Domain report: paramount.com

Registration

info

.com generic · MarkMonitor Inc. · expires 2027-10-28

Found

TLD: .com (generic)
ICANN policies apply: yes
Registrar: MarkMonitor Inc.
Registered: 29 October 1993
Last changed: 26 September 2026
Expires: 28 October 2027
Status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers: dns1.p09.nsone.net, dns2.p09.nsone.net, dns3.p09.nsone.net, dns4.p09.nsone.net, ns0004.secondary.cloudflare.com, ns0243.secondary.cloudflare.com
RDAP server: https://rdap.verisign.com/com/v1/

Checks

i

.com is a generic TLD (gTLD)

Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.

#1
✓ TLD delegated and signed #2

.com is delegated in the root zone and DNSSEC-signed.
✓ Expires on 2027-10-28 #3

The registration is valid until 2027-10-28 (370 days).
✓ Transfer locked #4

Registry status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
✓ Registry and delegation match #5

The nameservers registered at the registry are the ones published in DNS.

Delegation

pass

dns1.p09.nsone.net, dns2.p09.nsone.net, dns3.p09.nsone.net, dns4.p09.nsone.net, ns0004.secondary.cloudflare.com, ns0243.secondary.cloudflare.com

Found

Parent zone: com
Delegation from: a.gtld-servers.net (192.5.6.30)
NS at the parent: dns1.p09.nsone.net, dns2.p09.nsone.net, dns3.p09.nsone.net, dns4.p09.nsone.net, ns0004.secondary.cloudflare.com, ns0243.secondary.cloudflare.com
NS in the zone: dns1.p09.nsone.net, dns2.p09.nsone.net, dns3.p09.nsone.net, dns4.p09.nsone.net, ns0004.secondary.cloudflare.com, ns0243.secondary.cloudflare.com

Nameserver	Addresses	Network (AS)	Glue
dns1.p09.nsone.net	198.51.44.9 2620:4d:4000:6259:7:9:0:1	AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US	-
dns2.p09.nsone.net	198.51.45.9 2a00:edc0:6259:7:9::2	AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US	-
dns3.p09.nsone.net	198.51.44.73 2620:4d:4000:6259:7:9:0:3	AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US	-
dns4.p09.nsone.net	198.51.45.73 2a00:edc0:6259:7:9::4	AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US	-
ns0004.secondary.cloudflare.com	162.159.32.5 2606:4700:51::a29f:2005	AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US	162.159.32.5 2606:4700:51::a29f:2005
ns0243.secondary.cloudflare.com	162.159.33.118 2606:4700:59::a29f:2176	AS13335 CLOUDFLARENET - Cloudflare, Inc., US AS13335 CLOUDFLARENET - Cloudflare, Inc., US	162.159.33.118 2606:4700:59::a29f:2176

Checks

✓ 6 nameservers #6

Delegated to dns1.p09.nsone.net, dns2.p09.nsone.net, dns3.p09.nsone.net, dns4.p09.nsone.net, ns0004.secondary.cloudflare.com, ns0243.secondary.cloudflare.com.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 4 IPv4 /24s and 4 IPv6 /48s.
✓ 2 autonomous systems #11

The nameservers are spread over: AS13335 (CLOUDFLARENET - Cloudflare, Inc., US): 4 addresses; AS62597 (NSONE - NSONE Inc, US): 8 addresses.
✓ Nameserver names under 2 TLDs #12

Nameserver names use the TLDs .com, .net.
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

Nameservers

warn

12 of 12 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
dns1.p09.nsone.net 198.51.44.9	NOERROR, 8 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns1.p09.nsone.net 2620:4d:4000:6259:7:9:0:1	NOERROR, 11 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns2.p09.nsone.net 198.51.45.9	NOERROR, 8 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns2.p09.nsone.net 2a00:edc0:6259:7:9::2	NOERROR, 8 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns3.p09.nsone.net 198.51.44.73	NOERROR, 11 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns3.p09.nsone.net 2620:4d:4000:6259:7:9:0:3	NOERROR, 8 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns4.p09.nsone.net 198.51.45.73	NOERROR, 5 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
dns4.p09.nsone.net 2a00:edc0:6259:7:9::4	NOERROR, 5 ms, authoritative	no	yes / yes	refused	19dd46e347df36b70933bf2be8023258586586a9
ns0004.secondary.cloudflare.com 162.159.32.5	NOERROR, 5 ms, authoritative	no	yes / yes	refused	2026.10.2
ns0004.secondary.cloudflare.com 2606:4700:51::a29f:2005	NOERROR, 5 ms, authoritative	no	yes / yes	refused	2026.10.2
ns0243.secondary.cloudflare.com 162.159.33.118	NOERROR, 9 ms, authoritative	no	yes / yes	refused	2026.10.2
ns0243.secondary.cloudflare.com 2606:4700:59::a29f:2176	NOERROR, 9 ms, authoritative	no	yes / yes	refused	2026.10.2

Checks

✓ All respond #14

All 12 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
!

