Domain report: nytimes.com

Registration

info

.com generic · MarkMonitor Inc. · expires 2027-01-19

Found

TLD: .com (generic)
ICANN policies apply: yes
Registrar: MarkMonitor Inc.
Registered: 18 January 1994
Last changed: 18 December 2024
Expires: 19 January 2027
Status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers: dns1.p06.nsone.net, dns2.p06.nsone.net, dns3.p06.nsone.net, dns4.p06.nsone.net, ns-1328.awsdns-38.org, ns-1652.awsdns-14.co.uk, ns-244.awsdns-30.com, ns-635.awsdns-15.net
RDAP server: https://rdap.verisign.com/com/v1/

Checks

i

.com is a generic TLD (gTLD)

Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.

#1
✓ TLD delegated and signed #2

.com is delegated in the root zone and DNSSEC-signed.
✓ Expires on 2027-01-19 #3

The registration is valid until 2027-01-19 (88 days).
✓ Transfer locked #4

Registry status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
✓ Registry and delegation match #5

The nameservers registered at the registry are the ones published in DNS.

Delegation

pass

dns1.p06.nsone.net, dns2.p06.nsone.net, dns3.p06.nsone.net, dns4.p06.nsone.net, ns-1328.awsdns-38.org, ns-1652.awsdns-14.co.uk, ns-244.awsdns-30.com, ns-635.awsdns-15.net

Found

Parent zone: com
Delegation from: a.gtld-servers.net (192.5.6.30)
NS at the parent: dns1.p06.nsone.net, dns2.p06.nsone.net, dns3.p06.nsone.net, dns4.p06.nsone.net, ns-1328.awsdns-38.org, ns-1652.awsdns-14.co.uk, ns-244.awsdns-30.com, ns-635.awsdns-15.net
NS in the zone: dns1.p06.nsone.net, dns2.p06.nsone.net, dns3.p06.nsone.net, dns4.p06.nsone.net, ns-1328.awsdns-38.org, ns-1652.awsdns-14.co.uk, ns-244.awsdns-30.com, ns-635.awsdns-15.net

Nameserver	Addresses	Network (AS)	Glue
dns1.p06.nsone.net	198.51.44.6 2620:4d:4000:6259:7:6:0:1	AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US	-
dns2.p06.nsone.net	198.51.45.6 2a00:edc0:6259:7:6::2	AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US	-
dns3.p06.nsone.net	198.51.44.70 2620:4d:4000:6259:7:6:0:3	AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US	-
dns4.p06.nsone.net	198.51.45.70 2a00:edc0:6259:7:6::4	AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US	-
ns-1328.awsdns-38.org	205.251.197.48 2600:9000:5305:3000::1	AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US	-
ns-1652.awsdns-14.co.uk	205.251.198.116 2600:9000:5306:7400::1	AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US	-
ns-244.awsdns-30.com	205.251.192.244 2600:9000:5300:f400::1	AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US	205.251.192.244 2600:9000:5300:f400::1
ns-635.awsdns-15.net	205.251.194.123 2600:9000:5302:7b00::1	AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US	-

Checks

✓ 8 nameservers #6

Delegated to dns1.p06.nsone.net, dns2.p06.nsone.net, dns3.p06.nsone.net, dns4.p06.nsone.net, ns-1328.awsdns-38.org, ns-1652.awsdns-14.co.uk, ns-244.awsdns-30.com, ns-635.awsdns-15.net.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 6 IPv4 /24s and 6 IPv6 /48s.
✓ 2 autonomous systems #11

The nameservers are spread over: AS16509 (AMAZON-02 - Amazon.com, Inc., US): 8 addresses; AS62597 (NSONE - NSONE Inc, US): 8 addresses.
✓ Nameserver names under 4 TLDs #12

Nameserver names use the TLDs .com, .net, .org, .uk.
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

