refinitiv.com

Checked 22 October 2026, 10:30 UTC · via 8.8.8.8
✗Problems found
22 passed 5 warnings 1 failed 3 info

Registration

info

.com generic · MarkMonitor Inc. · expires 2027-06-08

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
MarkMonitor Inc.
Registered
8 June 2018
Last changed
7 May 2026
Expires
8 June 2027
Status
client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers
ns-amers-1.refinitiv.net, ns-amers-2.refinitiv.net, ns-apac-1.refinitiv.org, ns-apac-2.refinitiv.org, ns-emea-1.refinitiv.co.uk, ns-emea-2.refinitiv.co.uk
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-06-08 #3
    The registration is valid until 2027-06-08 (229 days).
  • ✓ Transfer locked #4
    Registry status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

ns-amers-1.refinitiv.net, ns-amers-2.refinitiv.net, ns-apac-1.refinitiv.org, ns-apac-2.refinitiv.org, ns-emea-1.refinitiv.co.uk, ns-emea-2.refinitiv.co.uk

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
ns-amers-1.refinitiv.net, ns-amers-2.refinitiv.net, ns-apac-1.refinitiv.org, ns-apac-2.refinitiv.org, ns-emea-1.refinitiv.co.uk, ns-emea-2.refinitiv.co.uk
NS in the zone
ns-amers-1.refinitiv.net, ns-amers-2.refinitiv.net, ns-apac-1.refinitiv.org, ns-apac-2.refinitiv.org, ns-emea-1.refinitiv.co.uk, ns-emea-2.refinitiv.co.uk
NameserverAddressesNetwork (AS)Glue
ns-amers-1.refinitiv.net146.242.18.65AS32067 AS32067 - Refinitiv US LLC, US-
ns-amers-2.refinitiv.net146.242.19.65AS3145 RFT-AS - Refinitiv US LLC, US-
ns-apac-1.refinitiv.org155.46.39.132AS24012 RAPL-AS-AP - Refinitiv Australia PTY Limited, AU-
ns-apac-2.refinitiv.org146.242.24.65AS24012 RAPL-AS-AP - Refinitiv Australia PTY Limited, AU-
ns-emea-1.refinitiv.co.uk155.46.38.132AS16050 Refinitiv-Slough-LO5-res-AS - Refinitiv Limited, GB-
ns-emea-2.refinitiv.co.uk146.242.21.65AS16050 Refinitiv-Slough-LO5-res-AS - Refinitiv Limited, GB-

Checks

  • ✓ 6 nameservers #6
    Delegated to ns-amers-1.refinitiv.net, ns-amers-2.refinitiv.net, ns-apac-1.refinitiv.org, ns-apac-2.refinitiv.org, ns-emea-1.refinitiv.co.uk, ns-emea-2.refinitiv.co.uk.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 6 IPv4 /24s and 0 IPv6 /48s.
  • ✓ 4 autonomous systems #11
    The nameservers are spread over: AS16050 (Refinitiv-Slough-LO5-res-AS - Refinitiv Limited, GB): 2 addresses; AS24012 (RAPL-AS-AP - Refinitiv Australia PTY Limited, AU): 2 addresses; AS3145 (RFT-AS - Refinitiv US LLC, US): 1 address; AS32067 (AS32067 - Refinitiv US LLC, US): 1 address.
  • ✓ Nameserver names under 3 TLDs #12
    Nameserver names use the TLDs .net, .org, .uk.
  • !
    No IPv6
    None of the nameservers has an IPv6 address, so IPv6-only resolvers can't reach them.
    #13

Nameservers

fail

5 of 6 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns-amers-1.refinitiv.net 146.242.18.65NOERROR, 120 ms, authoritativenoyes / yesrefused9.18.37
ns-amers-2.refinitiv.net 146.242.19.65NOERROR, 131 ms, authoritativenoyes / yesrefused9.18.37
ns-apac-1.refinitiv.org 155.46.39.132NOERROR, 242 ms, authoritativenoyes / yesrefused9.18.37
ns-apac-2.refinitiv.org 146.242.24.65NOERROR, 264 ms, authoritativenoyes / yesrefused-
ns-emea-1.refinitiv.co.uk 155.46.38.132no responsenono / no--
ns-emea-2.refinitiv.co.uk 146.242.21.65NOERROR, 19 ms, authoritativenoyes / yesrefused9.18.37

Checks

  • ✗
    Nameservers not responding
    These addresses did not answer, so resolvers waste time on timeouts: ns-emea-1.refinitiv.co.uk (155.46.38.132): read udp 46.225.38.91:57235->155.46.38.132:53: i/o timeout.
    #14
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: ns-amers-1.refinitiv.net: "9.18.37"; ns-amers-2.refinitiv.net: "9.18.37"; ns-apac-1.refinitiv.org: "9.18.37"; ns-emea-2.refinitiv.co.uk: "9.18.37". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

warn

serial 10069 · primary pln-dco-ddi01.int.refinitiv.com

Found

Primary (MNAME)
pln-dco-ddi01.int.refinitiv.com
Contact (RNAME)
dditeam.lseg.com
Serial
10069
Refresh / retry
3600 s / 900 s
Expire
2419200 s
Negative TTL
30 s

