Domain report: posteo.de

Registration

info

.de country-code

Found

TLD: .de (country-code)
ICANN policies apply: no

Checks

i

.de is a country-code TLD (ccTLD)

Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.

#1
✓ TLD delegated and signed #2

.de is delegated in the root zone and DNSSEC-signed.
i

Registration data not available

No registration data via RDAP: the registry of .de offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.

#3

Delegation

pass

emea.excedodns.eu, global.excedodns.com, nordic.excedodns.net, ns01.posteo-dns.de, ns02.posteo-dns.de, ns21.posteo-dns.ch, ns31.posteo-dns.eu, sto.excedodns.se, world.excedodns.org

Found

Parent zone: de
Delegation from: a.nic.de (194.0.0.53)
NS at the parent: emea.excedodns.eu, global.excedodns.com, nordic.excedodns.net, ns01.posteo-dns.de, ns02.posteo-dns.de, ns21.posteo-dns.ch, ns31.posteo-dns.eu, sto.excedodns.se, world.excedodns.org
NS in the zone: emea.excedodns.eu, global.excedodns.com, nordic.excedodns.net, ns01.posteo-dns.de, ns02.posteo-dns.de, ns21.posteo-dns.ch, ns31.posteo-dns.eu, sto.excedodns.se, world.excedodns.org

Nameserver	Addresses	Network (AS)	Glue
emea.excedodns.eu	194.58.192.48 2a01:3f1:48::53	AS8674 NETNOD-IX - Netnod AB, SE AS8674 NETNOD-IX - Netnod AB, SE	-
global.excedodns.com	194.58.198.48 2a01:3f1:3048::53	AS56908 NETNOD-NDS - Netnod AB, SE AS56908 NETNOD-NDS - Netnod AB, SE	-
nordic.excedodns.net	162.219.55.130 2620:10a:80ec::42	AS394354 CIRA-CLOUD2 - CIRA Canadian Internet Registration Authority Autorit Canadienne pour les enregistrements Internet, CA AS394354 CIRA-CLOUD2 - CIRA Canadian Internet Registration Authority Autorit Canadienne pour les enregistrements Internet, CA	-
ns01.posteo-dns.de	185.67.36.40 2a05:bc0:1000::40:1	AS8495 INTERNET_AG - INTERNET AG Global Network, DE AS8495 INTERNET_AG - INTERNET AG Global Network, DE	185.67.36.40 2a05:bc0:1000::40:1
ns02.posteo-dns.de	185.67.36.42 2a05:bc0:1000::42:1	AS8495 INTERNET_AG - INTERNET AG Global Network, DE AS8495 INTERNET_AG - INTERNET AG Global Network, DE	185.67.36.42 2a05:bc0:1000::42:1
ns21.posteo-dns.ch	185.67.36.42 2a05:bc0:1000::42:1	AS8495 INTERNET_AG - INTERNET AG Global Network, DE AS8495 INTERNET_AG - INTERNET AG Global Network, DE	-
ns31.posteo-dns.eu	87.225.252.162 2001:bf0:129::162:1	AS44716 DHOSTING-NET - D-hosting die Rackspace & Connectivity GmbH, DE AS12732 GUTCON-NET - GutCon GmbH, DE	-
sto.excedodns.se	185.42.137.101 2a01:3f0:400::48	AS8674 NETNOD-IX - Netnod AB, SE AS8674 NETNOD-IX - Netnod AB, SE	-
world.excedodns.org	162.219.54.130 2620:10a:80eb::42	AS55195 CIRA-CLOUD1 - CIRA Canadian Internet Registration Authority Autorit Canadienne pour les enregistrements Internet, CA AS55195 CIRA-CLOUD1 - CIRA Canadian Internet Registration Authority Autorit Canadienne pour les enregistrements Internet, CA	-

Checks

✓ 9 nameservers #6

Delegated to emea.excedodns.eu, global.excedodns.com, nordic.excedodns.net, ns01.posteo-dns.de, ns02.posteo-dns.de, ns21.posteo-dns.ch, ns31.posteo-dns.eu, sto.excedodns.se, world.excedodns.org.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 7 IPv4 /24s and 7 IPv6 /48s.
✓ 7 autonomous systems #11