Software version disclosed

These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: ns0004.secondary.cloudflare.com: "2026.10.2"; ns0243.secondary.cloudflare.com: "2026.10.2". Hide or replace the version string.

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

warn

serial 1654943220 · primary dns1.p09.nsone.net

Found

Primary (MNAME): dns1.p09.nsone.net
Contact (RNAME): hostmaster.nsone.net
Serial: 1654943220
Refresh / retry: 600 s / 600 s
Expire: 1209600 s
Negative TTL: 3600 s

Serial per nameserver

Nameserver	Serial
dns1.p09.nsone.net (198.51.44.9)	1654943220
dns1.p09.nsone.net (2620:4d:4000:6259:7:9:0:1)	1654943220
dns2.p09.nsone.net (198.51.45.9)	1654943220
dns2.p09.nsone.net (2a00:edc0:6259:7:9::2)	1654943220
dns3.p09.nsone.net (198.51.44.73)	1654943220
dns3.p09.nsone.net (2620:4d:4000:6259:7:9:0:3)	1654943220
dns4.p09.nsone.net (198.51.45.73)	1654943220
dns4.p09.nsone.net (2a00:edc0:6259:7:9::4)	1654943220
ns0004.secondary.cloudflare.com (162.159.32.5)	1654943220
ns0004.secondary.cloudflare.com (2606:4700:51::a29f:2005)	1654943220
ns0243.secondary.cloudflare.com (162.159.33.118)	1654943220
ns0243.secondary.cloudflare.com (2606:4700:59::a29f:2176)	1654943220

Checks

✓ Serial 1654943220 everywhere #22

All nameservers serve the same version of the zone.
!

Unusual SOA timers

refresh 10m is outside 20m–1d; retry 10m should be shorter than refresh 10m. Current values: refresh 10m, retry 10m, expire 14d, negative TTL 1h.

#23
✓ Primary is a public nameserver #24

The primary nameserver dns1.p09.nsone.net is one of the listed nameservers.
✓ Contact hostmaster@nsone.net #25

The SOA RNAME hostmaster.nsone.net means hostmaster@nsone.net.
✓ Timestamp serial #26

The serial 1654943220 is a Unix timestamp (2022-06-11 10:27 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

