 4 ms, authoritativenoyes / yesrefused41824.9
a13-67.akam.net 2.22.230.67NOERROR, 4 ms, authoritativenoyes / yesrefused41824.9
a13-67.akam.net 2600:1480:800::43NOERROR, 4 ms, authoritativenoyes / yesrefused41824.11
a18-64.akam.net 95.101.36.64NOERROR, 3 ms, authoritativenoyes / yesrefused48878.30
a18-64.akam.net 2600:1480:4800::40NOERROR, 3 ms, authoritativenoyes / yesrefused48878.27
a22-65.akam.net 23.211.61.65NOERROR, 3 ms, authoritativenoyes / yesrefused48878.30
a22-65.akam.net 2600:1480:7800::41NOERROR, 3 ms, authoritativenoyes / yesrefused48878.32
a3-66.akam.net 96.7.49.66NOERROR, 4 ms, authoritativenoyes / yesrefused41824.8
a3-66.akam.net 2600:1408:1c::42NOERROR, 3 ms, authoritativenoyes / yesrefused41824.10
a8-67.akam.net 2.16.40.67NOERROR, 4 ms, authoritativenoyes / yesrefused48878.30
a8-67.akam.net 2600:1403:a::43NOERROR, 4 ms, authoritativenoyes / yesrefused48878.33

Checks

  • ✓ All respond #14
    All 12 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: a1-4.akam.net: "41824.8"; a1-4.akam.net: "41824.9"; a13-67.akam.net: "41824.9"; a13-67.akam.net: "41824.11"; a18-64.akam.net: "48878.30"; a18-64.akam.net: "48878.27"; a22-65.akam.net: "48878.30"; a22-65.akam.net: "48878.32"; a3-66.akam.net: "41824.8"; a3-66.akam.net: "41824.10"; a8-67.akam.net: "48878.30"; a8-67.akam.net: "48878.33". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 2024116615 · primary a1-4.akam.net

Found

Primary (MNAME)
a1-4.akam.net
Contact (RNAME)
hostmaster.maersk.com
Serial
2024116615
Refresh / retry
3600 s / 600 s
Expire
604800 s
Negative TTL
300 s

Serial per nameserver

NameserverSerial
a1-4.akam.net (193.108.91.4)2024116615
a1-4.akam.net (2600:1401:2::4)2024116615
a13-67.akam.net (2.22.230.67)2024116615
a13-67.akam.net (2600:1480:800::43)2024116615
a18-64.akam.net (95.101.36.64)2024116615
a18-64.akam.net (2600:1480:4800::40)2024116615
a22-65.akam.net (23.211.61.65)2024116615
a22-65.akam.net (2600:1480:7800::41)2024116615
a3-66.akam.net (96.7.49.66)2024116615
a3-66.akam.net (2600:1408:1c::42)2024116615
a8-67.akam.net (2.16.40.67)2024116615
a8-67.akam.net (2600:1403:a::43)2024116615

Checks

  • ✓ Serial 2024116615 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 1h, retry 10m, expire 7d, negative TTL 5m.
  • ✓ Primary is a public nameserver #24
    The primary nameserver a1-4.akam.net is one of the listed nameservers.
  • ✓ Contact hostmaster@maersk.com #25
    The SOA RNAME hostmaster.maersk.com means hostmaster@maersk.com.
  • ✓ Timestamp serial #26
    The serial 2024116615 is a Unix timestamp (2034-02-21 06:36 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

