obi.de

Checked 21 October 2026, 23:41 UTC · via 8.8.8.8
!Passed with warnings
24 passed 2 warnings 0 failed 3 info

Registration

info

.de country-code

Found

TLD
.de (country-code)
ICANN policies apply
no

Checks

  • i
    .de is a country-code TLD (ccTLD)
    Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.
    #1
  • ✓ TLD delegated and signed #2
    .de is delegated in the root zone and DNSSEC-signed.
  • i
    Registration data not available
    No registration data via RDAP: the registry of .de offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.
    #3

Delegation

pass

ns01.cancom-mase.com, ns02.cancom-mase.net, ns03.cancom-mase.org, ns04.cancom-mase.de, ns05.cancom-mase.eu

Found

Parent zone
de
Delegation from
a.nic.de (194.0.0.53)
NS at the parent
ns01.cancom-mase.com, ns02.cancom-mase.net, ns03.cancom-mase.org, ns04.cancom-mase.de, ns05.cancom-mase.eu
NS in the zone
ns01.cancom-mase.com, ns02.cancom-mase.net, ns03.cancom-mase.org, ns04.cancom-mase.de, ns05.cancom-mase.eu
NameserverAddressesNetwork (AS)Glue
ns01.cancom-mase.com212.237.161.1 2001:1440:0:403a::53AS8469 PIRONETNDH-AS - CANCOM Managed Services GmbH, DE AS8469 PIRONETNDH-AS - CANCOM Managed Services GmbH, DE-
ns02.cancom-mase.net195.227.141.140 2001:1440:0:4034::53AS8469 PIRONETNDH-AS - CANCOM Managed Services GmbH, DE AS8469 PIRONETNDH-AS - CANCOM Managed Services GmbH, DE-
ns03.cancom-mase.org18.198.240.246 2a05:d014:30e:a800:dc84:9c93:5d17:5882AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US-
ns04.cancom-mase.de195.135.138.20 2001:1440:0:4039::53AS8469 PIRONETNDH-AS - CANCOM Managed Services GmbH, DE AS8469 PIRONETNDH-AS - CANCOM Managed Services GmbH, DE195.135.138.20 2001:1440:0:4039::53
ns05.cancom-mase.eu15.236.53.52 2a05:d012:64d:bb00:dc84:9c93:5d17:5882AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US-

Checks

  • ✓ 5 nameservers #6
    Delegated to ns01.cancom-mase.com, ns02.cancom-mase.net, ns03.cancom-mase.org, ns04.cancom-mase.de, ns05.cancom-mase.eu.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 5 IPv4 /24s and 3 IPv6 /48s.
  • ✓ 2 autonomous systems #11
    The nameservers are spread over: AS16509 (AMAZON-02 - Amazon.com, Inc., US): 4 addresses; AS8469 (PIRONETNDH-AS - CANCOM Managed Services GmbH, DE): 6 addresses.
  • ✓ Nameserver names under 5 TLDs #12
    Nameserver names use the TLDs .com, .de, .eu, .net, .org.
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

pass

10 of 10 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns01.cancom-mase.com 212.237.161.1NOERROR, 11 ms, authoritativenoyes / yesrefused-
ns01.cancom-mase.com 2001:1440:0:403a::53NOERROR, 12 ms, authoritativenoyes / yesrefused-
ns02.cancom-mase.net 195.227.141.140NOERROR, 11 ms, authoritativenoyes / yesrefused-
ns02.cancom-mase.net 2001:1440:0:4034::53NOERROR, 12 ms, authoritativenoyes / yesrefused-
ns03.cancom-mase.org 18.198.240.246NOERROR, 4 ms, authoritativenoyes / yesrefused-
ns03.cancom-mase.org 2a05:d014:30e:a800:dc84:9c93:5d17:5882NOERROR, 4 ms, authoritativenoyes / yesrefused-
ns04.cancom-mase.de 195.135.138.20NOERROR, 12 ms, authoritativenoyes / yesrefused-
ns04.cancom-mase.de 2001:1440:0:4039::53NOERROR, 12 ms, authoritativenoyes / yesrefused-
ns05.cancom-mase.eu 15.236.53.52NOERROR, 12 ms, authoritativenoyes / yesrefused-
ns05.cancom-mase.eu 2a05:d012:64d:bb00:dc84:9c93:5d17:5882NOERROR, 11 ms, authoritativenoyes / yesrefused-

Checks

  • ✓ All respond #14
    All 10 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • ✓ No version disclosed #17
    The nameservers don't reveal their software version.
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 2026100500 · primary ns01.cancom-mase.com

Found

Primary (MNAME)
ns01.cancom-mase.com
Contact (RNAME)
hostmaster.obi.de
Serial
2026100500
Refresh / retry
86400 s / 7200 s
Expire
3600000 s
Negative TTL
900 s

Serial per nameserver

NameserverSerial
ns01.cancom-mase.com (212.237.161.1)2026100500
ns01.cancom-mase.com (2001:1440:0:403a::53)2026100500
ns02.cancom-mase.net (195.227.141.140)2026100500
ns02.cancom-mase.net (2001:1440:0:4034::53)2026100500
ns03.cancom-mase.org (18.198.240.246)2026100500
ns03.cancom-mase.org (2a05:d014:30e:a800:dc84:9c93:5d17:5882)2026100500
ns04.cancom-mase.de (195.135.138.20)2026100500
ns04.cancom-mase.de (2001:1440:0:4039::53)2026100500
ns05.cancom-mase.eu (15.236.53.52)2026100500
ns05.cancom-mase.eu (2a05:d012:64d:bb00:dc84:9c93:5d17:5882)2026100500

