nikhef.nl

Checked 21 October 2026, 21:23 UTC · via 8.8.8.8
!Passed with warnings
23 passed 3 warnings 0 failed 5 info

Registration

info

.nl country-code · SURF B.V.

Found

TLD
.nl (country-code)
ICANN policies apply
no
Registrar
SURF B.V.
Registered
7 January 1987
Last changed
25 October 2017
Status
active
Registry nameservers
cesano.nikhef.nl, dwalin.nikhef.nl, ext-dns-2.cern.ch
RDAP server
https://rdap.sidn.nl/

Checks

  • i
    .nl is a country-code TLD (ccTLD)
    Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.
    #1
  • ✓ TLD delegated and signed #2
    .nl is delegated in the root zone and DNSSEC-signed.
  • i
    Expiry date not published
    The registry does not publish the expiry date in RDAP. Check it with your registrar.
    #3
  • i
    No transfer lock
    The domain has no transfer lock (status: active). A registrar lock protects against unauthorized transfers.
    #4
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

cesano.nikhef.nl, dwalin.nikhef.nl, ext-dns-2.cern.ch

Found

Parent zone
nl
Delegation from
ns1.dns.nl (194.0.28.53)
NS at the parent
cesano.nikhef.nl, dwalin.nikhef.nl, ext-dns-2.cern.ch
NS in the zone
ext-dns-2.cern.ch, ns1.nikhef.nl, ns2.nikhef.nl, way.desy.de
NameserverAddressesNetwork (AS)Glue
cesano.nikhef.nl (parent only)192.16.185.12 2001:610:120:1001::185:12AS1104 Nikhef - Stichting Nederlandse Wetenschappelijk Onderzoek Instituten, NL AS1103 SURFNET-NL - SURF B.V., NL192.16.185.12
dwalin.nikhef.nl (parent only)192.16.199.17 2001:610:120:1000::199:17AS1104 Nikhef - Stichting Nederlandse Wetenschappelijk Onderzoek Instituten, NL AS1103 SURFNET-NL - SURF B.V., NL192.16.199.17 2001:610:120:1000::199:17
ext-dns-2.cern.ch192.91.245.85 2001:1458:1:2::100:85AS513 CERN - CERN - European Organization for Nuclear Research, CH AS513 CERN - CERN - European Organization for Nuclear Research, CH-
ns1.nikhef.nl (zone only)192.16.199.17 2001:610:120:1000::199:17AS1104 Nikhef - Stichting Nederlandse Wetenschappelijk Onderzoek Instituten, NL AS1103 SURFNET-NL - SURF B.V., NL-
ns2.nikhef.nl (zone only)192.16.185.12 2001:610:120:1001::185:12AS1104 Nikhef - Stichting Nederlandse Wetenschappelijk Onderzoek Instituten, NL AS1103 SURFNET-NL - SURF B.V., NL-
way.desy.de (zone only)131.169.194.200 2001:638:700:10c2::1:c8AS1754 DESY-HAMBURG - Deutsches Elektronen-Synchrotron DESY, DE AS680 DFN - Verein zur Foerderung eines Deutschen Forschungsnetzes e.V., DE-

Checks

  • ✓ 3 nameservers #6
    Delegated to cesano.nikhef.nl, dwalin.nikhef.nl, ext-dns-2.cern.ch.
  • !
    NS sets differ
    The nameservers at the parent and in the zone should be the same. Only at the parent: cesano.nikhef.nl, dwalin.nikhef.nl; only in the zone: ns1.nikhef.nl, ns2.nikhef.nl, way.desy.de. cesano.nikhef.nl, dwalin.nikhef.nl, ext-dns-2.cern.ch, ns1.nikhef.nl, ns2.nikhef.nl, way.desy.de report NS ext-dns-2.cern.ch ns1.nikhef.nl ns2.nikhef.nl way.desy.de.
    #7
  • !
    Glue differs from the zone
    The addresses at the parent (glue) differ from the addresses in the zone: cesano.nikhef.nl (glue 192.16.185.12, zone 192.16.185.12, 2001:610:120:1001::185:12). Update the glue at your registrar.
    #8
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 4 IPv4 /24s and 3 IPv6 /48s.
  • ✓ 5 autonomous systems #11
    The nameservers are spread over: AS1103 (SURFNET-NL - SURF B.V., NL): 4 addresses; AS1104 (Nikhef - Stichting Nederlandse Wetenschappelijk Onderzoek Instituten, NL): 4 addresses; AS1754 (DESY-HAMBURG - Deutsches Elektronen-Synchrotron DESY, DE): 1 address; AS513 (CERN - CERN - European Organization for Nuclear Research, CH): 2 addresses; AS680 (DFN - Verein zur Foerderung eines Deutschen Forschungsnetzes e.V., DE): 1 address.
  • ✓ Nameserver names under 2 TLDs #12
    Nameserver names use the TLDs .ch, .nl.
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

