masterclass.com

Checked 22 October 2026, 09:43 UTC · via 8.8.8.8
!Passed with warnings
24 passed 2 warnings 0 failed 5 info

Registration

info

.com generic · GoDaddy.com, LLC · expires 2029-09-15

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
GoDaddy.com, LLC
Registered
16 September 1995
Last changed
6 September 2024
Expires
15 September 2029
Status
client delete prohibited, client renew prohibited, client transfer prohibited, client update prohibited
Registry nameservers
elmo.ns.cloudflare.com, lara.ns.cloudflare.com
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2029-09-15 #3
    The registration is valid until 2029-09-15 (1058 days).
  • ✓ Transfer locked #4
    Registry status: client delete prohibited, client renew prohibited, client transfer prohibited, client update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

elmo.ns.cloudflare.com, lara.ns.cloudflare.com

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
elmo.ns.cloudflare.com, lara.ns.cloudflare.com
NS in the zone
elmo.ns.cloudflare.com, lara.ns.cloudflare.com
NameserverAddressesNetwork (AS)Glue
elmo.ns.cloudflare.com173.245.59.163 108.162.193.163 172.64.33.163 2606:4700:58::adf5:3ba3 2a06:98c1:50::ac40:21a3 2803:f800:50::6ca2:c1a3AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US108.162.193.163 172.64.33.163 173.245.59.163 2606:4700:58::adf5:3ba3 2803:f800:50::6ca2:c1a3 2a06:98c1:50::ac40:21a3
lara.ns.cloudflare.com173.245.58.128 172.64.32.128 108.162.192.128 2a06:98c1:50::ac40:2080 2606:4700:50::adf5:3a80 2803:f800:50::6ca2:c080AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US108.162.192.128 172.64.32.128 173.245.58.128 2606:4700:50::adf5:3a80 2803:f800:50::6ca2:c080 2a06:98c1:50::ac40:2080

Checks

  • i
    2 nameservers
    Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: elmo.ns.cloudflare.com, lara.ns.cloudflare.com.
    #6
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 6 IPv4 /24s and 4 IPv6 /48s.
  • i
    All nameservers in one AS
    All nameserver addresses are announced by one network operator (AS13335 (CLOUDFLARENET - Cloudflare, Inc., US): 12 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.
    #11
  • i
    All nameserver names under .com
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

warn

12 of 12 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
elmo.ns.cloudflare.com 173.245.59.163NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
elmo.ns.cloudflare.com 108.162.193.163NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
elmo.ns.cloudflare.com 172.64.33.163NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
elmo.ns.cloudflare.com 2606:4700:58::adf5:3ba3NOERROR, 16 ms, authoritativenoyes / yesrefused2026.10.2
elmo.ns.cloudflare.com 2a06:98c1:50::ac40:21a3NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
elmo.ns.cloudflare.com 2803:f800:50::6ca2:c1a3NOERROR, 14 ms, authoritativenoyes / yesrefused2026.10.2
lara.ns.cloudflare.com 173.245.58.128NOERROR, 14 ms, authoritativenoyes / yesrefused2026.10.2
lara.ns.cloudflare.com 172.64.32.128NOERROR, 14 ms, authoritativenoyes / yesrefused2026.10.2
lara.ns.cloudflare.com 108.162.192.128NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
lara.ns.cloudflare.com 2a06:98c1:50::ac40:2080NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
lara.ns.cloudflare.com 2606:4700:50::adf5:3a80NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2
lara.ns.cloudflare.com 2803:f800:50::6ca2:c080NOERROR, 15 ms, authoritativenoyes / yesrefused2026.10.2

Checks

  • ✓ All respond #14
    All 12 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: elmo.ns.cloudflare.com: "2026.10.2"; lara.ns.cloudflare.com: "2026.10.2". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 2418018867 · primary elmo.ns.cloudflare.com

Found

Primary (MNAME)
elmo.ns.cloudflare.com
Contact (RNAME)
dns.cloudflare.com
Serial
2418018867
Refresh / retry
10000 s / 2400 s
Expire
604800 s
Negative TTL
1800 s

