Domain report: mozilla.com

Registration

info

.com generic · MarkMonitor Inc. · expires 2027-10-17

Found

TLD: .com (generic)
ICANN policies apply: yes
Registrar: MarkMonitor Inc.
Registered: 18 October 1994
Last changed: 11 September 2026
Expires: 17 October 2027
Status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers: ns1-240.akam.net, ns4-64.akam.net, ns5-65.akam.net, ns7-66.akam.net
RDAP server: https://rdap.verisign.com/com/v1/

Checks

i

.com is a generic TLD (gTLD)

Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.

#1
✓ TLD delegated and signed #2

.com is delegated in the root zone and DNSSEC-signed.
✓ Expires on 2027-10-17 #3

The registration is valid until 2027-10-17 (359 days).
✓ Transfer locked #4

Registry status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
✓ Registry and delegation match #5

The nameservers registered at the registry are the ones published in DNS.

Delegation

info

ns1-240.akam.net, ns4-64.akam.net, ns5-65.akam.net, ns7-66.akam.net

Found

Parent zone: com
Delegation from: a.gtld-servers.net (192.5.6.30)
NS at the parent: ns1-240.akam.net, ns4-64.akam.net, ns5-65.akam.net, ns7-66.akam.net
NS in the zone: ns1-240.akam.net, ns4-64.akam.net, ns5-65.akam.net, ns7-66.akam.net

Nameserver	Addresses	Network (AS)	Glue
ns1-240.akam.net	193.108.91.240 2600:1401:2::f0	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
ns4-64.akam.net	84.53.139.64	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
ns5-65.akam.net	184.85.248.65	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
ns7-66.akam.net	96.7.49.66	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-

Checks

✓ 4 nameservers #6

Delegated to ns1-240.akam.net, ns4-64.akam.net, ns5-65.akam.net, ns7-66.akam.net.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 4 IPv4 /24s and 1 IPv6 /48.
i

All nameservers in one AS

All nameserver addresses are announced by one network operator (AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 5 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.

#11
i

All nameserver names under .net

All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

#12
i

Partly IPv6

These nameservers have no IPv6 address: ns4-64.akam.net, ns5-65.akam.net, ns7-66.akam.net.

#13

Nameservers

warn

5 of 5 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
ns1-240.akam.net 193.108.91.240	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.10
ns1-240.akam.net 2600:1401:2::f0	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.8
ns4-64.akam.net 84.53.139.64	NOERROR, 3 ms, authoritative	no	yes / yes	refused	41824.7
ns5-65.akam.net 184.85.248.65	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.8
ns7-66.akam.net 96.7.49.66	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.6

Checks

✓ All respond #14

All 5 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
!

Software version disclosed

These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: ns1-240.akam.net: "41824.10"; ns1-240.akam.net: "41824.8"; ns4-64.akam.net: "41824.7"; ns5-65.akam.net: "41824.8"; ns7-66.akam.net: "41824.6". Hide or replace the version string.

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

warn

serial 2018045303 · primary ns5-65.akam.net

Found

Primary (MNAME): ns5-65.akam.net
Contact (RNAME): hostmaster.mozilla.com
Serial: 2018045303
Refresh / retry: 180 s / 180 s
Expire: 1209600 s
Negative TTL: 60 s

Serial per nameserver

Nameserver	Serial
ns1-240.akam.net (193.108.91.240)	2018045303
ns1-240.akam.net (2600:1401:2::f0)	2018045303
ns4-64.akam.net (84.53.139.64)	2018045303
ns5-65.akam.net (184.85.248.65)	2018045303
ns7-66.akam.net (96.7.49.66)	2018045303

Checks

✓ Serial 2018045303 everywhere #22

All nameservers serve the same version of the zone.
!

Unusual SOA timers

refresh 3m is outside 20m–1d; retry 3m should be shorter than refresh 3m; negative caching TTL (minimum) 1m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 3m, retry 3m, expire 14d, negative TTL 1m.