157 records at the apex

Found

Read from
193.108.91.4:53
TypeValueTTL
SOAa1-4.akam.net. hostmaster.maersk.com. 2024116615 3600 600 604800 30086400
NSa13-67.akam.net.86400
NSa3-66.akam.net.86400
NSa1-4.akam.net.86400
NSa8-67.akam.net.86400
NSa18-64.akam.net.86400
NSa22-65.akam.net.86400
A2.16.204.920
A2.16.204.3320
MX10 maersk-com.mail.protection.outlook.com.300
TXT"miro-verification=d0b7dde033085c907a3ee9555938b9482de5fc81"300
TXT"3rgaome6aidt94tk5sa6rd1bf"300
TXT"492gcbqdarq132p0us0vb1pd44"300
TXT"n93fcaaoksjbr61gb39ljmveef"300
TXT"lq2ab1kh666i3orqgah654e333"300
TXT"148mriu5esgcfoa0sp5dgvb0d9"300
TXT"nno6u1pksrb7fpr3qluil2de1p"300
TXT"gkpog1gb3ahdfqo6lrh4n2u93p"300
TXT"kdi0sbbg2clnmq70bfocd733uj"300
TXT"23gr26e6glfrgonddj8em3bcmm"300
TXT"_zjewwlz1b5r7wh4fvigkhr6pxh0vtky"300
TXT"hsnu4ttm19lijfrhp4jioahu1d"300
TXT"uj8l0jt58el1pcsh96fdis3qvv"300
TXT"6h6qq9escdu6pdi67706r8iplv"300
TXT"1qjv56kklr7i53sqeit7coaovl"300
TXT"41pbfht324vha8fch5h8m9npbi"300
TXT"atlassian-domain-verification=XsiRE7vL/wteQab1X/BscwjB/M3Exkmsg0WSgYRPV/YJsz1bRfKaolSza7YH5z3n"300
TXT"mongodb-site-verification=xz5kyrhatFlXE6KTw8YjbRUwEpcBIMNn"300
TXT"2surqnthcn9pnc8fu1fu498ff"300
TXT"5qqr9g66v0c6c8o6rb8l04a9k0"300
TXT"rgpazewpmlit001central"300
TXT"dimsnci884tg75jivtrs4p4of3"300
TXT"ou1d5buo3ttr1bb9hedsnjei8j"300
TXT"j3kv5n8qm2nc0m21r9aj9ujvh7"300
TXT"dhdu5q1gvetbib3l5j1n4ssfn5"300
TXT"42cb4t8faq6fsbprsrpfi35ppk"300
TXT"81jedev5eaaeutebu9435nr6si"300
TXT"cursor-domain-verification-cha7kf=0I86owCLxoMeriU8qqYzvhntU"300
TXT"jo5cqcods1pb8i0q8dl28v5g4v"300
TXT"rgpazewpmlit001routingci"300
TXT"5j6v1o63kil0d58odb1d87hvf8"300
TXT"ssa8a3l8m90temgvmpthlbr70f"300
TXT"7h7pd7vvdp8e1n5cf191q2l6l"300
TXT"mongodb-site-verification=ZQd4t5sozp9FAyv9IRVRUTftEFoxwJhl"300
TXT"bv8psrq20vnnt4dvn73ue73m3k"300
TXT"1t8m8qmjmh7q2fdilbnq3stc3a"300
TXT"id9hs4uof4l1p0rmp1hj1139st"300
TXT"f4ihg4lfrm6pleovtgv5jfsoot"300
TXT"mi7u8sm99g18qh1mlv0tk9tbul"300
TXT"bqn60jp6891lipmt7v6nktgbd6"300
TXT"slljr60q1vu5hfcpfeeev10r35"300
TXT"_tw3nsn8r3nsjz6800lj5ankh85xxf3n"300
TXT"36f29c04-1f67-4322-8baf-1d026189edee"300
TXT"ch9lshqqn2tv3jtq7kkqged6tk"300
TXT"fbust4a8vmoauersj2fodfl7n7"300
TXT"eeo6mo5d1hmeugn679r0oiv0ng"300
TXT"pn86ihce8oa5t171keq45l0g80"300
TXT"Foxit-domain-verification=a954070b142f21a0f7ca2a3991519638"300
TXT"77serhlq2vj1tiudga1buc7hte"300
TXT"10btj73q3evdis5lnpfc9ksj3q"300
TXT"65bp75bftmvkatlnatkr5eiirr"300
TXT"8a1dtbg5nmfu2hg57j1g99treh"300
TXT"n8gt0aeu985jlabeub9k7hpgco"300
TXT"p45qecp0k3hj0sea5lffco316l"300
TXT"kgepqfogbs65m9tovu8k72gr9g"300
TXT"hb74d1cu5ls4betiap7nl2cjim"300
TXT"c0l46oeumomil5ov4jl93j1jkl"300
TXT"mf1kd3asueihfti46dl1c88d3a"300
TXT"9m5mi5jlgmvfmcciamekmbdl5o"300
TXT"v=spf1 include:_u.maersk.com._spf.smart.ondmarc.com -all"300
TXT"ie0kss9gsqoroqmchudfdd9rhc"300
TXT"j0h44o2k3qs4d3ike069b1tut6"300
TXT"tskbji449m7fiqma498i15kotp"300
TXT"ddv70olmh6r5kk5vqp2rdkrcb2"300
TXT"nu3ao59nh1c4v9m46b4j6mc6n3"300
TXT"aje5b2oev60oii104dd85qg2g"300
TXT"xr5v454q13vjzrgxtfgfvjvjx6j0c830"300
TXT"openai-domain-verification=dv-a9LmqfaNtFXPXIg14vgETxkf"300
TXT"qd1rr3fpf7p4tcm7vn8og5dkp4"300
TXT"pn4d8s2vlcgqjenjkcgk876nej"300
TXT"apple-domain-verification=HkWSufb_CogGVVxCuByRVGuMblR1sEaXuHQuJu5Xo5g"300
TXT"mkdbsvfm5e5rkksbvj15soa0pg"300
TXT"puso8g93q9ptavso172dgi90nh"300
TXT"rkkru701l161vlrskovo4prkr2"300
