marsh.com

Checked 22 October 2026, 09:43 UTC · via 8.8.8.8
✗Problems found
27 passed 2 warnings 1 failed 5 info

Registration

info

.com generic · MarkMonitor Inc. · expires 2027-07-10

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
MarkMonitor Inc.
Registered
11 July 1997
Last changed
8 June 2026
Expires
10 July 2027
Status
client delete prohibited, client transfer prohibited, client update prohibited
Registry nameservers
ns01.mmc.com, ns03.mmc.com, ns04.mmc.com, ns05.mmc.com
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-07-10 #3
    The registration is valid until 2027-07-10 (260 days).
  • ✓ Transfer locked #4
    Registry status: client delete prohibited, client transfer prohibited, client update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

ns01.mmc.com, ns03.mmc.com, ns04.mmc.com, ns05.mmc.com

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
ns01.mmc.com, ns03.mmc.com, ns04.mmc.com, ns05.mmc.com
NS in the zone
ns01.mmc.com, ns03.mmc.com, ns04.mmc.com, ns05.mmc.com
NameserverAddressesNetwork (AS)Glue
ns01.mmc.com167.245.171.100AS17161 MMC - Marsh Inc., US167.245.171.100
ns03.mmc.com205.156.137.100AS17161 MMC - Marsh Inc., US205.156.137.100
ns04.mmc.com168.168.252.168AS132481 MMCI-AS-AP - Marsh & McLennan Companies, Inc., AU168.168.252.168
ns05.mmc.com168.168.107.3AS43949 MMC - Marsh Limited, GB168.168.107.3

Checks

  • ✓ 4 nameservers #6
    Delegated to ns01.mmc.com, ns03.mmc.com, ns04.mmc.com, ns05.mmc.com.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 4 IPv4 /24s and 0 IPv6 /48s.
  • ✓ 3 autonomous systems #11
    The nameservers are spread over: AS132481 (MMCI-AS-AP - Marsh & McLennan Companies, Inc., AU): 1 address; AS17161 (MMC - Marsh Inc., US): 2 addresses; AS43949 (MMC - Marsh Limited, GB): 1 address.
  • i
    All nameserver names under .com
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • !
    No IPv6
    None of the nameservers has an IPv6 address, so IPv6-only resolvers can't reach them.
    #13

Nameservers

fail

4 of 4 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns01.mmc.com 167.245.171.100NOERROR, 98 ms, authoritativenoyes / yesrefused-
ns03.mmc.com 205.156.137.100NOERROR, 119 ms, authoritativenono / yesrefused-
ns04.mmc.com 168.168.252.168NOERROR, 276 ms, authoritativenoyes / yesrefused-
ns05.mmc.com 168.168.107.3NOERROR, 25 ms, authoritativenoyes / yesrefused-

Checks

  • ✓ All respond #14
    All 4 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • ✓ No version disclosed #17
    The nameservers don't reveal their software version.
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✗
    No DNS over TCP
    DNS over TCP is required (RFC 7766); without it, large answers such as DNSSEC responses fail. Not answering over TCP: ns03.mmc.com (205.156.137.100): read tcp 46.225.38.91:55946->205.156.137.100:53: read: connection reset by peer.
    #19
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

info

serial 3012547220 · primary usash15-02dns01.mrshmc.com

Found

Primary (MNAME)
usash15-02dns01.mrshmc.com
Contact (RNAME)
internet.services.marsh.com
Serial
3012547220
Refresh / retry
3600 s / 360 s
Expire
2419200 s
Negative TTL
900 s

Serial per nameserver

NameserverSerial
ns01.mmc.com (167.245.171.100)3012547220
ns03.mmc.com (205.156.137.100)3012547220
ns04.mmc.com (168.168.252.168)3012547220
ns05.mmc.com (168.168.107.3)3012547220

Checks

  • ✓ Serial 3012547220 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 1h, retry 6m, expire 28d, negative TTL 15m.
  • i
    Hidden master
    The primary nameserver usash15-02dns01.mrshmc.com is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.
    #24
  • ✓ Contact internet@services.marsh.com #25
    The SOA RNAME internet.services.marsh.com means internet@services.marsh.com.
  • ✓ Timestamp serial #26
    The serial 3012547220 is a Unix timestamp (2065-06-18 10:40 UTC).

DNSSEC

warn

Signed, DS published at parent

Found

Validated by resolver
yes
Denial of existence
NSEC3
NSEC3
10 iterations, 10-byte salt
Signatures valid until
26 October 2026

DS at the parent

Key tagAlgorithmDigestMatches a key
27199RSASHA256 (8)SHA256 641E0E4A734384DA…NO
12274RSASHA256 (8)SHA256 F88F2164D05EE99A…yes

DNSKEY in the zone

Key tagRoleAlgorithm
32901ZSK (256)RSASHA256 (8)
12274KSK (257)RSASHA256 (8)