Nameservers

info

16 of 16 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
dns1.p06.nsone.net 198.51.44.6	NOERROR, 4 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns1.p06.nsone.net 2620:4d:4000:6259:7:6:0:1	NOERROR, 4 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns2.p06.nsone.net 198.51.45.6	NOERROR, 4 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns2.p06.nsone.net 2a00:edc0:6259:7:6::2	NOERROR, 4 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns3.p06.nsone.net 198.51.44.70	NOERROR, 6 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns3.p06.nsone.net 2620:4d:4000:6259:7:6:0:3	NOERROR, 4 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns4.p06.nsone.net 198.51.45.70	NOERROR, 4 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns4.p06.nsone.net 2a00:edc0:6259:7:6::4	NOERROR, 4 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
ns-1328.awsdns-38.org 205.251.197.48	NOERROR, 3 ms, authoritative	no	yes / yes	refused	-
ns-1328.awsdns-38.org 2600:9000:5305:3000::1	NOERROR, 3 ms, authoritative	no	yes / yes	refused	-
ns-1652.awsdns-14.co.uk 205.251.198.116	NOERROR, 9 ms, authoritative	no	yes / yes	refused	-
ns-1652.awsdns-14.co.uk 2600:9000:5306:7400::1	NOERROR, 9 ms, authoritative	no	yes / yes	refused	-
ns-244.awsdns-30.com 205.251.192.244	NOERROR, 9 ms, authoritative	no	yes / yes	refused	-
ns-244.awsdns-30.com 2600:9000:5300:f400::1	NOERROR, 9 ms, authoritative	no	yes / yes	refused	-
ns-635.awsdns-15.net 205.251.194.123	NOERROR, 4 ms, authoritative	no	yes / yes	refused	-
ns-635.awsdns-15.net 2600:9000:5302:7b00::1	NOERROR, 4 ms, authoritative	no	yes / yes	refused	-

Checks

✓ All respond #14

All 16 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
i

Identifying string disclosed

These nameservers answer version queries with a string that is not a version number: dns1.p06.nsone.net: "19dd46e347df36b70933bf2be8023258586586a9"; dns2.p06.nsone.net: "19dd46e347df36b70933bf2be8023258586586a9"; dns3.p06.nsone.net: "19dd46e347df36b70933bf2be8023258586586a9"; dns4.p06.nsone.net: "19dd46e347df36b70933bf2be8023258586586a9".

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

warn

serial 1652977968 · primary dns1.p06.nsone.net

Found

Primary (MNAME): dns1.p06.nsone.net
Contact (RNAME): hostmaster.nytimes.com
Serial: 1652977968
Refresh / retry: 300 s / 150 s
Expire: 1209600 s
Negative TTL: 300 s

Serial per nameserver

Nameserver	Serial
dns1.p06.nsone.net (198.51.44.6)	1652977968
dns1.p06.nsone.net (2620:4d:4000:6259:7:6:0:1)	1652977968
dns2.p06.nsone.net (198.51.45.6)	1652977968
dns2.p06.nsone.net (2a00:edc0:6259:7:6::2)	1652977968
dns3.p06.nsone.net (198.51.44.70)	1652977968
dns3.p06.nsone.net (2620:4d:4000:6259:7:6:0:3)	1652977968
dns4.p06.nsone.net (198.51.45.70)	1652977968
dns4.p06.nsone.net (2a00:edc0:6259:7:6::4)	1652977968
ns-1328.awsdns-38.org (205.251.197.48)	1
ns-1328.awsdns-38.org (2600:9000:5305:3000::1)	1
ns-1652.awsdns-14.co.uk (205.251.198.116)	1
ns-1652.awsdns-14.co.uk (2600:9000:5306:7400::1)	1
ns-244.awsdns-30.com (205.251.192.244)	1
ns-244.awsdns-30.com (2600:9000:5300:f400::1)	1
ns-635.awsdns-15.net (205.251.194.123)	1
ns-635.awsdns-15.net (2600:9000:5302:7b00::1)	1

Checks

!

Serials differ

The nameservers serve different versions of the zone: 1 on ns-1328.awsdns-38.org (205.251.197.48), ns-1328.awsdns-38.org (2600:9000:5305:3000::1), ns-1652.awsdns-14.co.uk (205.251.198.116), ns-1652.awsdns-14.co.uk (2600:9000:5306:7400::1), ns-244.awsdns-30.com (205.251.192.244), ns-244.awsdns-30.com (2600:9000:5300:f400::1), ns-635.awsdns-15.net (205.251.194.123), ns-635.awsdns-15.net (2600:9000:5302:7b00::1); 1652977968 on dns1.p06.nsone.net (198.51.44.6), dns1.p06.nsone.net (2620:4d:4000:6259:7:6:0:1), dns2.p06.nsone.net (198.51.45.6), dns2.p06.nsone.net (2a00:edc0:6259:7:6::2), dns3.p06.nsone.net (198.51.44.70), dns3.p06.nsone.net (2620:4d:4000:6259:7:6:0:3), dns4.p06.nsone.net (198.51.45.70), dns4.p06.nsone.net (2a00:edc0:6259:7:6::4). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.