Serial per nameserver

NameserverSerial
elmo.ns.cloudflare.com (173.245.59.163)2418018867
elmo.ns.cloudflare.com (108.162.193.163)2418018867
elmo.ns.cloudflare.com (172.64.33.163)2418018867
elmo.ns.cloudflare.com (2606:4700:58::adf5:3ba3)2418018867
elmo.ns.cloudflare.com (2a06:98c1:50::ac40:21a3)2418018867
elmo.ns.cloudflare.com (2803:f800:50::6ca2:c1a3)2418018867
lara.ns.cloudflare.com (173.245.58.128)2418018867
lara.ns.cloudflare.com (172.64.32.128)2418018867
lara.ns.cloudflare.com (108.162.192.128)2418018867
lara.ns.cloudflare.com (2a06:98c1:50::ac40:2080)2418018867
lara.ns.cloudflare.com (2606:4700:50::adf5:3a80)2418018867
lara.ns.cloudflare.com (2803:f800:50::6ca2:c080)2418018867

Checks

  • ✓ Serial 2418018867 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 2h46m40s, retry 40m, expire 7d, negative TTL 30m.
  • ✓ Primary is a public nameserver #24
    The primary nameserver elmo.ns.cloudflare.com is one of the listed nameservers.
  • ✓ Contact dns@cloudflare.com #25
    The SOA RNAME dns.cloudflare.com means dns@cloudflare.com.
  • ✓ Timestamp serial #26
    The serial 2418018867 is a Unix timestamp (2046-08-16 07:54 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