Checks

  • ✓ Signed and validated #27
    The zone is signed, the parent publishes a DS record, and the resolver validates the answers.
  • i
    Unused DS records
    These DS records match no key in the zone: key tag 27199 (SHA256). That is normal during a key rollover; otherwise remove them.
    #28
  • ✓ Modern algorithms #29
    Key algorithms: RSASHA256 (8).
  • ✓ Short-lived signatures (online signing) #30
    Signatures are valid for 96h0m0s and created on demand; the current one was made at 2026-10-22 03:23 UTC and expires at 2026-10-26 03:35 UTC.
  • !
    NSEC3 with extra iterations or salt
    NSEC3 uses 10 iterations and a 10-byte salt. RFC 9276 recommends 0 iterations and no salt: extra iterations cost resolvers CPU and add no real protection, and some validators treat high counts as insecure.
    #31

Records

info

75 records at the apex

Found

Read from
167.245.171.100:53
TypeValueTTL
SOAusash15-02dns01.mrshmc.com. internet.services.marsh.com. 3012547220 3600 360 2419200 9001800
NSns05.mmc.com.1800
NSns04.mmc.com.1800
NSns01.mmc.com.1800
NSns03.mmc.com.1800
A75.2.75.651800
A99.83.175.371800
MX5 mxb-001b7601.gslb.pphosted.com.1800
MX5 mxa-001b7601.gslb.pphosted.com.1800
TXT"yt+umpNxKiKhrTUWGro/1XM28L0zSvsK/67ljVYcjXNGuxc1TAIwZAGG0aWA1eO9iKSGED9f4bZ2G3d/5jrjhQ=="1800
TXT"cisco-ci-domain-verification=27cec54b73117ed7eec028c2e00a726f072f07aac9ba76c711a0bab4c16c689c"1800
TXT"d365mktkey=ErgfBC0WLmIIzMC1zat1zUfRExjMtfOEqs0VvOpW9Vwx"1800
TXT"d365mktkey=1JxMP5Ufqk3upDLAbiRoysCs5xzEZa50gg8yQ7Nrcv0x"1800
TXT"d365mktkey=OoYx5SpRcvUMiRiukbtz9CylBIq4dA1457qOlxFTkGUx"1800
TXT"d365mktkey=jFIzDcyGfI62H0XhSjLrmccCY83kcIY3QgxDxxAXKHgx"1800
TXT"d365mktkey=2kqVkXxyqBmBylex36ofn5urjO3NYxHjF0N0TAax3sEx"1800
TXT"google-site-verification=nD1MmIY5c3fIAAqzbDwGazPHXR3kOJy2YIULjFJ9t9g"1800
TXT"google-site-verification=dDgMCPIdNyLLEqoplSCkoRTKQqUgjQjL7Jao7cLxN3I"1800
TXT"wiz-domain-verification=d0bf95814c9fa27b0adef5853d0fd78dd849e94cb81760b79ef05e85a94e3d87"1800
TXT"jamf-site-verification=lP_HYw89EqT6BRBc6_mi9A"1800
TXT"00DWF00000Bpyob=1TBWF0000000KI5"1800
TXT"00D1a000000YrcS=1TBa70000000ANZ"1800
TXT"DirectFedAuthUrl=https://mmc.oktapreview.com/app/mmc_taxautomate_1/exk2ocgtjv64ntRFE0h8/sso/saml"1800
TXT"anthropic-domain-verification-fgespr=qToQ4rrggGgEAToYLSi0wssHa"1800
TXT"atlassian-domain-verification=B5ipV+NJ90VqYy22o3me3cL4LPzBQUvt9d8ZTKjVDaQut9y15-lyKBDUHA/+lOc+"1800
TXT"atlassian-domain-verification=xnXr01aGBaNvXPwRM4W0ttOcpdlCVf7kK4ca1XTG5iDuJhwcNjOZNCUDovUd25LP"1800
TXT"00D9h000004Jx0T=1TB9h000000006T"1800
TXT"00DDJ000000AHAT=1TBOg00000001aP"1800
TXT"00DQE0000000J2f=1TBOa00000000OD"1800
TXT"00DDn000002nia8=1TBOd00000000ZV"1800
TXT"wiz-domain-verification=f5ea71fd0788359b3d2c7eba4b538b6bab5c14b5fb3645a56dd9ebbf635eb7d5"1800
TXT"paloaltonetworks-site-verification=5c35b44b67277b65715adf3f3159a5e8de4a8646c1a999589267dd4ba873ca36"1800
TXT"sending_domain861941=ba49233a5ea93e5f488a447a3c297ebfc95bf3e831e864f249413fd11f0cde27"1800
TXT"Xmedius-Verification=f5d60ba4fecea35a3fe29d4c951b8bf3bd1fe4d79cd0ae8680d61ee6bb213513"1800