Checks

  • ✓ Serial 2026100500 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 1d, retry 2h, expire 1000h, negative TTL 15m.
  • ✓ Primary is a public nameserver #24
    The primary nameserver ns01.cancom-mase.com is one of the listed nameservers.
  • ✓ Contact hostmaster@obi.de #25
    The SOA RNAME hostmaster.obi.de means hostmaster@obi.de.
  • ✓ Date-based serial #26
    The serial 2026100500 follows the YYYYMMDDnn convention (2026-10-05).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

49 records at the apex

Found

Read from
212.237.161.1:53
TypeValueTTL
SOAns01.cancom-mase.com. hostmaster.obi.de. 2026100500 86400 7200 3600000 90086400
NSns01.cancom-mase.com.86400
NSns05.cancom-mase.eu.86400
NSns04.cancom-mase.de.86400
NSns03.cancom-mase.org.86400
NSns02.cancom-mase.net.86400
A18.245.60.880
A18.245.60.730
A18.245.60.300
A18.245.60.440
MX5 alt2.aspmx.l.google.com.900
MX10 alt4.aspmx.l.google.com.900
MX1 aspmx.l.google.com.900
MX5 alt1.aspmx.l.google.com.900
MX10 alt3.aspmx.l.google.com.900
TXT"MS=E9A9A0B753CDE9297D0272ED3B117D8731B3A7AC"86400
TXT"adobe-idp-site-verification=5a79fc77-e026-4525-bd89-2ce53d91801a"86400
TXT"cisco-ci-domain-verification=43312e6f21ee0dc645a63dd5621bd83ddee32d044f550597230da0959ec5e162"86400
TXT"guuucnb7v7s70gqpdnjstu8h9f"86400
TXT"apple-domain-verification=PD2gokapuZ9r2uiH"86400
TXT"5514a0d67742f8065bc8e6376797f7f9c9f19bb9092fdea532f2091328b3cb90"86400
TXT"yandex-verification: 58a47a58caeef896"86400
TXT"78BREJ/rT7akPwk/0NCOBtgub8AJZEl7gbNFLXL0RlQ="86400
TXT"google-site-verification=PcZ4Z7f4qqfKgrX76sGzKJOtM5Q6gwK7A-DWsJ9ogPU"86400
TXT"mhmswtmz7xwh3ng39k8y7g0p1gpcfx4k"86400
TXT"slack-domain-verification=aCYpgbA4OYau0jHaCYxqWgfjXP9eFVDahMMSGaqL"3600
TXT"sendinblue-code: 6f1c788fba2917972d1dc3619eb83dd8"86400
TXT"l0ojk3ta3t76vds7j40ljfeht3"86400
TXT"mvc0aqhj6niqd1u9hanj18j8la"86400
TXT"google-gws-recovery-domain-verification=46299054"3600
TXT"google-site-verification=BCEZvohSLhloWlYh_1ezo2phYqC-ifH_8dk0ub_i2q4"3600
TXT"brevo-code:6f1c788fba2917972d1dc3619eb83dd8"86400
TXT"amazonses:Kik3MJbyecw17Qu9646TSYs3Dp3Bp2nk/YbYl75gG5c="86400
TXT"4h1ri94e7i5g46ihrenpakpg9e"86400
TXT"ftrll1u0o7utf5s2n1793fgrnr"86400
TXT"bw=v17xiFIfe6jzeD4on8KF9pqbF/kEAgd/2trZpSWordTF"86400
TXT"detectify-verification=bc4e1557d3d5478dda9b11872e258d6d"86400
TXT"d5unac79sd9se0jhbq3772nc26"86400
TXT"jamf-site-verification=-o9WUNd5vlPjD51R492Sfg"86400
TXT"atlassian-domain-verification=LnJF7WVnK/D0Qptua43WJAtSEdTrRqbzPH6CRZChBBaxtFBhXwIZLZPggs85BTj/"86400
TXT"docusign=1f8a3bad-18ca-43d4-b961-888cb65f4dbd"3600
TXT"docusign=f75ad870-026e-41e9-87f8-7780c31f25f4"3600
TXT"google-site-verification=KZnDtoq4wDCb4ftUbdQJK1O_EvEu5nB2cGpScLJalvA"86400
TXT"mk-org-sso-60f264d1-4f5c-4568-a179-f4c75afaa950"86400
TXT"fk5miv6ciq7pin590hu51iu1di"86400
TXT"bw=imq576XRfD66JNtlYTdytcbqriMl3MXXwGSdN1dw3BEB"86400
TXT"deepl-domain-verification=ca8063c240fe44958c681ea61d112125"86400
TXT"v=spf1 ip4:84.17.184.240/28 ip4:213.61.69.162 ip4:217.9.112.165 ip4:212.186.193.50 ip4:213.185.164.18 ip4:18.197.251.173 ip4:52.29.201.254 ip4:3.120.167.104 ip4:18.185.195.229 ip4:52.58.235.215 ip4:52.58.48.167 ip4:18.196.84.111 ip4:18.194.214.102 include" ":spf.sendinblue.com ip4:85.158.196.35 ip4:85.158.196.36 ip4:85.158.196.37 ip4:85.158.196.241 ip4:85.158.196.242 ip4:85.158.196.243 ip4:85.158.196.244 include:_spf.google.com include:mail.zendesk.com include:_spf.salesforce.com ip4:195.200.255.124 include:" "spf.codepiraten.com a:spf.mas.t-systems-service.com a:mail.datanet.de a:securemail.datanet.de ip4:80.90.150.66 ip4:80.157.1.58 include:spf-a.opntxtdns.com -all"900
TXT"anthropic-domain-verification-9jncd5=KZK4Vgh95Dug5PtpyJ83EJwI4"86400

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (0s). Low TTLs are useful just before a planned change.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35