The nameservers are spread over: AS12732 (GUTCON-NET - GutCon GmbH, DE): 1 address; AS394354 (CIRA-CLOUD2 - CIRA Canadian Internet Registration Authority Autorit Canadienne pour les enregistrements Internet, CA): 2 addresses; AS44716 (DHOSTING-NET - D-hosting die Rackspace & Connectivity GmbH, DE): 1 address; AS55195 (CIRA-CLOUD1 - CIRA Canadian Internet Registration Authority Autorit Canadienne pour les enregistrements Internet, CA): 2 addresses; AS56908 (NETNOD-NDS - Netnod AB, SE): 2 addresses; AS8495 (INTERNET_AG - INTERNET AG Global Network, DE): 6 addresses; AS8674 (NETNOD-IX - Netnod AB, SE): 4 addresses.
✓ Nameserver names under 7 TLDs #12

Nameserver names use the TLDs .ch, .com, .de, .eu, .net, .org, .se.
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

Nameservers

info

18 of 18 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
emea.excedodns.eu 194.58.192.48	NOERROR, 17 ms, authoritative	no	yes / yes	refused	-
emea.excedodns.eu 2a01:3f1:48::53	NOERROR, 20 ms, authoritative	no	yes / yes	refused	-
global.excedodns.com 194.58.198.48	NOERROR, 8 ms, authoritative	no	yes / yes	refused	-
global.excedodns.com 2a01:3f1:3048::53	NOERROR, 10 ms, authoritative	no	yes / yes	refused	-
nordic.excedodns.net 162.219.55.130	NOERROR, 3 ms, authoritative	no	yes / yes	refused	FRA D-ZONE nameserver
nordic.excedodns.net 2620:10a:80ec::42	NOERROR, 8 ms, authoritative	no	yes / yes	refused	FRA D-ZONE nameserver
ns01.posteo-dns.de 185.67.36.40	NOERROR, 5 ms, authoritative	no	yes / yes	refused	-
ns01.posteo-dns.de 2a05:bc0:1000::40:1	NOERROR, 5 ms, authoritative	no	yes / yes	refused	-
ns02.posteo-dns.de 185.67.36.42	NOERROR, 6 ms, authoritative	no	yes / yes	refused	-
ns02.posteo-dns.de 2a05:bc0:1000::42:1	NOERROR, 4 ms, authoritative	no	yes / yes	refused	-
ns21.posteo-dns.ch 185.67.36.42	NOERROR, 6 ms, authoritative	no	yes / yes	refused	-
ns21.posteo-dns.ch 2a05:bc0:1000::42:1	NOERROR, 4 ms, authoritative	no	yes / yes	refused	-
ns31.posteo-dns.eu 87.225.252.162	NOERROR, 9 ms, authoritative	no	yes / yes	refused	-
ns31.posteo-dns.eu 2001:bf0:129::162:1	NOERROR, 12 ms, authoritative	no	yes / yes	refused	-
sto.excedodns.se 185.42.137.101	NOERROR, 25 ms, authoritative	no	yes / yes	refused	-
sto.excedodns.se 2a01:3f0:400::48	NOERROR, 24 ms, authoritative	no	yes / yes	refused	-
world.excedodns.org 162.219.54.130	NOERROR, 13 ms, authoritative	no	yes / yes	refused	CIRA Server
world.excedodns.org 2620:10a:80eb::42	NOERROR, 16 ms, authoritative	no	yes / yes	refused	CDG D-ZONE nameserver

Checks

✓ All respond #14

All 18 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
i

Identifying string disclosed

These nameservers answer version queries with a string that is not a version number: nordic.excedodns.net: "FRA D-ZONE nameserver"; world.excedodns.org: "CIRA Server"; world.excedodns.org: "CDG D-ZONE nameserver".

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

pass

serial 1792544452 · primary ns01.posteo-dns.de

Found

Primary (MNAME): ns01.posteo-dns.de
Contact (RNAME): hostmaster.posteo.de
Serial: 1792544452
Refresh / retry: 3600 s / 900 s
Expire: 604800 s
Negative TTL: 300 s

