Domain report: paychex.com

Registration

info

.com generic · MarkMonitor Inc. · expires 2029-06-09

Found

TLD: .com (generic)
ICANN policies apply: yes
Registrar: MarkMonitor Inc.
Registered: 10 June 1991
Last changed: 7 March 2025
Expires: 9 June 2029
Status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers: a1-21.akam.net, a12-65.akam.net, a16-64.akam.net, a2-64.akam.net, a7-66.akam.net, a9-64.akam.net
RDAP server: https://rdap.verisign.com/com/v1/

Checks

i

.com is a generic TLD (gTLD)

Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.

#1
✓ TLD delegated and signed #2

.com is delegated in the root zone and DNSSEC-signed.
✓ Expires on 2029-06-09 #3

The registration is valid until 2029-06-09 (960 days).
✓ Transfer locked #4

Registry status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
✓ Registry and delegation match #5

The nameservers registered at the registry are the ones published in DNS.

Delegation

info

a1-21.akam.net, a12-65.akam.net, a16-64.akam.net, a2-64.akam.net, a7-66.akam.net, a9-64.akam.net

Found

Parent zone: com
Delegation from: a.gtld-servers.net (192.5.6.30)
NS at the parent: a1-21.akam.net, a12-65.akam.net, a16-64.akam.net, a2-64.akam.net, a7-66.akam.net, a9-64.akam.net
NS in the zone: a1-21.akam.net, a12-65.akam.net, a16-64.akam.net, a2-64.akam.net, a7-66.akam.net, a9-64.akam.net

Nameserver	Addresses	Network (AS)	Glue
a1-21.akam.net	193.108.91.21 2600:1401:2::15	AS20940 AKAMAI-ASN1 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a12-65.akam.net	184.26.160.65 2600:1480:f000::41	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a16-64.akam.net	23.211.132.64 2600:1406:1b::40	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a2-64.akam.net	95.100.174.64 2600:1480:7000::40	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a7-66.akam.net	23.61.199.66 2600:1406:32::42	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a9-64.akam.net	184.85.248.64 2a02:26f0:117::40	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-

Checks

✓ 6 nameservers #6

Delegated to a1-21.akam.net, a12-65.akam.net, a16-64.akam.net, a2-64.akam.net, a7-66.akam.net, a9-64.akam.net.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 6 IPv4 /24s and 6 IPv6 /48s.
✓ 2 autonomous systems #11

The nameservers are spread over: AS20940 (AKAMAI-ASN1 - Akamai International B.V., NL): 1 address; AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 11 addresses.
i

All nameserver names under .net

All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

#12
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

Nameservers

warn

12 of 12 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
a1-21.akam.net 193.108.91.21	NOERROR, 3 ms, authoritative	no	yes / yes	refused	41824.8
a1-21.akam.net 2600:1401:2::15	NOERROR, 3 ms, authoritative	no	yes / yes	refused	41824.8
a12-65.akam.net 184.26.160.65	NOERROR, 6 ms, authoritative	no	yes / yes	refused	48878.31
a12-65.akam.net 2600:1480:f000::41	NOERROR, 6 ms, authoritative	no	yes / yes	refused	48878.32
a16-64.akam.net 23.211.132.64	NOERROR, 3 ms, authoritative	no	yes / yes	refused	48878.31
a16-64.akam.net 2600:1406:1b::40	NOERROR, 4 ms, authoritative	no	yes / yes	refused	48878.27
a2-64.akam.net 95.100.174.64	NOERROR, 5 ms, authoritative	no	yes / yes	refused	48878.32
a2-64.akam.net 2600:1480:7000::40	NOERROR, 4 ms, authoritative	no	yes / yes	refused	48878.26
a7-66.akam.net 23.61.199.66	NOERROR, 6 ms, authoritative	no	yes / yes	refused	41824.11
a7-66.akam.net 2600:1406:32::42	NOERROR, 6 ms, authoritative	no	yes / yes	refused	41824.4
a9-64.akam.net 184.85.248.64	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.11
a9-64.akam.net 2a02:26f0:117::40	NOERROR, 5 ms, authoritative	no	yes / yes	refused	41824.9

Checks

✓ All respond #14

All 12 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
!

