Domain report: miele.be

Registration

info

.be country-code

Found

TLD: .be (country-code)
ICANN policies apply: no

Checks

i

.be is a country-code TLD (ccTLD)

Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.

#1
✓ TLD delegated and signed #2

.be is delegated in the root zone and DNSSEC-signed.
i

Registration data not available

No registration data via RDAP: the registry of .be offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.

#3

Delegation

info

a1-31.akam.net, a2-66.akam.net, a20-67.akam.net, a5-67.akam.net, a6-67.akam.net, a9-65.akam.net

Found

Parent zone: be
Delegation from: a.nsset.be (194.0.6.1)
NS at the parent: a1-31.akam.net, a2-66.akam.net, a20-67.akam.net, a5-67.akam.net, a6-67.akam.net, a9-65.akam.net
NS in the zone: a1-31.akam.net, a2-66.akam.net, a20-67.akam.net, a5-67.akam.net, a6-67.akam.net, a9-65.akam.net

Nameserver	Addresses	Network (AS)	Glue
a1-31.akam.net	193.108.91.31 2600:1401:2::1f	AS20940 AKAMAI-ASN1 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a2-66.akam.net	95.100.174.66 2600:1480:7000::42	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a20-67.akam.net	95.100.175.67 2a02:26f0:67::43	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a5-67.akam.net	95.100.168.67 2600:1480:b000::43	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a6-67.akam.net	23.211.133.67 2600:1401:1::43	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a9-65.akam.net	184.85.248.65 2a02:26f0:117::41	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-

Checks

✓ 6 nameservers #6

Delegated to a1-31.akam.net, a2-66.akam.net, a20-67.akam.net, a5-67.akam.net, a6-67.akam.net, a9-65.akam.net.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 6 IPv4 /24s and 6 IPv6 /48s.
✓ 2 autonomous systems #11

The nameservers are spread over: AS20940 (AKAMAI-ASN1 - Akamai International B.V., NL): 1 address; AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 11 addresses.
i

All nameserver names under .net

All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

#12
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

Nameservers

warn

12 of 12 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
a1-31.akam.net 193.108.91.31	NOERROR, 3 ms, authoritative	no	yes / yes	refused	41824.4
a1-31.akam.net 2600:1401:2::1f	NOERROR, 3 ms, authoritative	no	yes / yes	refused	41824.4
a2-66.akam.net 95.100.174.66	NOERROR, 4 ms, authoritative	no	yes / yes	refused	48878.27
a2-66.akam.net 2600:1480:7000::42	NOERROR, 4 ms, authoritative	no	yes / yes	refused	48878.32
a20-67.akam.net 95.100.175.67	NOERROR, 3 ms, authoritative	no	yes / yes	refused	48878.30
a20-67.akam.net 2a02:26f0:67::43	NOERROR, 3 ms, authoritative	no	yes / yes	refused	48878.27
a5-67.akam.net 95.100.168.67	NOERROR, 3 ms, authoritative	no	yes / yes	refused	41824.7
a5-67.akam.net 2600:1480:b000::43	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.10
a6-67.akam.net 23.211.133.67	NOERROR, 4 ms, authoritative	no	yes / yes	refused	48878.29
a6-67.akam.net 2600:1401:1::43	NOERROR, 4 ms, authoritative	no	yes / yes	refused	48878.27
a9-65.akam.net 184.85.248.65	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.8
a9-65.akam.net 2a02:26f0:117::41	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.11

Checks

✓ All respond #14

All 12 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
!

Software version disclosed

These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: a1-31.akam.net: "41824.4"; a2-66.akam.net: "48878.27"; a2-66.akam.net: "48878.32"; a20-67.akam.net: "48878.30"; a20-67.akam.net: "48878.27"; a5-67.akam.net: "41824.7"; a5-67.akam.net: "41824.10"; a6-67.akam.net: "48878.29"; a6-67.akam.net: "48878.27"; a9-65.akam.net: "41824.8"; a9-65.akam.net: "41824.11". Hide or replace the version string.

