opendns.com

Checked 22 October 2026, 10:10 UTC · via 8.8.8.8
!Passed with warnings
25 passed 2 warnings 0 failed 4 info

Registration

info

.com generic · PDR Ltd. d/b/a PublicDomainRegistry.com · expires 2027-09-04

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
PDR Ltd. d/b/a PublicDomainRegistry.com
Registered
4 September 2003
Last changed
10 August 2026
Expires
4 September 2027
Status
client transfer prohibited
Registry nameservers
auth1.opendns.com, auth2.opendns.com, auth3.opendns.com
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-09-04 #3
    The registration is valid until 2027-09-04 (317 days).
  • ✓ Transfer locked #4
    Registry status: client transfer prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

auth1.opendns.com, auth2.opendns.com, auth3.opendns.com

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
auth1.opendns.com, auth2.opendns.com, auth3.opendns.com
NS in the zone
auth1.opendns.com, auth2.opendns.com, auth3.opendns.com
NameserverAddressesNetwork (AS)Glue
auth1.opendns.com208.69.39.2 2620:119:30::53AS36692 CISCO-UMBRELLA - Cisco OpenDNS, LLC, US AS36692 CISCO-UMBRELLA - Cisco OpenDNS, LLC, US208.69.39.2 2620:119:30::53
auth2.opendns.com146.112.60.53 2a04:e4c0:53::53AS36692 CISCO-UMBRELLA - Cisco OpenDNS, LLC, US AS36692 CISCO-UMBRELLA - Cisco OpenDNS, LLC, US146.112.60.53 2a04:e4c0:53::53
auth3.opendns.com208.69.39.2AS36692 CISCO-UMBRELLA - Cisco OpenDNS, LLC, US208.69.39.2

Checks

  • ✓ 3 nameservers #6
    Delegated to auth1.opendns.com, auth2.opendns.com, auth3.opendns.com.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ Glue present and correct #8
    Glue is published for the nameservers inside the zone: auth1.opendns.com, auth2.opendns.com, auth3.opendns.com.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 2 IPv4 /24s and 2 IPv6 /48s.
  • i
    All nameservers in one AS
    All nameserver addresses are announced by one network operator (AS36692 (CISCO-UMBRELLA - Cisco OpenDNS, LLC, US): 5 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.
    #11
  • i
    All nameserver names under .com
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • i
    Partly IPv6
    These nameservers have no IPv6 address: auth3.opendns.com.
    #13

Nameservers

pass

5 of 5 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
auth1.opendns.com 208.69.39.2NOERROR, 4 ms, authoritativenoyes / yesrefused-
auth1.opendns.com 2620:119:30::53NOERROR, 5 ms, authoritativenoyes / yesrefused-
auth2.opendns.com 146.112.60.53NOERROR, 4 ms, authoritativenoyes / yesrefused-
auth2.opendns.com 2a04:e4c0:53::53NOERROR, 10 ms, authoritativenoyes / yesrefused-
auth3.opendns.com 208.69.39.2NOERROR, 4 ms, authoritativenoyes / yesrefused-

Checks

  • ✓ All respond #14
    All 5 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • ✓ No version disclosed #17
    The nameservers don't reveal their software version.
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

warn

serial 1792663735 · primary auth1.opendns.com

Found

Primary (MNAME)
auth1.opendns.com
Contact (RNAME)
noc.opendns.com
Serial
1792663735
Refresh / retry
16384 s / 2048 s
Expire
1048576 s
Negative TTL
2560 s

Serial per nameserver

NameserverSerial
auth1.opendns.com (208.69.39.2)1792663735
auth1.opendns.com (2620:119:30::53)1792663814
auth2.opendns.com (146.112.60.53)1792663669
auth2.opendns.com (2a04:e4c0:53::53)1792663680
auth3.opendns.com (208.69.39.2)1792663654

Checks

  • !
    Serials differ
    The nameservers serve different versions of the zone: 1792663654 on auth3.opendns.com (208.69.39.2); 1792663669 on auth2.opendns.com (146.112.60.53); 1792663680 on auth2.opendns.com (2a04:e4c0:53::53); 1792663735 on auth1.opendns.com (208.69.39.2); 1792663814 on auth1.opendns.com (2620:119:30::53). This is normal for a few minutes after a change; if it lasts, zone transfers to the secondaries are failing.
    #22
  • ✓ Timers within recommendations #23
    SOA refresh 4h33m4s, retry 34m8s, expire 291h16m16s, negative TTL 42m40s.
  • ✓ Primary is a public nameserver #24
    The primary nameserver auth1.opendns.com is one of the listed nameservers.
  • ✓ Contact noc@opendns.com #25
    The SOA RNAME noc.opendns.com means noc@opendns.com.
  • ✓ Timestamp serial #26
    The serial 1792663735 is a Unix timestamp (2026-10-22 10:08 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

pass

24 records at the apex

Found

Read from
208.69.39.2:53
TypeValueTTL
SOAauth1.opendns.com. noc.opendns.com. 1792663691 16384 2048 1048576 256086400
NSauth1.opendns.com.604800
NSauth2.opendns.com.604800
NSauth3.opendns.com.604800
A146.112.62.105300
MX30 aer-mx-01.cisco.com.3600
MX10 alln-mx-01.cisco.com.3600
MX20 rcdn-mx-01.cisco.com.3600
TXT"8a0qMBOOpB-h4tuZsbRSOi00ZA"3600
TXT"docusign=2dcbb085-bb7f-44b2-8cdd-c9a93a8c0514"120
TXT"google-site-verification=1uqoSSYwOE4E7Vue1oAcKDmEt6yn5US6vuQ6shGu2dg"120
TXT"google-site-verification=VXNIemKQVGZ9Q3215ANNzcTDK5ZejVDwd6RQsQ2u1GI"120
TXT"identrust_validate=5sxUJXEBNGIryr9TcBm31oSDJsqEiIkNIodAE18dD/xn"3600
TXT"identrust_validate=dkFEA7jD1kBR9Uo9E25VVSRjPfhYSFMdX3sUWoWG28Mv"3600
TXT"v=spf1 ptr include:_nets.opendns.com include:mail.zendesk.com include:amazonses.com include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ip4:173.37.147.246 ip4:173.37.147.247 ip4:72.163.7.179 ip4:72.163.7.180 ip4:192" ".28.150.255 ?all"120
TXT"_qhmqsb0grgjeq03vl0tvsnhchg7seuf"3600
CAA0 issue "amazon.com"3600
CAA0 issue "amazonaws.com"3600
CAA0 issue "amazontrust.com"3600
CAA0 issue "awstrust.com"3600
CAA0 issue "digicert.com"3600
CAA0 issue "identrust.com"3600
CAA0 issue "letsencrypt.org"3600
CAA0 issue "quovadisglobal.com"3600

Checks

  • ✓ TTLs within range #32
    TTLs: A 5m, MX 1h, NS 7d. The NS TTL at the parent is 2d and in the zone 7d; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • ✓ CAA restricts issuance #35
    Certificates may be issued by: amazon.com, amazonaws.com, amazontrust.com, awstrust.com, digicert.com, identrust.com, letsencrypt.org, quovadisglobal.com.