nationwide.com

Checked 22 October 2026, 10:00 UTC · via 8.8.8.8
!Passed with warnings
25 passed 3 warnings 0 failed 3 info

Registration

info

.com generic · CSC Corporate Domains, Inc. · expires 2027-03-05

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
CSC Corporate Domains, Inc.
Registered
4 March 1994
Last changed
1 March 2026
Expires
5 March 2027
Status
client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers
a1-253.akam.net, a13-65.akam.net, a22-67.akam.net, a26-64.akam.net, a4-67.akam.net, a5-67.akam.net
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-03-05 #3
    The registration is valid until 2027-03-05 (133 days).
  • ✓ Transfer locked #4
    Registry status: client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

a1-253.akam.net, a13-65.akam.net, a22-67.akam.net, a26-64.akam.net, a4-67.akam.net, a5-67.akam.net

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
a1-253.akam.net, a13-65.akam.net, a22-67.akam.net, a26-64.akam.net, a4-67.akam.net, a5-67.akam.net
NS in the zone
a1-253.akam.net, a13-65.akam.net, a22-67.akam.net, a26-64.akam.net, a4-67.akam.net, a5-67.akam.net
NameserverAddressesNetwork (AS)Glue
a1-253.akam.net193.108.91.253 2600:1401:2::fdAS20940 AKAMAI-ASN1 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a13-65.akam.net2.22.230.65 2600:1480:800::41AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a22-67.akam.net23.211.61.67 2600:1480:7800::43AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a26-64.akam.net23.74.25.64 2600:1480:b800::40AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a4-67.akam.net72.246.46.67 2600:1480:9000::43AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a5-67.akam.net95.100.168.67 2600:1480:b000::43AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-

Checks

  • ✓ 6 nameservers #6
    Delegated to a1-253.akam.net, a13-65.akam.net, a22-67.akam.net, a26-64.akam.net, a4-67.akam.net, a5-67.akam.net.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 6 IPv4 /24s and 6 IPv6 /48s.
  • ✓ 2 autonomous systems #11
    The nameservers are spread over: AS20940 (AKAMAI-ASN1 - Akamai International B.V., NL): 1 address; AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 11 addresses.
  • i
    All nameserver names under .net
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

warn

12 of 12 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
a1-253.akam.net 193.108.91.253NOERROR, 4 ms, authoritativenoyes / yesrefused41824.9
a1-253.akam.net 2600:1401:2::fdNOERROR, 4 ms, authoritativenoyes / yesrefused41824.10
a13-65.akam.net 2.22.230.65NOERROR, 5 ms, authoritativenoyes / yesrefused41824.11
a13-65.akam.net 2600:1480:800::41NOERROR, 5 ms, authoritativenoyes / yesrefused41824.7
a22-67.akam.net 23.211.61.67NOERROR, 4 ms, authoritativenoyes / yesrefused48878.30
a22-67.akam.net 2600:1480:7800::43NOERROR, 4 ms, authoritativenoyes / yesrefused48878.33
a26-64.akam.net 23.74.25.64NOERROR, 4 ms, authoritativenoyes / yesrefused48878.33
a26-64.akam.net 2600:1480:b800::40NOERROR, 4 ms, authoritativenoyes / yesrefused48878.30
a4-67.akam.net 72.246.46.67NOERROR, 4 ms, authoritativenoyes / yesrefused48878.33
a4-67.akam.net 2600:1480:9000::43NOERROR, 3 ms, authoritativenoyes / yesrefused48878.26
a5-67.akam.net 95.100.168.67NOERROR, 5 ms, authoritativenoyes / yesrefused41824.8
a5-67.akam.net 2600:1480:b000::43NOERROR, 4 ms, authoritativenoyes / yesrefused41824.9