TXT"3jvq6l55qch4clmam5q79r55ar"300
TXT"6tf23eu70hd5a9kcite7khb7vp"300
TXT"gt03o825cbhtmc9cj3e5l5gnj2"300
TXT"s5ljpv25iufsep78hg0uof8mr5"300
TXT"onetrust-domain-verification=f85c433a671d4368b18d444638261e66"300
TXT"v6nego07mskrncv0b1cj091l8r"300
TXT"87li7i0f9laenppra4punqor1s"300
TXT"3lhg76k896hm47rf3ic7i0pho4"300
TXT"sdlclttmj0q1sohnseehass3ap"300
TXT"jel89og4lac0skdf9qrk66addp"300
TXT"bgihg7vijekmoqi4i337vnvh7j"300
TXT"fv5sb1cfgqkptpbqefqfeneik3"300
TXT"mqm7nh8nu2o5effgqff0s89p16"300
TXT"3ip3hhu6gom012d6hgc1avf5it"300
TXT"l57i6h0thdrpibp9rjf99tagmj"300
TXT"google-site-verification=lZm7QwNROkT-2o3pRjKIO1r7fQMr6vetbxRLWA7NN2g"300
TXT"msfpkey=6x7vn6kmlfi5cxp8pmjuwy41p"300
TXT"c3a926jk5q42fuiloc43b6igfa"300
TXT"figma-domain-verification=e348683a8bb5022f61c17b93dd471327663d35054fdd73aa37e00c35d9cff27a-1767872510"300
TXT"nr9fn5805ujj1amet8g9uekt6q"300
TXT"qtbj2g1arb36ilofp94bh4h1c3"300
TXT"9ia8smovvtikh3fcblqonl1pjo"300
TXT"asv=d5b13324fb96e4a7da97e74c452b2853"300
TXT"du2l05h268aa0q6kktuf6qp03d"300
TXT"n3049k5qt3tuvbtc9nh9af38gv"300
TXT"recm0v1gko3j0e9276tqd4ceoc"300
TXT"k88vtkmsohjupk28ktqug3qjng"300
TXT"l744hgr61cfvbl50tnapsknmha"300
TXT"5hb3bk32kjkb965v8sd3r9k6nf"300
TXT"2ja6bcr3r0m3fl943qh38qe2qj"300
TXT"intersight=bb870959daf9c2e79cf3043c8f631def6cd0cbbd0affe210e058841aacf8899e"300
TXT"h69ulrk29v1rjf5s04unkn8jmp"300
TXT"ntfin2fhbr87h0hpjq8s20o86j"300
TXT"j05vu6duolcsfjajmcagspik3s"300
TXT"550jadoecaudege2clr01vuusg"300
TXT"smartsheet-site-validation=0pqzhiVD-b8Kv6bPwVT5NX0OvQbZ2mKo"300
TXT"4vu0qrr3isdhakvh1c0ngujilk"300
TXT"9jaoouukfocetp57qvkhqu3be"300
TXT"g55c0bq29ik43bhug65edoariv"300
TXT"nhbu78s8dt9bngp6291hseeuir"300
TXT"asv=2008907196855064eea2dadbb42409da"300
TXT"apple-domain-verification=2rnDCx91XO0PqJl5qLEoTImq1IxAmfTYk8oYENNnISw"300
TXT"o0he05s5405c4o623t7173ssrq"300
TXT"laskcbimv5bfohiu15kdmuj8ha"300
TXT"s4vnm53kct54n01el1id0mdlr8"300
TXT"dlfiofkttimaqh7ugilm414iht"300
TXT"aol922vtcmvnm83dl02650rvfc"300
TXT"aadhdmh7a3tdk2ikgoe6lha8ku"300
TXT"uv74rsr2dudfjcnq98d7qjbqeg"300
TXT"m4uaoena4v0lnadd6bvbf67rlv"300
TXT"374etrmoiqn99ln98upk0fca5q"300
TXT"m5rcu5chaukuq275g0s3qsoqiu"300
TXT"kcitk7gq9rf3sb26agdkqutt8a"300
TXT"9ofkt047fr6i4uggeu08blbiro"300
TXT"en37jelp58mhv6i395draqippn"300
TXT"cavndqlrcta51qdq398j30qd25"300
TXT"mvpiu453h4hctsovdp7v727mvn"300
TXT"mrh4mta9alh2c943eis5l7v371"300
TXT"bnpt3gm9ccavr1k89ll70ia3hr"300
TXT"agb5rqtql2lf133ri7qvjhqm1v"300
TXT"s46ic6pe2ok4trbqp3gcsoe50f"300
TXT"b7dr9949doeicc0alt5dhnjrje"300
TXT"78rvlkvno0ca5rj6iau3snp1i"300
TXT"9kbe7dtbn7rbjdsvrrhv6436ut"300
TXT"2o9hqftk57cbjfcpdsmf2tts5c"300
TXT"5m78ven45842qmgcjuo58ia9qv"300
TXT"va3546n45va45tpg5o44n92d0l"300
TXT"4njlcf91om7mdimlrj2ehjheen"300
TXT"qcbmfjig0ag3obr06stae52805"300
TXT"o9u4lfg02cbgpmbm1r1533rjbi"300
TXT"jamf-site-verification=2X_0u0iYM5V-C39QiuAvSg"300
TXT"anthropic-domain-verification-rngh5k=ScB2CO8chVFOPa2mIbAyrNtpw"300
CAA0 issuemail "sectigo.com"1800

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (20s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • i
    Wildcard record
    A random name under the zone resolves, so there is a wildcard (*) record. Typos and non-existent hosts resolve too, which can confuse mail and certificate checks.
    #34
  • ✓ CAA restricts issuance #35
    Certificates may be issued by: .