Domain report: marketo.com

Registration

info

.com generic · Nom-iq Ltd. dba COM LAUDE · expires 2027-07-23

Found

TLD: .com (generic)
ICANN policies apply: yes
Registrar: Nom-iq Ltd. dba COM LAUDE
Registered: 23 July 2002
Last changed: 18 June 2019
Expires: 23 July 2027
Status: client delete prohibited, client transfer prohibited, client update prohibited
Registry nameservers: ns1.marketo.com, ns2.mktdns.com
RDAP server: https://rdap.verisign.com/com/v1/

Checks

i

.com is a generic TLD (gTLD)

Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.

#1
✓ TLD delegated and signed #2

.com is delegated in the root zone and DNSSEC-signed.
✓ Expires on 2027-07-23 #3

The registration is valid until 2027-07-23 (274 days).
✓ Transfer locked #4

Registry status: client delete prohibited, client transfer prohibited, client update prohibited.
✓ Registry and delegation match #5

The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

ns1.marketo.com, ns2.mktdns.com

Found

Parent zone: com
Delegation from: a.gtld-servers.net (192.5.6.30)
NS at the parent: ns1.marketo.com, ns2.mktdns.com
NS in the zone: ns1.marketo.com, ns2.mktdns.com

Nameserver	Addresses	Network (AS)	Glue
ns1.marketo.com	208.77.136.240	AS15224 OMNITURE - Adobe Inc., US	208.77.136.240
ns2.mktdns.com	192.28.164.191	AS15224 OMNITURE - Adobe Inc., US	192.28.164.191

Checks

i

2 nameservers

Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: ns1.marketo.com, ns2.mktdns.com.

#6
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ Glue present and correct #8

Glue is published for the nameservers inside the zone: ns1.marketo.com.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 2 IPv4 /24s and 0 IPv6 /48s.
i

All nameservers in one AS

All nameserver addresses are announced by one network operator (AS15224 (OMNITURE - Adobe Inc., US): 2 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.

#11
i

All nameserver names under .com

All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

#12
!

No IPv6

None of the nameservers has an IPv6 address, so IPv6-only resolvers can't reach them.

#13

Nameservers

fail

2 of 2 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
ns1.marketo.com 208.77.136.240	NOERROR, 87 ms, authoritative	no	yes / yes	ALLOWED (1851 records)	9.11.36-RedHat-9.11.36-16.el8_10.8
ns2.mktdns.com 192.28.164.191	NOERROR, 154 ms, authoritative	no	no / yes	refused	9.11.36-RedHat-9.11.36-16.el8_10.8

Checks

✓ All respond #14

All 2 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
!

Software version disclosed

These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: ns1.marketo.com: "9.11.36-RedHat-9.11.36-16.el8_10.8"; ns2.mktdns.com: "9.11.36-RedHat-9.11.36-16.el8_10.8". Hide or replace the version string.

#17
✗

Zone transfer allowed

These nameservers send the complete zone to anyone who asks (AXFR), exposing all host names: ns1.marketo.com (208.77.136.240): 1851 records. Restrict zone transfers to your secondary servers.

#18
✗

No DNS over TCP

DNS over TCP is required (RFC 7766); without it, large answers such as DNSSEC responses fail. Not answering over TCP: ns2.mktdns.com (192.28.164.191): dial tcp 192.28.164.191:53: connect: connection refused.

#19
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

warn

serial 2026102103 · primary ns1.marketo.com

Found

Primary (MNAME): ns1.marketo.com
Contact (RNAME): ops.localhost
Serial: 2026102103
Refresh / retry: 900 s / 900 s
Expire: 604800 s
Negative TTL: 900 s

Serial per nameserver

Nameserver	Serial
ns1.marketo.com (208.77.136.240)	2026102103
ns2.mktdns.com (192.28.164.191)	2026102103

Checks

✓ Serial 2026102103 everywhere #22

All nameservers serve the same version of the zone.
!

Unusual SOA timers

refresh 15m is outside 20m–1d; retry 15m should be shorter than refresh 15m. Current values: refresh 15m, retry 15m, expire 7d, negative TTL 15m.

