Domain report: penguinrandomhouse.de

Registration

info

.de country-code

Found

TLD: .de (country-code)
ICANN policies apply: no

Checks

i

.de is a country-code TLD (ccTLD)

Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.

#1
✓ TLD delegated and signed #2

.de is delegated in the root zone and DNSSEC-signed.
i

Registration data not available

No registration data via RDAP: the registry of .de offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.

#3

Delegation

info

dns009.arvato-systems.de, dns017.arvato-systems.de, ns1.arvato-systems.de, ns2.arvato-systems.de

Found

Parent zone: de
Delegation from: a.nic.de (194.0.0.53)
NS at the parent: dns009.arvato-systems.de, dns017.arvato-systems.de, ns1.arvato-systems.de, ns2.arvato-systems.de
NS in the zone: dns009.arvato-systems.de, dns017.arvato-systems.de, ns1.arvato-systems.de, ns2.arvato-systems.de

Nameserver	Addresses	Network (AS)	Glue
dns009.arvato-systems.de	193.189.249.157	AS6805 TDDE-ASN1 - Telefonica Germany GmbH & Co.OHG, DE	193.189.249.157
dns017.arvato-systems.de	84.17.190.100	AS33873 arvato-systems-AS - Arvato Systems GmbH, DE	84.17.190.100
ns1.arvato-systems.de	84.17.168.69 2a01:4a8:3222:2222::10	AS33873 arvato-systems-AS - Arvato Systems GmbH, DE AS33873 arvato-systems-AS - Arvato Systems GmbH, DE	84.17.168.69 2a01:4a8:3222:2222::10
ns2.arvato-systems.de	109.235.143.148 2a01:4a8:2222:2222::11	AS33873 arvato-systems-AS - Arvato Systems GmbH, DE AS33873 arvato-systems-AS - Arvato Systems GmbH, DE	109.235.143.148 2a01:4a8:2222:2222::11

Checks

✓ 4 nameservers #6

Delegated to dns009.arvato-systems.de, dns017.arvato-systems.de, ns1.arvato-systems.de, ns2.arvato-systems.de.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 4 IPv4 /24s and 2 IPv6 /48s.
✓ 2 autonomous systems #11

The nameservers are spread over: AS33873 (arvato-systems-AS - Arvato Systems GmbH, DE): 5 addresses; AS6805 (TDDE-ASN1 - Telefonica Germany GmbH & Co.OHG, DE): 1 address.
i

All nameserver names under .de

All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

#12
i

Partly IPv6

These nameservers have no IPv6 address: dns009.arvato-systems.de, dns017.arvato-systems.de.

#13

Nameservers

warn

6 of 6 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
dns009.arvato-systems.de 193.189.249.157	NOERROR, 10 ms, authoritative	no	yes / yes	refused	42
dns017.arvato-systems.de 84.17.190.100	NOERROR, 9 ms, authoritative	no	yes / yes	refused	PowerDNS Authoritative Server 4.1.0 (built Nov 30 2017 10:13:06 by mockbuild@jenkins.monshouwer.eu)
ns1.arvato-systems.de 84.17.168.69	NOERROR, 15 ms, authoritative	no	yes / yes	refused	https://www.youtube.com/watch?v=7qnd-hdmgfk
ns1.arvato-systems.de 2a01:4a8:3222:2222::10	NOERROR, 15 ms, authoritative	no	yes / yes	refused	https://www.youtube.com/watch?v=7qnd-hdmgfk
ns2.arvato-systems.de 109.235.143.148	NOERROR, 9 ms, authoritative	no	yes / yes	refused	https://www.youtube.com/watch?v=7qnd-hdmgfk
ns2.arvato-systems.de 2a01:4a8:2222:2222::11	NOERROR, 9 ms, authoritative	no	yes / yes	refused	https://www.youtube.com/watch?v=7qnd-hdmgfk

Checks

✓ All respond #14

All 6 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
!

Software version disclosed

These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: dns017.arvato-systems.de: "PowerDNS Authoritative Server 4.1.0 (built Nov 30 2017 10:13:06 by mockbuild@jenkins.monshouwer.eu)". Hide or replace the version string.