#22
!

Unusual SOA timers

refresh 5m is outside 20m–1d. Current values: refresh 5m, retry 2m30s, expire 14d, negative TTL 5m.

#23
✓ Primary is a public nameserver #24

The primary nameserver dns1.p06.nsone.net is one of the listed nameservers.
✓ Contact hostmaster@nytimes.com #25

The SOA RNAME hostmaster.nytimes.com means hostmaster@nytimes.com.
✓ Timestamp serial #26

The serial 1652977968 is a Unix timestamp (2022-05-19 16:32 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

warn

75 records at the apex

Found

Read from: 198.51.44.6:53

Type	Value	TTL
SOA	dns1.p06.nsone.net. hostmaster.nytimes.com. 1652977968 300 150 1209600 300	300
NS	dns4.p06.nsone.net.	300
NS	dns2.p06.nsone.net.	300
NS	dns3.p06.nsone.net.	300
NS	dns1.p06.nsone.net.	300
NS	ns-635.awsdns-15.net.	300
NS	ns-1652.awsdns-14.co.uk.	300
NS	ns-1328.awsdns-38.org.	300
NS	ns-244.awsdns-30.com.	300
A	151.101.1.164	120
A	151.101.129.164	120
A	151.101.193.164	120
A	151.101.65.164	120
MX	1 aspmx.l.google.com.	600
MX	5 alt1.aspmx.l.google.com.	600
MX	5 alt2.aspmx.l.google.com.	600
MX	10 alt3.aspmx.l.google.com.	600
MX	10 alt4.aspmx.l.google.com.	600
TXT	"1password-site-verification=5XOUF7UVRZC5XFXKJ7IH435GPA"	500
TXT	"253961548-4297453"	500
TXT	"MS=A1BFCA84E21B7011CA98DF9DC251CDDF90E0174B"	500
TXT	"MS=ms22827202"	500
TXT	"NV=6b9b6zcshr98ey1x"	500
TXT	"ZOOM_verify_ClSSgAI2bqqZQA66rT4Z1x"	500
TXT	"_b2ao2yybjl1klqaw0mahepejqyvwgq1"	500
TXT	"_wufmw8f1leho148v35f8zaogcyux7lx"	500
TXT	"adobe-idp-site-verification=5ce4d99c-af0a-4b76-9217-bd49d3336df0"	500
TXT	"apple-domain-verification=1BVLidj37w9zRMnU"	500
TXT	"atlassian-domain-verification=Vrn33GZgJTapfeggl1snZZ5a8HjNwfFb1K5kBxVNhp7jlMFlRZGUytV9rIHhGdR8"	500
TXT	"atlassian-sending-domain-verification=1b4b110f-a2dd-4853-8b13-de36c831aa81"	500
TXT	"cursor-domain-verification-cbqk6b=DdvvVJNHMmVswd6oRmD8GZX50"	500
TXT	"dell-technologies-domain-verification=nytimes.com_e9803e4c-210b-4501-a26b-705148cb7292_1777730473"	500
TXT	"docusign=6a4f88fd-cd2f-4917-acdb-bb2f343438a1"	500
TXT	"docusign=bd506110-db79-430e-b159-cc1d74fe1176"	500
TXT	"dropbox-domain-verification=4ld3jahx0psi"	500
TXT	"gamma-domain-verification-m0hfp8=Kn1CNDywmVQvNK2EE60GxQORI"	500
TXT	"google-site-verification=4TE2ggBoy6PktLjtZ03t32A2oEZ0VD0PY6MnTj8IL_g"	500
TXT	"google-site-verification=4qJm5sAZa1_29BTwFjqW09t7_7D4Vee3LBFQqg8xYbs"	500
TXT	"google-site-verification=NIqXa_F8IaqdPJhTtexgR0NYbzVLD_-X-uRUvyf4GyQ"	500
TXT	"google-site-verification=NSmi94k0NzvQaksUCNXeJZPYtJPSoUf52cjJsJcZFy4"	500
TXT	"google-site-verification=OJl4BugQ_esE20V0QtVc9DhqvnnxOLHnf5AmFjdLSqk"	500