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

pass

serial 2024091937 · primary a1-31.akam.net

Found

Primary (MNAME): a1-31.akam.net
Contact (RNAME): hostmaster.miele.be
Serial: 2024091937
Refresh / retry: 3600 s / 600 s
Expire: 604800 s
Negative TTL: 300 s

Serial per nameserver

Nameserver	Serial
a1-31.akam.net (193.108.91.31)	2024091937
a1-31.akam.net (2600:1401:2::1f)	2024091937
a2-66.akam.net (95.100.174.66)	2024091937
a2-66.akam.net (2600:1480:7000::42)	2024091937
a20-67.akam.net (95.100.175.67)	2024091937
a20-67.akam.net (2a02:26f0:67::43)	2024091937
a5-67.akam.net (95.100.168.67)	2024091937
a5-67.akam.net (2600:1480:b000::43)	2024091937
a6-67.akam.net (23.211.133.67)	2024091937
a6-67.akam.net (2600:1401:1::43)	2024091937
a9-65.akam.net (184.85.248.65)	2024091937
a9-65.akam.net (2a02:26f0:117::41)	2024091937

Checks

✓ Serial 2024091937 everywhere #22

All nameservers serve the same version of the zone.
✓ Timers within recommendations #23

SOA refresh 1h, retry 10m, expire 7d, negative TTL 5m.
✓ Primary is a public nameserver #24

The primary nameserver a1-31.akam.net is one of the listed nameservers.
✓ Contact hostmaster@miele.be #25

The SOA RNAME hostmaster.miele.be means hostmaster@miele.be.
✓ Date-based serial #26

The serial 2024091937 follows the YYYYMMDDnn convention (2024-09-19).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

warn

26 records at the apex

Found

Read from: 193.108.91.31:53

Type	Value	TTL
SOA	a1-31.akam.net. hostmaster.miele.be. 2024091937 3600 600 604800 300	86400
NS	a6-67.akam.net.	84600
NS	a2-66.akam.net.	84600
NS	a9-65.akam.net.	84600
NS	a5-67.akam.net.	84600
NS	a1-31.akam.net.	84600
NS	a20-67.akam.net.	84600
A	104.82.99.49	20
AAAA	2a02:26f0:b700:292::12a1	20
AAAA	2a02:26f0:b700:29d::12a1	20
MX	30 mx03.hornetsecurity.com.	300
MX	40 mx04.hornetsecurity.com.	300
MX	10 mx01.hornetsecurity.com.	300
MX	20 mx02.hornetsecurity.com.	300
TXT	"_is6ypgr2tvc8l3h6n0enarp4lyuidjn"	86400
TXT	"facebook-domain-verification=n96rhcj92urt1sv3laulcn7vulno0c"	86400
TXT	"google-site-verification=Lg1OsOafloj2kG08gciJ79liHsuFM0jF36l8PO0wWW0"	86400
TXT	"j80y3n87h9n55gmrm1tptrp44n0c2r61"	86400
TXT	"domain-verification:fdfa5ed1976a57c8c168694387d87d80467ab9f0"	86400
TXT	"MS=ms85277591"	86400
TXT	"v=spf1 include:_spf.miele.com -all"	86400
TXT	"_styl5ndhobzxy2t63ykmhiwa55fvhpm"	86400
TXT	"google-site-verification=7HxXKLuYtr_h3-NjBuroWPefrYx1z8P-BIHB0p7DWjk"	86400
CAA	0 issue "awstrust.com"	86400
CAA	0 issue "digicert.com"	86400
CAA	0 issue "sectigo.com"	86400

Checks

!

Very low TTLs

These records have a TTL below 5m, causing extra queries and slower lookups: A (20s), AAAA (20s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 1d and in the zone 1410m; resolvers may use either.

#32
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
✓ CAA restricts issuance #35

Certificates may be issued by: awstrust.com, digicert.com, sectigo.com.