Checks

  • ✓ All respond #14
    All 12 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: a1-253.akam.net: "41824.9"; a1-253.akam.net: "41824.10"; a13-65.akam.net: "41824.11"; a13-65.akam.net: "41824.7"; a22-67.akam.net: "48878.30"; a22-67.akam.net: "48878.33"; a26-64.akam.net: "48878.33"; a26-64.akam.net: "48878.30"; a4-67.akam.net: "48878.33"; a4-67.akam.net: "48878.26"; a5-67.akam.net: "41824.8"; a5-67.akam.net: "41824.9". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 4896 · primary a1-253.akam.net

Found

Primary (MNAME)
a1-253.akam.net
Contact (RNAME)
ipadmin.nationwide.com
Serial
4896
Refresh / retry
10800 s / 3600 s
Expire
1209600 s
Negative TTL
300 s

Serial per nameserver

NameserverSerial
a1-253.akam.net (193.108.91.253)4896
a1-253.akam.net (2600:1401:2::fd)4896
a13-65.akam.net (2.22.230.65)4896
a13-65.akam.net (2600:1480:800::41)4896
a22-67.akam.net (23.211.61.67)4896
a22-67.akam.net (2600:1480:7800::43)4896
a26-64.akam.net (23.74.25.64)4896
a26-64.akam.net (2600:1480:b800::40)4896
a4-67.akam.net (72.246.46.67)4896
a4-67.akam.net (2600:1480:9000::43)4896
a5-67.akam.net (95.100.168.67)4896
a5-67.akam.net (2600:1480:b000::43)4896

Checks

  • ✓ Serial 4896 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 3h, retry 1h, expire 14d, negative TTL 5m.
  • ✓ Primary is a public nameserver #24
    The primary nameserver a1-253.akam.net is one of the listed nameservers.
  • ✓ Contact ipadmin@nationwide.com #25
    The SOA RNAME ipadmin.nationwide.com means ipadmin@nationwide.com.
  • ✓ Counter serial #26
    The serial 4896 is a plain counter.