Software version disclosed

These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: a1-21.akam.net: "41824.8"; a12-65.akam.net: "48878.31"; a12-65.akam.net: "48878.32"; a16-64.akam.net: "48878.31"; a16-64.akam.net: "48878.27"; a2-64.akam.net: "48878.32"; a2-64.akam.net: "48878.26"; a7-66.akam.net: "41824.11"; a7-66.akam.net: "41824.4"; a9-64.akam.net: "41824.11"; a9-64.akam.net: "41824.9". Hide or replace the version string.

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

warn

serial 2024072615 · primary dnssoa.paychex.com

Found

Primary (MNAME): dnssoa.paychex.com
Contact (RNAME): network_engineering.paychex.com
Serial: 2024072615
Refresh / retry: 300 s / 180 s
Expire: 604800 s
Negative TTL: 300 s

Serial per nameserver

Nameserver	Serial
a1-21.akam.net (193.108.91.21)	2024072615
a1-21.akam.net (2600:1401:2::15)	2024072615
a12-65.akam.net (184.26.160.65)	2024072615
a12-65.akam.net (2600:1480:f000::41)	2024072615
a16-64.akam.net (23.211.132.64)	2024072615
a16-64.akam.net (2600:1406:1b::40)	2024072615
a2-64.akam.net (95.100.174.64)	2024072615
a2-64.akam.net (2600:1480:7000::40)	2024072615
a7-66.akam.net (23.61.199.66)	2024072615
a7-66.akam.net (2600:1406:32::42)	2024072615
a9-64.akam.net (184.85.248.64)	2024072615
a9-64.akam.net (2a02:26f0:117::40)	2024072615

Checks

✓ Serial 2024072615 everywhere #22

All nameservers serve the same version of the zone.
!

Unusual SOA timers

refresh 5m is outside 20m–1d. Current values: refresh 5m, retry 3m, expire 7d, negative TTL 5m.

#23
i

Hidden master

The primary nameserver dnssoa.paychex.com is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.

#24
✓ Contact network_engineering@paychex.com #25

The SOA RNAME network_engineering.paychex.com means network_engineering@paychex.com.
✓ Date-based serial #26

The serial 2024072615 follows the YYYYMMDDnn convention (2024-07-26).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