#23
✓ Primary is a public nameserver #24

The primary nameserver ns5-65.akam.net is one of the listed nameservers.
✓ Contact hostmaster@mozilla.com #25

The SOA RNAME hostmaster.mozilla.com means hostmaster@mozilla.com.
✓ Timestamp serial #26

The serial 2018045303 is a Unix timestamp (2033-12-13 00:08 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

warn

45 records at the apex

Found

Read from: 193.108.91.240:53

Type	Value	TTL
SOA	ns5-65.akam.net. hostmaster.mozilla.com. 2018045303 180 180 1209600 60	3600
NS	ns7-66.akam.net.	3600
NS	ns4-64.akam.net.	3600
NS	ns1-240.akam.net.	3600
NS	ns5-65.akam.net.	3600
A	35.190.14.201	600
AAAA	2600:1901:0:c197::	3600
MX	5 alt1.aspmx.l.google.com.	60
MX	1 aspmx.l.google.com.	60
MX	10 aspmx3.googlemail.com.	60
MX	5 alt2.aspmx.l.google.com.	60
TXT	"status-page-domain-verification=66thnl6f725t"	60
TXT	"anthropic-domain-verification-bhww58=QIicfKVPKNxTK78KvVLOTg9HY"	60
TXT	"apple-domain-verification=AW6Ub2u78cjUEoTz"	60
TXT	"openai-domain-verification=dv-K4BRwXIccR9ZPEk5YkygkYoA"	60
TXT	"docker-verification=2f2414f7-df6b-4bf5-80e4-b7212e54af13"	60
TXT	"docusign=b3fe0d4f-0830-4d21-8ac4-3247fd53199c"	60
TXT	"google-site-verification=IpSwLqTy1MSoslsauQbp2ohg2A92W2Qq2SAw5QQC5jA"	60
TXT	"asv=922480dc61f55632a133db2c25597e3d"	60
TXT	"status-page-domain-verification=v1vmjp2v89c0"	60
TXT	"h1-domain-verification=npd53FESN2jo7DQNQvMum8E9zdXKmNNjLZKNUHFVDKEoBYwD"	60
TXT	"coursera-domain-verification=Y24czi8G4lghjuEOZbPUZJGZL3ZWCCqS4ZDlH5bLbmda9p5lDgG1Egd0j75H3UyV"	60
TXT	"xp5tz620d79rq5wg8tss9cqj6ync5ffb"	60
TXT	"MS=ms53448578"	60
TXT	"_veifelr1ln0sms73xbbdexkuh0n4esh"	60
TXT	"aocGrHyfAWIi8sU8mTrID9Pj1A"	60
TXT	"plausible-sso-verification=86a4a89d-6956-4af5-a609-df05fa65f043"	60
TXT	"infoblox-domain-mastery=db089a79e7ee978fa4ddfb94a0e9e080ebac58f7507b58a0ad2abecd2e27317ba7"	60
TXT	"notion-domain-verification=iFlGX1ER56vtEhhqy0jkEDrJTKztyPXD2BPU4BNYTTG"	60
TXT	"v=spf1 include:mozilla.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email include:helpscoutemail.com ~all"	60
TXT	"knowbe4-site-verification=06f6ae33f35b924850c58ba985731eb7"	60
TXT	"intacct-esk=4FED1A6DBF25C0CAE053D606A8C0F840"	60
TXT	"atlassian-domain-verification=8xkMty0tOT0eog0PN17DvoBgD4NC/3/j/Tkx6tRZN5Zl15VBEFltqd9CfFxWiGe3"	60
TXT	"remote-domain-verification=cf65a23c-16ed-4181-8ee9-2bc2741130d5"	60
TXT	"stripe-verification=12da43cd3189cf99e5c3ecdfdae9c97c7d4230aed93a22ae62892f0cee028e0c"	60
CAA	0 iodef "mailto:foxsec+caaiodef@mozilla.com"	3600
CAA	0 issue "comodoca.com"	3600
CAA	0 issue "amazon.com"	3600
CAA	0 issue "awstrust.com"	3600
CAA	0 issue "letsencrypt.org"	3600
CAA	0 issue "pki.goog"	3600
CAA	0 issue "digicert.com"	3600
CAA	0 issue "amazontrust.com"	3600
CAA	0 issue "amazonaws.com"	3600
CAA	0 issue "sectigo.com"	3600

Checks

!

Very low TTLs

These records have a TTL below 5m, causing extra queries and slower lookups: MX (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1h; resolvers may use either.

#32
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
✓ CAA restricts issuance #35

Certificates may be issued by: comodoca.com, amazon.com, awstrust.com, letsencrypt.org, pki.goog, digicert.com, amazontrust.com, amazonaws.com, sectigo.com.