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

pass

serial 2026101400 · primary dns009.arvato-systems.de

Found

Primary (MNAME): dns009.arvato-systems.de
Contact (RNAME): hostmaster.bnic.bertelsmann.de
Serial: 2026101400
Refresh / retry: 3600 s / 1800 s
Expire: 3600000 s
Negative TTL: 3600 s

Serial per nameserver

Nameserver	Serial
dns009.arvato-systems.de (193.189.249.157)	2026101400
dns017.arvato-systems.de (84.17.190.100)	2026101400
ns1.arvato-systems.de (84.17.168.69)	2026101400
ns1.arvato-systems.de (2a01:4a8:3222:2222::10)	2026101400
ns2.arvato-systems.de (109.235.143.148)	2026101400
ns2.arvato-systems.de (2a01:4a8:2222:2222::11)	2026101400

Checks

✓ Serial 2026101400 everywhere #22

All nameservers serve the same version of the zone.
✓ Timers within recommendations #23

SOA refresh 1h, retry 30m, expire 1000h, negative TTL 1h.
✓ Primary is a public nameserver #24

The primary nameserver dns009.arvato-systems.de is one of the listed nameservers.
✓ Contact hostmaster@bnic.bertelsmann.de #25

The SOA RNAME hostmaster.bnic.bertelsmann.de means hostmaster@bnic.bertelsmann.de.
✓ Date-based serial #26

The serial 2026101400 follows the YYYYMMDDnn convention (2026-10-14).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

info

25 records at the apex

Found

Read from: 193.189.249.157:53

Type	Value	TTL
SOA	dns009.arvato-systems.de. hostmaster.bnic.bertelsmann.de. 2026101400 3600 1800 3600000 3600	3600
NS	dns009.arvato-systems.de.	3600
NS	ns1.arvato-systems.de.	3600
NS	dns017.arvato-systems.de.	3600
NS	ns2.arvato-systems.de.	3600
A	128.65.213.76	3600
MX	10 penguinrandomhouse-de.mail.protection.outlook.com.	86400
TXT	"google-site-verification=trHp86Q1HknOfWspu14lHDfmz9WJJeQ8plGa9YVqKLs"	300
TXT	"box-domain-verification=db77a8bd2b4c58c0c06fe162423a3228c6d9be760b24b66336e394f05f465c31"	300
TXT	"asv=d7133dece2fcfd6defbdc78690f63e09"	300
TXT	"pinterest-site-verification=cdcbe53dc5765872d95ae13c998bbb24"	300
TXT	"miro-verification=0b5398e3695491388001ffbe765fe73633532e3f"	300
TXT	"pinterest-site-verification=d1e0c1b8e9cbfd07b22e9277ee693ca6"	300
TXT	"adobe-idp-site-verification=1ab58e56a7c5cfcf85df9cf0e34dc26505b7982a08fd338b70244c5611b99242"	300
TXT	"atlassian-domain-verification=Kl3ByU1tsfV9fKiC7TDDZYz1uCeTeUo0SSEh5SitZ9q99Ua74O571fgiIg//j5Hn"	300
TXT	"mc1mpfhbi9j5ofo45b3ul4fqa9"	300
TXT	"canva-site-verification=5nX1gSbClijqMgbtwdl8tQ"	300
TXT	"elevenlabs=ksXgBZfiHHPeHmPdD4WZtZKqlVdVHZhF0fEfvWTjBTY"	300
TXT	"google-site-verification=L2FetfX7dQvRB_mSTQgcE23hHYEhbbFZBPGNAS3RGjE"	300
TXT	"openai-domain-verification=dv-BgwsGKUkK3RGvm0yiGFVKyVz"	300
TXT	"openai-domain-verification=dv-qsgK5IDay1uUrGBUX5vWDz3G"	300
TXT	"google-site-verification=TQfSGUfwPyHUI05zZOdaa2P94SNNB5dGQEySWNCduHg"	300
TXT	"MS=ms75265722"	300
TXT	"v=spf1 mx include:spf.protection.outlook.com include:_spf.senders.scnem.com include:spf.servicemail24.de include:www.techcast.com include:spf.mailjet.com a:smtp.siruphosting.de -all"	300
TXT	"langdock-verify=bdzalaIH0jj5B__GXXyhl3xDyNFFsUXWg3V8wlaU14U"	300

Checks

✓ TTLs within range #32

TTLs: A 1h, MX 1d, NS 1h. The NS TTL at the parent is 1d and in the zone 1h; resolvers may use either.
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35