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

64 records at the apex

Found

Read from
193.108.91.253:53
TypeValueTTL
SOAa1-253.akam.net. ipadmin.nationwide.com. 4896 10800 3600 1209600 300300
NSa13-65.akam.net.300
NSa5-67.akam.net.300
NSa4-67.akam.net.300
NSa22-67.akam.net.300
NSa26-64.akam.net.300
NSa1-253.akam.net.300
A2.16.204.6820
A2.16.204.9320
MX10 mx2.hc2638-63.iphmx.com.300
MX10 mx1.hc2638-63.iphmx.com.300
TXT"pardot273512=27b7adbcc4c8bf5aa4d83128e8058fef4b72b87242448b9328d784f6033c3f7e"300
TXT"00D70000000N29U=1TBPc00000002uh"300
TXT"openai-domain-verification=dv-HG5kxapzpkgB7QDobTZfKfpP"300
TXT"SFMC-IQaxOTyYoxFZoCrU6fENoJTnTG3TG56reVoL2MRJ"300
TXT"00D8a0000029GqY=1TBaZ0000000421"300
TXT"00DVa000005GEAc=1TBVa00000008C5"300
TXT"knowbe4-site-verification=2233e2f5e154c72fd920cee35d5cd753"300
TXT"postman-domain-verification=5c025381270ef5a9e4819bbf95b5be95156365cd426621b26d358fe7041c8ea9"300
TXT"00D80000000KAXd=1TBPn00000009w9"300
TXT"logmein-verification-code=62edc601-f390-4b51-8fe1-633d7d7dc688"300
TXT"smartsheet-site-validation=KbZGdAxugzHquR2EsN5nlUQ7DaEkgRuG"300
TXT"pexip-portal-domain-verification=241a7f35-f550-40d2-a400-6c9de7766941"300
TXT"00Ddq000002YdCH=1TBdq0000000X41"300
TXT"google-site-verification=nKdJMTeaVSqFJIgMLqhhxPtNyZC0V4Xe0Jhmk6XIfSk"300
TXT"ZA=VzeDq4uIgQ3xEiy/SKAUAg=="300
TXT"00D3x000001zzAZ=1TBVu00000003Qv"300
TXT"pexip-ms-tenant-domain-verification=241a7f35-f550-40d2-a400-6c9de7766941"300
TXT"SFMC-O1eyAlmzwjC9cd4vFCCfSWoNrP8_ZlwCoZm20VHc"300
TXT"hover-domain-verification=veZJStVWdn"300
TXT"00Dbc000005beTR=1TBbc000000065R"300
TXT"docusign=1e14c7ce-c2a2-48be-8b10-d2c6cb7f6bcb"300
TXT"00DG0000000kZdU=1TBWR00000004gL"300
TXT"adobe-idp-site-verification=86ee327a-adff-4ade-9dc1-2b09877cce85"300
TXT"7R6dvh3cQ9jIdETrz7mdyQjOI37KmP6B"300
TXT"00DE0000000ZZVz=1TBV100000005Az"300
TXT"autodesk-domain-verification=2e3uIKkoxR15wmSVnxIR"300
TXT"00Ddp000001jnC5=1TBdp00000006LZ"300
TXT"docker-verification=cc6691fb-4579-4948-9609-dd58a496fe2f"300
TXT"onetrust-domain-verification=1b7f8cda1cf14095bf7658a0e73b1ef4"300
TXT"_globalsign-domain-verification=BhXLcus_dNrPlz0mAzwh69CvymagoODy0Pvd7vcQFc"300
TXT"loop-domain-verification-1mrmfh=jdo6Hpviwgkw7worHCCOp08hE"300
TXT"docusign=c055da15-e3c9-4db0-a252-6a3cca891df0"300
TXT"facebook-domain-verification=nzusm3w9s42dgfwjsr62a6xfuz5ofg"300
TXT"pardot677263=af8f0a86c00f08be4e35b4731384fa0d8847ba709f2cb30b27cb5d51f578bbf1"300
TXT"google-site-verification=5yNNisqv9iGwOhk5EsL-DifUfIec3kSCq4SgpALdkSI"300
TXT"jamf-site-verification=ILWC_0jwBr37H3TyRAm6QA"300
TXT"apple-domain-verification=raGT6DOmqlElOPqZ"300
TXT"google-site-verification=BevMS2fc7jCoBPRH5SeRwBla2fZAIiAu7IYvDLUJXRk"300
TXT"v=spf1 exists:%{i}.spf.hc2638-63.iphmx.com exists:%{i}.spf.hc2638-80.iphmx.com a:mta.email-nationwide.com ip4:66.231.80.72 include:res.cisco.com include:spf.protection.outlook.com ~all"300
TXT"OSSRH-65591"300
TXT"atlassian-domain-verification=RE/KY6RsT6DVcsykab8u5Pa1Xsl61oOWx68sVNcrcbegVJ1Ob0r8QnKRDOcYT9bL"300
TXT"00DD50000001dy1=1TBD50000004C9i"300
TXT"_9cl6s61h03r9q5e4vdjnwwhtla001m1"300
TXT"1password-site-verification=NW6EHVDXOBE4DECEYO6SFW3CA4"300
TXT"Data00DDn000002Hcby=1TBVw000000040P"300
TXT"00D1U000000xmUk=1TBQU000000026f"300
TXT"00Ddo000002Iqrp=1TBdo00000005Sk"300
TXT"MS=ms77822681"300
TXT"00D30000000637L=1TBVw000000026f"300
TXT"SFMC-EvxSQZhB0Hxmqdte4M4DAbJYNag-CluneMWvzqAO"300
TXT"infoblox-domain-mastery=7d6c603cd9860f597c95dcd4a680620b08108a3dd5c889dbb73e1acae816599342"300
TXT"00DWF00000Beuml=1TBWF0000001AyD"300
TXT"e2ma-verification=nxhib"300

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (20s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 5m; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35