pass

103 records at the apex

Found

Read from: 198.51.44.9:53

Type	Value	TTL
SOA	dns1.p09.nsone.net. hostmaster.nsone.net. 1654943220 600 600 1209600 3600	86400
NS	dns1.p09.nsone.net.	86400
NS	dns2.p09.nsone.net.	86400
NS	dns3.p09.nsone.net.	86400
NS	dns4.p09.nsone.net.	86400
NS	ns0004.secondary.cloudflare.com.	86400
NS	ns0243.secondary.cloudflare.com.	86400
A	13.248.160.137	3600
A	76.223.34.124	3600
MX	10 mxa-00262c01.gslb.pphosted.com.	300
MX	10 mxb-00262c01.gslb.pphosted.com.	300
MX	20 mx0b-00262c01.pphosted.com.	300
MX	20 mx0a-00262c01.pphosted.com.	300
TXT	"v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com include:_netblocks.viacom.com include:spf.protection.outlook.com include:servers.mcsv.net a:c.spf.service-now.com include:et._spf.pardot.com include:mail.zendesk.com include:smtp.app.echomark.com ~all"	120
TXT	"nqTA6wYS9vAxkENGjP0MYTZSbcK/FiphuFvqkjruM/JS5YdBU1hKQOHiuqFxHKRH/t4oA6GKdIjD7DjMsb4W3Q=="	120
TXT	"MS=ms93353093"	120
TXT	"atlassian-domain-verification=E+wiTTQbdi+aIBlOe7MvMyDmxBdCed/oDG6hRZquh5QIu+JegSoM3VH8Fof+kOz6"	120
TXT	"v=msv1 t=F4A58993-A138-4F29-BADB-170CF3A9E779"	120
TXT	"fCt698S/G4QwV/LbxgR9U0i2MrZ29D0S2igCVmih1tEV/Sy+z3rD8BzCr4qTe+0BPcXZhuVc7aAkanQnwDV0vg=="	120
TXT	"docusign=40044c74-ba1f-463e-b87a-c4f172912cd1"	120
TXT	"onetrust-domain-verification=0aea1d6cacf74f468a9b7fb2e6e69faf"	120
TXT	"docusign=5325d27d-5bd3-404e-99f0-042f85954ae0"	120
TXT	"apple-domain-verification=CA9nRLZIrWbwJYiZ"	120
TXT	"flexera-domain-verification-wrbrmwrxkxdauhmi"	120
TXT	"onetrust-domain-verification=e26530ee19fd42a2ad984756df53db0d"	120
TXT	"appspace-domain-verification=95717daa24b5c09519b505de173a1b8d2d0d37ec64cb70ce7d6fde2847c72bca"	120
TXT	"2lfg9qk9d7l0fo76dmsnren5l5"	120
TXT	"wiz-domain-verification=6fd13e7cdaff683d7d119656d141ce4e9caeec911c829518efb28e9acbf43323"	120
TXT	"onetrust-domain-verification=91ebabf2cd4d42a582b279896decfe60"	120
TXT	"edisen-verification-key=8f029dc6-1fd2-4bdc-8ee5-073a334f3eaa"	120
TXT	"google-gws-recovery-domain-verification=41403009"	120
TXT	"atlassian-sending-domain-verification=ae08c2c6-2020-4935-a227-fc8a4fbac4e2"	120
TXT	"google-site-verification=L0j1Oua7r3P1DPaSuf7URZ91J6PQPKwUoxfoUSzZ4dw"	120
TXT	"docker-verification=596ab5bd-b50e-4e16-bed2-13146dd269c4"	120
TXT	"htjqrqxdntswxbgtbwwrjw3p809y04w4"	120
TXT	"fastly-domain-delegation-pp9t9nwcdibabjmivaqq-567265-2023-01-25"	120
TXT	"sending_domain873291=c9e128c35ffc904a10fe1ac709498a50b4b3862a2a8e0d6828083f2e8f2b5368"	120
TXT	"zapier-domain-verification-challenge=d41edf8b-6fe5-4bc2-a09f-6e19a3d1e561"	120
TXT	"miro-verification=1e01f8da769be1241fceefd9abf2c317dcd68323"	120
TXT	"mandrill_verify.g1wZXKP3lBYYCq-0r3Km6w"	120
TXT	"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrLHiExVd55zd/IQ/J/mRwSRMAocV/hMB3jXwaHH36d9NaVynQFYV8NaWi69c1veUtRzGt7yAioXqLj7Z4TeEUoOLgrKsn8YnckGs9i3B3tVFB+Ch/4mPhXWiNfNdynHWBcPcbJ8kjEQ2U8y78dHZj1YeRXXVvWob2OaKynO8/lQIDAQAB;"	120
TXT	"mongodb-site-verification=S4lk8yD2yDGqgYYsM0Sb47OOmtRulXU2"	120
TXT	"mongodb-site-verification=O8XvBn4BtBEykZiZvCsVZDTtX9emIWqz"	120
TXT	"pardot873291=97b3ced0abc14627873d586b94bf4d89758d3fc8ac2022dd43aced31ee82d641"	120
TXT	"google-site-verification=fh3sj8xpUdoOlCa8iUxrnEEmouL-A0lTbQb3wP4T-Ak"	120
TXT	"postman-domain-verification=a0ea2072cff6f69c4fbe6717a632b0c7a15889d87d2da77e11909d7e8bb3ba803a80d40daacc4c3a76d4a5f283b068db35d84082ff7e41821de42c997e78b996"	120