warn

51 records at the apex

Found

Read from: 193.108.91.21:53

Type	Value	TTL
SOA	dnssoa.paychex.com. network_engineering.paychex.com. 2024072615 300 180 604800 300	300
NS	a7-66.akam.net.	0
NS	a9-64.akam.net.	0
NS	a2-64.akam.net.	0
NS	a1-21.akam.net.	0
NS	a16-64.akam.net.	0
NS	a12-65.akam.net.	0
A	141.123.222.0	30
A	141.123.122.0	30
MX	5 mxa-0018d001.gslb.pphosted.com.	3600
MX	5 mxb-0018d001.gslb.pphosted.com.	3600
TXT	"_n8wr6gvfxrv7oeavol3fd7sdxzaq0sz"	3600
TXT	"webexdomainverification.4C675B8B2CBEB136E053AB06FC0A3F65=f8608121-9c32-40c9-a635-c308800ef40f"	3600
TXT	"_ldwzhd675if1q9el8gt6nc42iwgdb79"	3600
TXT	"_globalsign-domain-verification=ln6G6qMbrMeJLZSOGjjxis2fcs9NHicunfT-JK_mCZ"	3600
TXT	"mongodb-site-verification=mgxrhoBPzn2iy3CPLd7rtwdfglmZHW98"	3600
TXT	"&I7#^7BTr2jm7izpwwD78FLxBD^tvZgh#QkNia7b#82bncV1y9Og&Jut&PUWcTMMq3l%LoDIHdIyFk*@%Yh%YTeDoOJ#h6F%dMD"	3600
TXT	"webexdomainverification.4C675B877D85B136E053AB06FC0A3F65=425bda8b-ece4-455a-8470-8c342459baed"	3600
TXT	"webexdomainverification.4C675B88DDE7B136E053AB06FC0A3F65=348f0e31-9e4d-41cd-a69c-2c049482ab4e"	3600
TXT	"webexdomainverification.4C675B8AB05CB136E053AB06FC0A3F65=a116205b-69c2-4275-8ae4-5b03245b90af"	3600
TXT	"google-site-verification=aO2KFau3D3oReP21skud5avXafihv_GOb2rRGa3CX98"	3600
TXT	"smartsheet-site-validation=HjBvWrV0WsqK_eTacK6sSdAR3LHirK5T"	3600
TXT	"adobe-idp-site-verification=f8b0df720e80daa3fa586bb2b10262e47a9f9a6cad77fc15fcdc28a8f365bcb9"	3600
TXT	"cursor-domain-verification-1emfvf=8vMU2uCZMXPxbDMuIkD1PX02E"	3600
TXT	"anthropic-domain-verification-enm1m5=IZJh5h6ArH5OW8DD6MJl5zdsR"	3600
TXT	"google-site-verification=coCQRcoz3wHg4X-z3KDd-Z7qpaxuztIeyflB3O3h9VM"	3600
TXT	"webexdomainverification.4C675B879F16B136E053AB06FC0A3F65=2b6105de-f774-4581-87a0-694c1fff9df8"	3600
TXT	"atlassian-domain-verification=0QmI9ItHGZlUap4jzxHGe/ciIDvUY74g9NCHEGJ4bVZqrNlS0abnyIG7y2QFir4v"	3600
TXT	"webexdomainverification.4C675B8AEC06B136E053AB06FC0A3F65=8d247669-7fcc-478d-8447-f6cddba8a5e5"	3600
TXT	"miro-verification=aa3f6ec2da5c0b428cc0a584f9a3dee5cd726c26"	3600
TXT	"docusign=a7aebf2f-f0f7-424e-80ac-4a5fe5091a05"	3600
TXT	"atlassian-sending-domain-verification=f9522ff3-1855-4859-a88c-b8ac26789639"	3600
TXT	"yahoo-verification-key=jr5lqyVsx4xhl/fl2E1cRSyWbkaV2ia3160IzoCGxE8="	3600
TXT	"jamf-site-verification=AX1vZUkTXdsazs7vwESNoQ"	3600
TXT	"pendo-domain-verification=ZOSYLW5M8Qg9LGDF4LFTXhq9kHo"	3600
TXT	"reachdesk-verification=BPtyRgWCNUbWLtYaP4hYXiQtUEp0fDwsRiEvcNkn2bHgb8pbMuz6JYnZdLHED8C2"	3600
TXT	"scph0416._domainkey.paychex.com"	3600
TXT	"astro-domain-verification=cm2erxmv10o7901mgec7u801c"	3600
TXT	"apple-domain-verification=EIPPSo35BVITdvu6"	3600
TXT	"drift-domain-verification=288b79ec271af46e91b2db8e8821ec1ed4b85e0671853fe53820d93034e6cf22"	3600
TXT	"MS=ms47634397"	3600
TXT	"v=spf1 ip4:148.163.157.161 ip4:148.163.159.161 ip4:54.240.47.53 ip4:54.240.47.54 ip4:142.0.186.100 ip4:142.0.180.105 include:spf.clearslide.com include:spf.protection.outlook.com include:spf.constantcontact.com include:sendgrid.net" " include:amazonses.com include:mktomail.com ptr:appriver.com ~all"	3600
TXT	"naAG3zjC4aycf1Sr7srA"	3600
TXT	"appspace-domain-verification=61e37a4fefb4914af1e121cf3c37b0c549ebf6575e6f04e0f382fa807ddf3196"	3600
TXT	"webexdomainverification.4C675B8B638DB136E053AB06FC0A3F65=506ea7b8-5b52-48a5-8581-fa6df11e65c1"	3600
TXT	"ciscocidomainverification=2f6d13de54025e14804a6b5145993d8c8dcca8d0e1329e819cea5f5181f49133"	3600
TXT	"webexdomainverification.=d3054b58-cec4-4e25-a6f3-57db681efc24"	3600
TXT	"google-site-verification=Q9eoGUqbxPmtDS7SWDV2crEPbgHvqsYf9CLtYOjPanw"	3600
TXT	"webexdomainverification.4C675B879650B136E053AB06FC0A3F65=0481cb94-dad5-4d67-bc4b-a5396c66b4f8"	3600
TXT	"xOe8BR0xoPo5oSu_7KVrCjxdL_anrpE"	3600
TXT	"adobe-idp-site-verification=dd84886cfc8124b3f75b32c419c1604af6ace628d17613d71caaf16a12768f79"	3600

Checks

!

Very low TTLs

These records have a TTL below 5m, causing extra queries and slower lookups: A (30s), NS (0s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 0s; resolvers may use either.

#32
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35