TXT	"google-site-verification=ZTCMdpSKM7HwqTvGUf_00Ef008JhOnbzGgCSUGYfsro"	500
TXT	"google-site-verification=ZsySMeZ_SRbJZFu-53ptepytP7h5pxHO0qAg8Z2bKug"	500
TXT	"google-site-verification=aReMr8hkX3gxeHLKKk4tJ1s970U7QdEqUMIhMmLUfjQ"	500
TXT	"google-site-verification=dNxU4aqYrP-m9U4J4OO_hvaOfjepywv2BN8Luc-q4o8"	500
TXT	"google-site-verification=jZcmQFxPEP38yqYpmRvo0v_9hQFAdBZPUEBwTNUPUF8"	500
TXT	"google-site-verification=q5oM_szMOT79db0AJjdk_JP1xeurksaWmhbv_dd-MEM"	500
TXT	"google-site-verification=tvhSn0gaSi6CUrrc9N1pvq4tmJrzvbfJbKVWPrgg_6Q"	500
TXT	"jamf-site-verification=PIprfFrz8CBhH0TK0nNhnQ"	500
TXT	"klaviyo-site-verification=NsTtn9"	500
TXT	"klaviyo-site-verification=PkxYaQ"	500
TXT	"klaviyo-site-verification=VBhmML"	500
TXT	"lucidlink-verification=PZP4S4XGS2MW9TT3H76V0TPSY0"	500
TXT	"masv=oFbRBdtBUCoWWHaQiRJLZcKASUJZboJz"	500
TXT	"miro-verification=ee856857f05022ca58c04ab6f8e4014e564b3d6b"	500
TXT	"notion-domain-verification=4wS9fYEvnEgZg6Fc4cQ3atgsNuaj2zZIKwRP34uAGse"	500
TXT	"onetrust-domain-verification=1e62f8d767fc41a39fdf3f77025a8105"	500
TXT	"onetrust-domain-verification=dee1266d6a984549b43a1bd101957a8f"	500
TXT	"parallels-domain-verification=df31386535ac4cbe8d70cde19722e58da9831b130c3d46299f64ca5d0ed0f94d"	500
TXT	"segment-site-verification=Z6wALFPYli6z0AlPlgjZXpMVRLZ2KiRb"	500
TXT	"serval-domain-verification-bew4y4=VA1qmSGnvHaYCguEOONe1E2Nq"	500
TXT	"shade-domain-verification-wys4jv=w07FFVQR3MSW3TNoXqZAYS7O0"	500
TXT	"v=spf1 include:nytimes.com._nspf.vali.email include:%{i}._ip.%{h}._ehlo.%{d}._spf.vali.email include:_spf.e.sparkpost.com include:amazonses.com ~all"	500
TXT	"wiz-domain-verification=f58277d3dd68296f29aace3a12b746a054eee9f6c472f21673207cfcc1991081"	500
TXT	"wrike-verification=NjYxMTMwODpmZGRiNmQ3Yjc1Yzk5NjFhMDk2OWI4MWM2NDhkZmYxNjdmOThhODQ2MDJmZmI0ZTMxNTUxOTMzZGRlMzQwZDEw"	500
CAA	0 issue "amazon.com"	500
CAA	0 issue "amazonaws.com"	500
CAA	0 issue "amazontrust.com"	500
CAA	0 issue "awstrust.com"	500
CAA	0 issue "certainly.com"	500
CAA	0 issue "comodoca.com"	500
CAA	0 issue "digicert.com"	500
CAA	0 issue "letsencrypt.org"	500
CAA	0 issue "pki.goog"	500
CAA	0 issue "symantec.com"	500

Checks

!

Very low TTLs

These records have a TTL below 5m, causing extra queries and slower lookups: A (2m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 5m; resolvers may use either.

#32
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
✓ CAA restricts issuance #35

Certificates may be issued by: amazon.com, amazonaws.com, amazontrust.com, awstrust.com, certainly.com, comodoca.com, digicert.com, letsencrypt.org, pki.goog, symantec.com.