TXT	"smartsheet-site-validation=Rdl7IUINBtNWKsa6wd3Mium1D6cl0iPS"	120
TXT	"autodesk-domain-verification=M3mXoTw53n3dOQaobatN"	120
TXT	"autodesk-domain-verification=9gcLtPfq1SBxE_HmL0wi"	120
TXT	"mongodb-site-verification=DEW7mDk0Zx3JSB9LTVJKfITyaJlC26Lm"	120
TXT	"y9kn97kf46mnl8vfpk6rmc6bk5vnsnzs"	120
TXT	" eudgtb2qf9l0tqr0gmq737hqv2 "	120
TXT	"sending_domain1068592=a4bf2f064d8a59d584c6db0cfccb0aecf92075ee30a2d97f0b3096a72b21db64"	120
TXT	"00d8c0000083agaeai"	120
TXT	"pardot1068592=d9ab4c8de5af3a4151168cd81138c52d4b476efbd0d125519cdd9f40b5784740"	120
TXT	"openai-domain-verification=dv-v20U7A1nVRkSENh3Xi5aZ8iT"	120
TXT	"_mgu60aqp5wsxunyjr0xu84i2pq5kyeq"	120
TXT	"successfactors-site-verification=Yjg1MjAwNThhMWE3OTAwNjI0NTA2MzFjZDM5ZTdmNDQ4OTI3YjI1NjA4YTMzZDNlM2RmZGJlYTA3ZDliMTNkZg=="	120
TXT	"wombat-verification=3KwxVCQV1HEp-aRXRTKKaZ5G0frhk"	120
TXT	"jumpdesktop=bd1f4ef76bcca6e378e4e84901b430143137693c75dcfca3d3cf8828757d"	120
TXT	"intersight=4eeede849b350d28bab871540591cb6798d2adf6de76b7494efa476d343f7f99"	120
TXT	"qtibf5uh2lij90jntu7a966iug"	120
TXT	"ku4k4ttu80f0ad6puat57jvb3m"	120
TXT	"jamf-site-verification=6L9yM9lBMk4WTEP9wzkcIQ"	120
TXT	"smartsheet-site-validation=1m0sjmUKKkHAS4c0sHzLK_fGrE1y5IE9"	120
TXT	"parallels-domain-verification=19f7e985539e42cca485ea9a8dc3dd94c6f9931d85d8423b8ecef69756834710"	120
TXT	"_v0fa5c46ljga3dl12il4va1xxtedjx8"	120
TXT	"cursor-domain-verification-2vmq3k=MpgHlmjz5z1umdT7G5qS4BGsr"	120
TXT	"TAILSCALE-ZlWPbfUFvX5RVmqdWWNl"	120
TXT	"hpe-greenlake-domain-verification=44724c3858497470526b50306c54743348383433626c455366444f7955754668"	120
TXT	"include:sendgrid.net ip4:149.72.251.202 ip4:149.72.63.221"	120
TXT	"elevenlabs=faPwC2pMHcAD_9v_dWGSPvNh3QpdgUeclYfyYjaSjes"	120
TXT	" 3alfm4lqlr1nvigrjhpv947ku1 "	120
TXT	"anthropic-domain-verification-0wv6j3=sOGAQtN35ANml3NNqQbZetnhv"	120
TXT	"mongodb-site-verification=1Q7yMbqhHv65HpPHQBTapWVwFZl5fiDb"	120
TXT	"bluebeam-verification=xo6p1zqtqt109qielj3c1jsz551pfn"	120
TXT	"lucidlink-verification=8428FY4ME00710H7DMW02J0XX0"	120
TXT	"smartsheet-site-validation=UyHO2Nzp9RDmw_yA6u52Sw4Sg9VjjqYo"	120
TXT	"echomark-domain-verification=019e8f4f-f967-77ed-874a-842c7c126b7f"	120
TXT	"google-site-verification=LJt717g40TMYU-shK4jEj1MDrgLuGbBftBA-fpe0wxc"	120
TXT	"YT8d827AaAdcqGLaxqGa"	120
TXT	"smartsheet-site-validation=AhPZQ5QEapBQuWiXQswVI3dqUCLEfKAh"	120
TXT	"pardot1185121=f1ef1258bab504a8cfdbeb620b0d01ed46965a8683d1707f06c647e7e4266ffe"	120
CAA	0 issue "letsencrypt.org"	600
CAA	0 issue "sectigo.com"	600
CAA	0 issue "godaddy.com"	600
CAA	0 issue "starfieldtech.com"	600
CAA	0 issue "comodoca.com"	600
CAA	0 issue "trust-provider.com"	600
CAA	0 issue "usertrust.com"	600
CAA	0 issue "digicert.com"	600
CAA	0 issue "amazon.com"	600
CAA	0 issuewild "letsencrypt.org"	600
CAA	0 issuewild "sectigo.com"	600
CAA	0 issuewild "godaddy.com"	600
CAA	0 issuewild "starfieldtech.com"	600
CAA	0 issuewild "comodoca.com"	600
CAA	0 issuewild "trust-provider.com"	600
CAA	0 issuewild "usertrust.com"	600
CAA	0 issuewild "digicert.com"	600
CAA	0 issuewild "amazon.com"	600
CAA	0 issue "pki.goog"	600
CAA	0 issuewild "pki.goog"	600

Checks

✓ TTLs within range #32

TTLs: A 1h, MX 5m, NS 1d. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
✓ CAA restricts issuance #35

Certificates may be issued by: letsencrypt.org, sectigo.com, godaddy.com, starfieldtech.com, comodoca.com, trust-provider.com, usertrust.com, digicert.com, amazon.com, pki.goog.