info

12 of 12 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
cesano.nikhef.nl 192.16.185.12NOERROR, 10 ms, authoritativenoyes / yesrefused-
cesano.nikhef.nl 2001:610:120:1001::185:12NOERROR, 9 ms, authoritativenoyes / yesrefused-
dwalin.nikhef.nl 192.16.199.17NOERROR, 10 ms, authoritativenoyes / yesrefused-
dwalin.nikhef.nl 2001:610:120:1000::199:17NOERROR, 10 ms, authoritativenoyes / yesrefused-
ext-dns-2.cern.ch 192.91.245.85NOERROR, 17 ms, authoritativenoyes / yesrefusedUNKNOWN
ext-dns-2.cern.ch 2001:1458:1:2::100:85NOERROR, 17 ms, authoritativenoyes / yesrefusedUNKNOWN
ns1.nikhef.nl 192.16.199.17NOERROR, 9 ms, authoritativenoyes / yesrefused-
ns1.nikhef.nl 2001:610:120:1000::199:17NOERROR, 9 ms, authoritativenoyes / yesrefused-
ns2.nikhef.nl 192.16.185.12NOERROR, 9 ms, authoritativenoyes / yesrefused-
ns2.nikhef.nl 2001:610:120:1001::185:12NOERROR, 10 ms, authoritativenoyes / yesrefused-
way.desy.de 131.169.194.200NOERROR, 17 ms, authoritativenoyes / yesrefused-
way.desy.de 2001:638:700:10c2::1:c8NOERROR, 17 ms, authoritativenoyes / yesrefused-

Checks

  • ✓ All respond #14
    All 12 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • i
    Identifying string disclosed
    These nameservers answer version queries with a string that is not a version number: ext-dns-2.cern.ch: "UNKNOWN".
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

info

serial 202600084 · primary lin-vm-net-ctb-001.nikhef.nl

Found

Primary (MNAME)
lin-vm-net-ctb-001.nikhef.nl
Contact (RNAME)
hostmaster.nikhef.nl
Serial
202600084
Refresh / retry
14400 s / 3600 s
Expire
604800 s
Negative TTL
3600 s

Serial per nameserver

NameserverSerial
cesano.nikhef.nl (192.16.185.12)202600084
cesano.nikhef.nl (2001:610:120:1001::185:12)202600084
dwalin.nikhef.nl (192.16.199.17)202600084
dwalin.nikhef.nl (2001:610:120:1000::199:17)202600084
ext-dns-2.cern.ch (192.91.245.85)202600084
ext-dns-2.cern.ch (2001:1458:1:2::100:85)202600084
ns1.nikhef.nl (192.16.199.17)202600084
ns1.nikhef.nl (2001:610:120:1000::199:17)202600084
ns2.nikhef.nl (192.16.185.12)202600084
ns2.nikhef.nl (2001:610:120:1001::185:12)202600084
way.desy.de (131.169.194.200)202600084
way.desy.de (2001:638:700:10c2::1:c8)202600084

Checks

  • ✓ Serial 202600084 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 4h, retry 1h, expire 7d, negative TTL 1h.
  • i
    Hidden master
    The primary nameserver lin-vm-net-ctb-001.nikhef.nl is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.
    #24
  • ✓ Contact hostmaster@nikhef.nl #25
    The SOA RNAME hostmaster.nikhef.nl means hostmaster@nikhef.nl.
  • ✓ Counter serial #26
    The serial 202600084 is a plain counter.

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

pass

18 records at the apex

Found

Read from
192.16.185.12:53
TypeValueTTL
SOAlin-vm-net-ctb-001.nikhef.nl. hostmaster.nikhef.nl. 202600084 14400 3600 604800 36003600
NSns2.nikhef.nl.3600
NSway.desy.de.3600
NSext-dns-2.cern.ch.3600
NSns1.nikhef.nl.3600
MX10 mx.soverin.net.3600
TXT"v=spf1 redirect=_spf.nikhef.nl"3600
TXT"ZOOM_verify_I18KZTHNnq7nSXtI0y2HRy"3600
TXT"atlassian-sending-domain-verification=5dad3728-f82a-40e0-a770-64c61c9e8123"3600
TXT"DomainVerification=KVBQFNPB8XN8WKVF58E2WYSTHPTMEVUBROQEJ5XXJOG1J9G69JNDLJNCIALU4UL4"3600
TXT"atlassian-domain-verification=09AISz0F1191uXaagNfUQDP4SUulLKVjgQFWekhSsEXdSiasXUaTytNJyZTZmAn5"3600
TXT"10571979"3600
CAA0 issue "letsencrypt.org"3600
CAA0 issue "sectigo.com"3600
CAA0 iodef "mailto:security@nikhef.nl"3600
CAA0 issue "amazon.com"3600
CAA0 issue "digicert.com"3600
CAA0 issue "harica.gr"3600

Checks

  • ✓ TTLs within range #32
    TTLs: MX 1h, NS 1h.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • ✓ CAA restricts issuance #35
    Certificates may be issued by: letsencrypt.org, sectigo.com, amazon.com, digicert.com, harica.gr.