info

54 records at the apex

Found

Read from
173.245.59.163:53
TypeValueTTL
SOAelmo.ns.cloudflare.com. dns.cloudflare.com. 2418018867 10000 2400 604800 18001800
NSelmo.ns.cloudflare.com.86400
NSlara.ns.cloudflare.com.86400
A104.17.11.109300
A104.17.12.109300
AAAA2606:4700::6811:b6d300
AAAA2606:4700::6811:c6d300
MX1 aspmx.l.google.com.300
MX10 alt3.aspmx.l.google.com.300
MX10 alt4.aspmx.l.google.com.300
MX5 alt1.aspmx.l.google.com.300
MX5 alt2.aspmx.l.google.com.300
TXT"00d5y000002tzbcuac"300
TXT"MS=ms40464053"300
TXT"ZOOM_verify_MPUyRtnpQ-KCjAo8dCLHtA"300
TXT"adobe-idp-site-verification=8cecf303de49e79f3bdba851120976cc135e573af7e1415614ad70124486ff6b"300
TXT"airtable-verification=2e81434c48c7f1f5f14e32e768aac1f1"300
TXT"anthropic-domain-verification-09srn7=YDOqYXJCGJNNLdEfNFn4Bv2K6"300
TXT"apple-domain-verification=Dwh77ggSYSJLv0sV"300
TXT"atlassian-domain-verification=fsLNVMHXTinbduijD9qeWWVOBbtM0ktMigExcpz84eXkqnvQWEF2UV5Mgm+w827G"300
TXT"atlassian-domain-verification=z8jowpBlkVJiTOqh0KMVPyRiJPZS62sQS/xQk08yGwdNQZ3mxJ8FDkZmnOxts5OY"300
TXT"cursor-domain-verification-gcpwkw=M0JNzcmFlXXDV3hxBDtgwzC8U"300
TXT"decagon-domain-verification-nc91pt=1RNcCaurtxoXZeWleNg62XUbb"300
TXT"docusign=6a55ec11-02b4-4add-89e3-635c4c845c02"300
TXT"dropbox-domain-verification=qzcecejb36yn"300
TXT"elevenlabs=uI1io7p5QnHLXBO4aIDSPbT1cilewVmgyBHbIv5yP3A"300
TXT"facebook-domain-verification=vko59lt5tiv3e15nlz3fz0ndzaa48k"300
TXT"figma-domain-verification=c03ba85be58bb787cf163df010d8a8f566914bdca30d4a8b4daa451bb0a86bb6-1774469364"300
TXT"gamma-domain-verification-5h4yh2=nNmT1WskPGUEevoEumWLfuiQQ"300
TXT"google-site-verification=82VH4G93yO_5Q3pQCMlhCigfy6YiJW9VB2BgLv1acNU"300
TXT"google-site-verification=HBtTedJJzGqpI0XzHnITC3kJW_kQizrx6qj-pJsBYpk"300
TXT"google-site-verification=UicQjDg7QYyoskEBnAx7DNiYZq2bNIovIdmTY8NEXkE"300
TXT"google-site-verification=ZLRIGV-xmlMAsluAM6Q0sXrYlH9i_lNOPure0L5-FRY"300
TXT"google-site-verification=eKv2UoTFDkYJ7Oj3zLj0cMpKYWTiIg90xNLRih9GFVQ"300
TXT"google-site-verification=iQxG-q_4dr0FA3Ao1DRrgLQjWqmL52fGQwUQxBEacQw"300
TXT"google-site-verification=n1Yz2XSiiz2Zq-fqb_3r0Vxu6nu4aJYocC-yApmymZo"300
TXT"h1-domain-verification=P8nffKmUSEtYWiazMh7ywjrjwYuWCV2BNT4twJXMhygtq8aq"300
TXT"jamf-site-verification=-EgzC23s3-FEy67wN_mmkA"300
TXT"jetbrains-domain-verification=cmohn0y9vdknqw3qaisdk6sn7"300
TXT"jumpdesktop=7ffc143dc6e1d1c8ce3cc46d41f514753764c58441fddc7e1745499243df"300
TXT"onetrust-domain-verification=85b9a0f52c594a449647a4da09295d27"300
TXT"openai-domain-verification=dv-GcY4FzLCwaYMyMTHJyhXx0F0"300
TXT"opus-clip-domain-verification-zemts8=ojPEL6WKEqGIE4oKs1MGcmXsq"300
TXT"pardot923373=eb51071010d88eac96762e419f98e03d8428bd9cbfc2748b1286e18b33fcf0b1"300
TXT"segment-site-verification=G8EClOzpb9DOxF39ihbSmVtb2j6hv5vz"300
TXT"segment-site-verification=uqDqIFigNS4vDmAD8EmAGhRsRpIVpvX4"300
TXT"serval-domain-verification-dgcjt0=dVNwJAK7PsxoQPKJ54kzoTO8Q"300
TXT"stripe-verification=05be685f2aa766fd02db629e200de6599f96a26ac878f011ca07f4e460ead9c5"300
TXT"stripe-verification=BAC58CD27A726CB57A22A94CF194159DC8AEC807D3C552A42D196543806C9F6C"300
TXT"stripe-verification=a724da2600b32898d16a622d440ffe5df365aede0ea0085dac363d14e7d539fa"300
TXT"stripe-verification=f4598fc28f5441e04a5f78cd69c1df5e2679418ccd8659c94a62348c027e345f"300
TXT"teamviewer-sso-verification=63cefa94ee3247beb570154f96dac6f4"300
TXT"v=spf1 ip4:198.245.81.0/24 ip4:136.147.176.0/24 ip4:13.111.0.0/16 ip4:136.147.182.0/24 ip4:136.147.135.0/24 ip4:199.122.123.0/24 ip4:167.89.0.0/17 ip4:168.245.0.0/17 ip4:185.250.239.148 ip4:185.250.239.168 ip4:185.250.239.190 ip4:198.244.59.30 ip4:198.244" ".59.33 ip4:198.244.59.35 ip4:198.61.254.21 ip4:209.61.151.236 ip4:209.61.151.249 ip4:209.61.151.251 ip4:69.72.40.93 ip4:69.72.40.94/31 ip4:69.72.40.96/30 ip4:69.72.47.205 include:_spf.google.com include:servers.mcsv.net include:amazonses.com include:spf.b" "raintreegateway.com include:_spf.salesforce.com ~all"300
TXT"zapier-domain-verification-challenge=157c535c-55e3-47db-afae-588cd71db34b"300

Checks

  • ✓ TTLs within range #32
    TTLs: A 5m, AAAA 5m, MX 5m, NS 1d. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35