Serial per nameserver

Nameserver	Serial
emea.excedodns.eu (194.58.192.48)	1792544452
emea.excedodns.eu (2a01:3f1:48::53)	1792544452
global.excedodns.com (194.58.198.48)	1792544452
global.excedodns.com (2a01:3f1:3048::53)	1792544452
nordic.excedodns.net (162.219.55.130)	1792544452
nordic.excedodns.net (2620:10a:80ec::42)	1792544452
ns01.posteo-dns.de (185.67.36.40)	1792544452
ns01.posteo-dns.de (2a05:bc0:1000::40:1)	1792544452
ns02.posteo-dns.de (185.67.36.42)	1792544452
ns02.posteo-dns.de (2a05:bc0:1000::42:1)	1792544452
ns21.posteo-dns.ch (185.67.36.42)	1792544452
ns21.posteo-dns.ch (2a05:bc0:1000::42:1)	1792544452
ns31.posteo-dns.eu (87.225.252.162)	1792544452
ns31.posteo-dns.eu (2001:bf0:129::162:1)	1792544452
sto.excedodns.se (185.42.137.101)	1792544452
sto.excedodns.se (2a01:3f0:400::48)	1792544452
world.excedodns.org (162.219.54.130)	1792544452
world.excedodns.org (2620:10a:80eb::42)	1792544452

Checks

✓ Serial 1792544452 everywhere #22

All nameservers serve the same version of the zone.
✓ Timers within recommendations #23

SOA refresh 1h, retry 15m, expire 7d, negative TTL 5m.
✓ Primary is a public nameserver #24

The primary nameserver ns01.posteo-dns.de is one of the listed nameservers.
✓ Contact hostmaster@posteo.de #25

The SOA RNAME hostmaster.posteo.de means hostmaster@posteo.de.
✓ Timestamp serial #26

The serial 1792544452 is a Unix timestamp (2026-10-21 01:00 UTC).

DNSSEC

warn

Signed, DS published at parent

Found

Validated by resolver: yes
Denial of existence: NSEC3
NSEC3: 20 iterations, 8-byte salt
Signatures valid until: 29 October 2026

DS at the parent

Key tag	Algorithm	Digest	Matches a key
53881	RSASHA256 (8)	SHA256 D3D66D1FB310D448…	yes

DNSKEY in the zone

Key tag	Role	Algorithm
53881	KSK (257)	RSASHA256 (8)
23244	ZSK (256)	RSASHA256 (8)

Checks

✓ Signed and validated #27

The zone is signed, the parent publishes a DS record, and the resolver validates the answers.
✓ DS matches a key #28

The DS record at the parent matches a key in the zone: key tag 53881 (SHA256).
✓ Modern algorithms #29

Key algorithms: RSASHA256 (8).
✓ Signatures valid until 2026-10-29 #30

The earliest DNSKEY/SOA signature expires at 2026-10-29 00:00 UTC.
!

NSEC3 with extra iterations or salt

NSEC3 uses 20 iterations and a 8-byte salt. RFC 9276 recommends 0 iterations and no salt: extra iterations cost resolvers CPU and add no real protection, and some validators treat high counts as insecure.

#31

Records

pass

27 records at the apex

Found

Read from: 194.58.192.48:53

Type	Value	TTL
SOA	ns01.posteo-dns.de. hostmaster.posteo.de. 1792544452 3600 900 604800 300	300
NS	ns31.posteo-dns.eu.	300
NS	world.excedodns.org.	300
NS	global.excedodns.com.	300
NS	nordic.excedodns.net.	300
NS	sto.excedodns.se.	300
NS	emea.excedodns.eu.	300
NS	ns01.posteo-dns.de.	300
NS	ns02.posteo-dns.de.	300
NS	ns21.posteo-dns.ch.	300
A	185.67.36.168	300
A	185.67.36.169	300
AAAA	2a05:bc0:1001:40::168:1	300
AAAA	2a05:bc0:1001:40::169:1	300
MX	10 mx04.posteo.de.	300
MX	10 mx01.posteo.de.	300
MX	10 mx02.posteo.de.	300
MX	10 mx03.posteo.de.	300
TXT	"e09403217652a8ddff5c9587701e02f9d12b226b6523bcf247aee481d00b4b1"	300
TXT	"v=spf1 ip4:185.67.36.0/23 ip6:2a05:bc0:1000::/47 ~all"	300
TXT	"84944eaf2fa3496cc8b73383c39b0046330432b19e3400ce8c21052b09194db"	300
CAA	0 issuewild "d-trust.net"	300
CAA	0 issuewild "geotrust.com"	300
CAA	0 iodef "mailto:hostmaster@posteo.de"	300
CAA	0 issue "certum.pl"	300
CAA	0 issue "d-trust.net"	300
CAA	0 issue "geotrust.com"	300

Checks

✓ TTLs within range #32

TTLs: A 5m, AAAA 5m, MX 5m, NS 5m. The NS TTL at the parent is 1d and in the zone 5m; resolvers may use either.
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
✓ CAA restricts issuance #35

Certificates may be issued by: d-trust.net, geotrust.com, certum.pl.