TXT"apple-domain-verification=7Ix9R5WWUG6tqQd0"1800
TXT"bettercomp-verify=7859ea1d2469bd0fd62899dcb0e3d2c917f21a25c5783ef7eef4add3985ab7c5"1800
TXT"TXT" "bettercomp-verify=7859ea1d2469bd0fd62899dcb0e3d2c917f21a25c5783ef7eef4add3985ab7c5"1800
TXT"pendo-domain-verification=_giuT79_IbdoPE4yrk9TbPN5BG8"1800
TXT"google-site-verification=fwvlmgE9igik3pObbm_rUBbFhzep8dfNNILBx-jLYnA"1800
TXT"google-site-verification=Zj-zAMBsyycWDR3VJjFoEPmHMYZ9NE12rQQXGsOD_kU"1800
TXT"MS=ms20058834"1800
TXT"0ed1fe018a7947983a28764bb7b90dc5b227aedfda"1800
TXT"adobe-idp-site-verification=913e4ed488bb8eccd8e2d2de5461f4ec10e6649b4d6410a4d03e0dabf4b522d2"1800
TXT"iKnJEh4Z/G+12pFbZcmCh6LDB2a5gNhQ8Ieta3wBPNgBIz6/yqKcwaFruRee708OdxDNRZzzi12Y3AjiU5Fk1g=="1800
TXT"Ep8Y1Vf5cBwJcwQyTJ12hoVpWk7OwPvh0RHn+dCeZbgPTZSeGV4zEwi9HHGilyovyRZBDoFv8kPRxUyzZXCy9w=="1800
TXT"atlassian-domain-verification=zUH3HeS6jWIavzHkMsMCHlKw8WpIGuLOR3gCFRvfGdkC95re1yJSP2EnkI4afd7i"1800
TXT"588b6846375bd9f37f344f4c06dcb3ac"1800
TXT"amazonses:7gbsJIlJCN038duu4e/fn+j5JRxX3HjOBxQfAiCZr2c="1800
TXT"amazonses:TfnZT7QmJapNauFsEWgBLtlCgWqEUTusCRn6A28togA="1800
TXT"amazonses:epm5i6J/3RRes73nsJ5ySUjiNgJ3WayRqFlemgmVFrs="1800
TXT"zywave-domain-verification=EqaEoZtpog2iKpMZWmWqWh5CVMmDW78JN/JgY+spYL8="1800
TXT"mongodb-site-verification=gyGHLqKU0KxVWjpUTq5lbq8dfNA6lVlN"1800
TXT"docusign=ff2e9780-148f-495c-8e29-cc927929ddd9"1800
TXT"docusign=65a5e2c9-5f9d-4a80-8656-50701b2d7eb0"1800
TXT"smartsheet-site-validation=Oc07DLaTdJ-gg3mXSrGaN7XWQP0r0h1b"1800
TXT"SFMC-T-mzpFCxu3H5N5zWILHlSvWcED0hfKzD7cAUDlns"1800
TXT"0h39hbndtbqr6n9mdxbx7kgpcg3p6636"1800
TXT"v=spf1 include:marsh.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email include:ncapp02.com ~all"1800
TXT"pardot395202=12113bf27feadde824557fffeba2c8c5cf04ae8948d2c5e5f1b602556475c362"1800
TXT"_globalsign-domain-verification=IFaQyK07E-Ksc8NcwZ-ns7kxuRzmIKOXT-MFfKVJVn"1800
TXT"onetrust-domain-verification=290322a96bb040228adcc4f737667d98"1800
TXT"docusign=19b69040-9580-406b-a4ad-49540f74dc4d"1800
TXT"j5sr1tr6ww5gczgnvvnn4nnx32bnmhkz"1800
TXT"cloudhealth=19c285f6-d6c3-4cb4-b9a7-b2303bc9cf00"1800
TXT"3AD5EBCDA91424D526C298FC0D7D7468379E22BEEAB74D31DF68E60B674C83A1"1800
TXT"_acme-challenge.icargo-ssrs" "TXT" "eRHBM9aPNsa6b58XriX7wDZuyx4teXSd_fJqjzstWnU"1800
TXT"_acme-challenge.icargo" "TXT" "TCCfiWC65eaAdRnCNMIMHkvUVzEg8JVRliiswcMoWSM"1800
TXT"_acme-challenge.iris" "txt" "ebQtSd_0g9awFZfq08mQob3f2ivG_wjF3zckjjuvt_A"1800
TXT"_acme-challenge.uat-iris" "txt" "QcfGK1TFZNKC-HjnierP1kJuPs4gODuLxjZbE94n9pw"1800
TXT"_acme-challenge.uat-icargo" "txt" "HIyDnzuYZRNj3XdoJBxjlszUy5z3n8YJ91usjx1oRPo"1800
TXT"d365mktkey=ScZvE4E9xqqbEB81Bl50Z6rTdN6uxZfxkJ0BVnEinbMx"1800
TXT"d365mktkey=Kc8xerteL1MgmGNIMMPbmY6lLO7VEoRpqLIce96gZTox"1800
TXT"d365mktkey=75LNvwioiCnyKlU3pzUfMlqjbxOpG1gH3zBw5mIFrtEx"1800
TXT"d365mktkey=3ctA0xz0S6DvZxthtiPMx4FXeNQzITVOWdTv3VDAgXkx"1800
TXT"d365mktkey=8Xqw8pzxKXP5JeKfoUixHdYxs7jtvic300hnNVKjnEsx"1800

Checks

  • ✓ TTLs within range #32
    TTLs: A 30m, MX 30m, NS 30m. The NS TTL at the parent is 2d and in the zone 30m; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35