niedersachsen.de

Checked 21 October 2026, 23:32 UTC · via 8.8.8.8
!Passed with warnings
21 passed 2 warnings 0 failed 6 info

Registration

info

.de country-code

Found

TLD
.de (country-code)
ICANN policies apply
no

Checks

  • i
    .de is a country-code TLD (ccTLD)
    Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.
    #1
  • ✓ TLD delegated and signed #2
    .de is delegated in the root zone and DNSSEC-signed.
  • i
    Registration data not available
    No registration data via RDAP: the registry of .de offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.
    #3

Delegation

warn

ns-a.niedersachsen.de, ns-b.niedersachsen.de

Found

Parent zone
de
Delegation from
a.nic.de (194.0.0.53)
NS at the parent
ns-a.niedersachsen.de, ns-b.niedersachsen.de
NS in the zone
ns-a.niedersachsen.de, ns-b.niedersachsen.de
NameserverAddressesNetwork (AS)Glue
ns-a.niedersachsen.de80.228.49.9 2a02:1060:0:b000::1:3AS9145 EWETEL - EWE TEL GmbH, DE AS9145 EWETEL - EWE TEL GmbH, DE80.228.49.9 2a02:1060:0:b000::1:3
ns-b.niedersachsen.de80.228.49.10 2a02:1060:0:b000::1:4AS9145 EWETEL - EWE TEL GmbH, DE AS9145 EWETEL - EWE TEL GmbH, DE80.228.49.10 2a02:1060:0:b000::1:4

Checks

  • i
    2 nameservers
    Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: ns-a.niedersachsen.de, ns-b.niedersachsen.de.
    #6
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ Glue present and correct #8
    Glue is published for the nameservers inside the zone: ns-a.niedersachsen.de, ns-b.niedersachsen.de.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • !
    Nameservers in one network
    all IPv4 addresses are in 80.228.49.0/24; all IPv6 addresses are in 2a02:1060::/48. A single network failure takes all nameservers down; RFC 2182 recommends topologically separate networks (anycast setups are an exception).
    #10
  • i
    All nameservers in one AS
    All nameserver addresses are announced by one network operator (AS9145 (EWETEL - EWE TEL GmbH, DE): 4 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.
    #11
  • i
    All nameserver names under .de
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

pass

4 of 4 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns-a.niedersachsen.de 80.228.49.9NOERROR, 17 ms, authoritativenoyes / yesrefused-
ns-a.niedersachsen.de 2a02:1060:0:b000::1:3NOERROR, 18 ms, authoritativenoyes / yesrefused-
ns-b.niedersachsen.de 80.228.49.10NOERROR, 18 ms, authoritativenoyes / yesrefused-
ns-b.niedersachsen.de 2a02:1060:0:b000::1:4NOERROR, 21 ms, authoritativenoyes / yesrefused-

Checks

  • ✓ All respond #14
    All 4 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • ✓ No version disclosed #17
    The nameservers don't reveal their software version.
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 2026102003 · primary ns-a.niedersachsen.de

Found

Primary (MNAME)
ns-a.niedersachsen.de
Contact (RNAME)
dns-admin.niedersachsen.de
Serial
2026102003
Refresh / retry
7200 s / 2400 s
Expire
1814400 s
Negative TTL
3600 s

Serial per nameserver

NameserverSerial
ns-a.niedersachsen.de (80.228.49.9)2026102003
ns-a.niedersachsen.de (2a02:1060:0:b000::1:3)2026102003
ns-b.niedersachsen.de (80.228.49.10)2026102003
ns-b.niedersachsen.de (2a02:1060:0:b000::1:4)2026102003

Checks

  • ✓ Serial 2026102003 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 2h, retry 40m, expire 21d, negative TTL 1h.
  • ✓ Primary is a public nameserver #24
    The primary nameserver ns-a.niedersachsen.de is one of the listed nameservers.
  • ✓ Contact dns-admin@niedersachsen.de #25
    The SOA RNAME dns-admin.niedersachsen.de means dns-admin@niedersachsen.de.
  • ✓ Date-based serial #26
    The serial 2026102003 follows the YYYYMMDDnn convention (2026-10-20).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

info

26 records at the apex

Found

Read from
80.228.49.9:53
TypeValueTTL
SOAns-a.niedersachsen.de. dns-admin.niedersachsen.de. 2026102003 7200 2400 1814400 36003600
NSns-b.niedersachsen.de.3600
NSns-a.niedersachsen.de.3600
A80.228.49.1733600
MX5 inetmail14.niedersachsen.de.3600
MX5 inetmail23.niedersachsen.de.3600
MX5 inetmail13.niedersachsen.de.3600
TXT"9760dfa889dda593bd7eb829f4658071a09e4651cfa7226348720a062176c68"60
TXT"a970c57d49ee64d1656b4678113a82769e44f1cbdf6d5649e3e5318bdb6aaf5"60
TXT"google-site-verification=h8sQpJqduU0c_OLgTA4fZBZV48mS40fiV2f0wGlp4Wk"60
TXT"cisco-ci-domain-verification=40cd14245a352a1238579515709398e1ed95f2ee2e3bc9d02110434a438c9d89"60
TXT"v=spf1 ip4:80.228.49.0/27 ip4:80.228.54.224/28 ip4:195.37.198.224/28 -all"60
TXT"swisssign-check=7IvogopiIqzbCs41LKJ5Xa86mus"60
TXT"9f94f6011ceca57d4786900a942c4ec6f938db1f9ec3adfda48c236909e13a8"60
TXT"HARICA-04NBQSpIzAKP4YYFPCl"60
TXT"26c8ed7898afe9d17c347120a41f46de9422fa129f94b69867c8b7a4fb07d43"60
TXT"_telesec-domain-validation=358116_2026-03-16_rjcJmlKR6t0pKtyNuD9cJFPhTUghgQ8oEgGl5GnTsMl0FIyGX3"60
TXT"_telesec-domain-validation=362138_2026-09-07_D3cZDBzO9Fz5qAeGuwyVQhpCpCZbjjDVaQ1CKHPlZEwm2ncKVI"60
TXT"7a9d806ff712f12fc638e5f1cb4711908619592f4dcd35ec91cca13b83d9d7b"60
TXT"_4vq7izdhpi3rnz8avjgr8nsdhz866y7"60
TXT"_telesec-domain-validation=334768_2024-04-25_mHECm8zL0ThwT35mmXhyQdsCLSaUGWWwzRecNLLDOMvn1WhnSq"60
TXT"MS=ms78488956"60
TXT"_telesec-domain-validation=319276_2023-04-25_FfBYJaZH9GjsoBgCzfqB2nHApsX7Eq8fRp4HL45jg5Swafjt7E"60
TXT"_pki-validation.niedersachsen.de=q1900EnT6RykvvktPcwB7Uz97om8UDJG"60
TXT"swisssign-check=7qBb8BnrkJH-9tQ5WhfvBvvyqzo"60
TXT"_telesec-domain-validation=345947_2025-03-17_O2nNgncSSkPiO4hfcHieRYGQQHpzZZWyAjZIMddHBQBFwsqzhr"60

Checks

  • ✓ TTLs within range #32
    TTLs: A 1h, MX 1h, NS 1h. The NS TTL at the parent is 1d and in the zone 1h; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35