#23
✓ Primary is a public nameserver #24

The primary nameserver ns1.marketo.com is one of the listed nameservers.
!

Invalid contact address

The SOA RNAME "ops.localhost" is not a valid mailbox (expected e.g. hostmaster.example.com).

#25
✓ Date-based serial #26

The serial 2026102103 follows the YYYYMMDDnn convention (2026-10-21).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

info

26 records at the apex

Found

Read from: 208.77.136.240:53

Type	Value	TTL
SOA	ns1.marketo.com. ops.localhost. 2026102103 900 900 604800 900	600
NS	ns1.marketo.com.	600
NS	ns2.mktdns.com.	600
A	104.18.192.233	600
MX	10 marketo-com.mail.protection.outlook.com.	300
MX	100 adobe.mail.protection.outlook.com.	300
TXT	"MS=ms95387274"	600
TXT	"google-site-verification=9EUaxC5OqIbeG4VTqGtgy2UbZLMfAe2ZM28MMeaMLBs"	600
TXT	"MS=ms34806256"	600
TXT	"google-site-verification=pQ-Gk4cCtY1t5UU-JTkuKKyhjk2QdWIgPaiBMrJR1SM"	600
TXT	"status-page-domain-verification=pqmpb1yvw1dz"	600
TXT	"google-site-verification=E1jvuT8o7bA75beg9XslqDeMnufcOqhJBsyzIwQ6Xe0"	600
TXT	"google-site-verification=CztEkUCnQ1v0EudqzeJbKUkjMu4CqDvvXM131NfM7pk"	600
TXT	"OSSRH-67446"	600
TXT	"MS=ms51195664"	600
TXT	"google-site-verification=auBtgWYdtkcIKKM-fRd2FxgOZvVSB8MLPhO7SERZwtE"	600
TXT	"google-site-verification=dFL4BAJgqXndkGQuoX-c039VOnPm0ptVLB9M4Pl9RPw"	600
TXT	"google-site-verification=xxDOZ8jDWKvy0lo6P3CxZAz3i5ZdRt_QUaKf7RQrh1Y"	600
TXT	"facebook-domain-verification=u80xtkb3jkirftn3jwfiicngvx0dbz"	600
TXT	"google-site-verification=44HGCKdJz23m2tJK-DlGEruZKHV_0lV6BQbmvEFnk5I"	600
TXT	"MS=674EB5F6B3CD7BE735580C0ACA3127EDED5B872E"	600
TXT	"google-site-verification=v90xmCVGJMmKlCidNLg3ENaeSQoyzR_xoCs2kYrPcG4"	600
TXT	"google-site-verification=rOg04D_NTdb0vTg6vs0qHDO-HoK4yrsvmC1QFxU9hkU"	600
TXT	"v=spf1 ip4:96.43.144.64/31 ip4:96.43.148.64/31 ip4:199.15.212.0/22 ip4:94.236.119.0/26 ip4:185.28.196.0/22 ip4:192.28.128.0/18 ip4:103.237.104.0/22 ip4:52.38.191.241 ip4:52.207.191.216 " "ip4:52.34.3.26 ip4:35.166.89.76 ip4:35.164.204.88 ip4:35.164.166.33 ip4:204.93.64.116 ip4:204.93.64.117 ip4:192.250.208.112 ip4:192.250.208.113 ip4:130.248.172.0/24 ip4:130.248.173.0/24 ip4:130.248.131.152 " "include:_spf.salesforce.com include:spf.protection.outlook.com include:_netblocks.xactlycorp.com include:stspg-customer.com include:sendgrid.net include:mktomail.com ~all"	600
TXT	"google-site-verification=AjxWtKyIMQXK_eQGKEOOC64UHiWXmePVemOmN0m9mpU"	600
TXT	"google-site-verification=1NZ4Zz9lmDKeKjl6NLcwftEv_x_dIiwo49YuPkCFCqQ"	600

Checks

✓ TTLs within range #32

TTLs: A 10m, MX 5m, NS 10m. The NS TTL at the parent is 2d and in the zone 10m; resolvers may use either.
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35