Serial per nameserver

NameserverSerial
ns-amers-1.refinitiv.net (146.242.18.65)10069
ns-amers-2.refinitiv.net (146.242.19.65)10069
ns-apac-1.refinitiv.org (155.46.39.132)10069
ns-apac-2.refinitiv.org (146.242.24.65)10069
ns-emea-2.refinitiv.co.uk (146.242.21.65)10069

Checks

  • ✓ Serial 10069 everywhere #22
    All nameservers serve the same version of the zone.
  • !
    Unusual SOA timers
    negative caching TTL (minimum) 30s is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 1h, retry 15m, expire 28d, negative TTL 30s.
    #23
  • i
    Hidden master
    The primary nameserver pln-dco-ddi01.int.refinitiv.com is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.
    #24
  • ✓ Contact dditeam@lseg.com #25
    The SOA RNAME dditeam.lseg.com means dditeam@lseg.com.
  • ✓ Counter serial #26
    The serial 10069 is a plain counter.

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

36 records at the apex

Found

Read from
146.242.18.65:53
TypeValueTTL
SOApln-dco-ddi01.int.refinitiv.com. dditeam.lseg.com. 10069 3600 900 2419200 30300
NSns-emea-2.refinitiv.co.uk.300
NSns-apac-2.refinitiv.org.300
NSns-amers-2.refinitiv.net.300
NSns-amers-1.refinitiv.net.300
NSns-emea-1.refinitiv.co.uk.300
NSns-apac-1.refinitiv.org.300
A159.220.50.8830
MX10 eu-smtp-inbound-1.mimecast.com.300
MX20 eu-smtp-inbound-2.mimecast.com.300
TXT"google-site-verification=jRqaRM0TFCqS8kXhCJMXGUMNnLPTbDYP7ADlTZ9vqYk"300
TXT"v=DMARC1; p=none; rua=mailto: mailto:dmarc_agg@vali.email"300
TXT"adobe-idp-site-verification=3caea4fbc07ad0143fb8293308af5a5980696afa61a3d9a1f0770e59956c5f02"300
TXT"@ 3600 IN TXT adobe-idp-site-verification=3caea4fbc07ad0143fb8293308af5a5980696afa61a3d9a1f0770e59956c5f02"300
TXT"e5c9b486-9373-4758-b329-1f9a2e3a8065"300
TXT"amazonses:kFLrPcr62mk9rKQYt5HdnPlm39WhJl+qa+uR2a6Eo6Q="300
TXT"amazonses:48RbkiOinSB3SXjhF1W9ZtBNfqGy2AzYSIwTGpy2NK0="300
TXT"amazonses:rqiLrXust3yHj7GE2EeObeypxjWh0roZ09fK1lOkll4="300
TXT"0ed1fe018a365e2259c79c4721af1c693740444f9a"300
TXT"amazonses:8ZkartTPEY6YlJ9T46PcNvo4YCwfz0Rq9+swYG/t7RM="300
TXT"v=spf1 include:eu._netblocks.mimecast.com include:spf.protection.outlook.com include:_spf.amers.refinitiv.com include:_spf.apac.refinitiv.com" " include:_spf.emea.refinitiv.com include:_spf.eu.mailgun.org include:amazonses.com include:_spf.salesforce.com ip4:205.201.128.0/20 ip4:198.2.128.0/18 ip4:148.105.0.0/16 ip4:192.174.95.137 ip4:192.174.95.138 -all"300
TXT"8c5294c2-2b2c-4b08-a94b-58ab163a52c7"300
TXT"postman-domain-verification=a13451db2309a074d8b91b3f2325c4bad5b687dd63c441d07a64140acce824cd"300
TXT"ca3-bad6a5b8a4d34cceabf72b323332a30a"300
TXT"smartsheet-site-validation=Yj8blK2xKo31MtGGgVdroXnqdo07Sizq"300
TXT"MS=ms48471151"300
TXT"smartsheet-site-validation=bdYAlbUhwKxONBaEg_oLfSU-yov7wpe4"300
TXT"figma-domain-verification=774455eb2cd1d8d95568c55e1135ae72887d0facd60a0d3e47466a8d48aeb92e-1720680476"300
TXT"MS=072DCBB6E67EBFD83CA25460C7251E296E191C5E"300
TXT"Verifying DNS records ownership as requested by RonnieM from Microsoft"300
TXT" MS=ms62854955"300
TXT"MS=1756654612D2C9DC2227012353214AFA6C1382ED"300
TXT"onetrust-domain-verification=7627b8385eef4feeb7dcffac36310358"300
TXT"amazonses:I9NMTVtbruT42v1xsLDWZLClSBJAyZEmjK3Awt/10M0="300
TXT"webexdomainverification.AFZN=14825916-81d3-40f2-b6ca-9635c9c334a7"300
TXT"v=DKIM1;k=rsa;g=*;t=s;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCcbHd8DbWmGV0P7Jdd8fGxbzdXJaS/zLc0GKSz45q98Kixxtiy72z04WLMyNNNml9f0jutGqWxiEGfzdL5cSMuEw0172rSDYBVTJnCUQGolP3OrLk4QmuNXYCCLjNmoR2dgRo19KTvq+Gjn23W2inHruuG1xd34onQ+M6A4EqjnwIDAQAB"300

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (30s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 5m; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35