riotinto.com

Checked 22 October 2026, 10:31 UTC · via 8.8.8.8
!Passed with warnings
24 passed 3 warnings 0 failed 4 info

Registration

info

.com generic · CSC Corporate Domains, Inc. · expires 2027-02-08

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
CSC Corporate Domains, Inc.
Registered
7 February 1997
Last changed
4 February 2026
Expires
8 February 2027
Status
client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers
dns11.domainnetwork.com, dns12.domainnetwork.com, dns13.domainnetwork.com, dns14.domainnetwork.net, dns15.domainnetwork.net, dns16.domainnetwork.net
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-02-08 #3
    The registration is valid until 2027-02-08 (108 days).
  • ✓ Transfer locked #4
    Registry status: client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

dns11.domainnetwork.com, dns12.domainnetwork.com, dns13.domainnetwork.com, dns14.domainnetwork.net, dns15.domainnetwork.net, dns16.domainnetwork.net

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
dns11.domainnetwork.com, dns12.domainnetwork.com, dns13.domainnetwork.com, dns14.domainnetwork.net, dns15.domainnetwork.net, dns16.domainnetwork.net
NS in the zone
dns11.domainnetwork.com, dns12.domainnetwork.com, dns13.domainnetwork.com, dns14.domainnetwork.net, dns15.domainnetwork.net, dns16.domainnetwork.net
NameserverAddressesNetwork (AS)Glue
dns11.domainnetwork.com204.74.108.248AS12008 VERCARA - Vercara, LLC, US204.74.108.248
dns12.domainnetwork.com204.74.109.248AS12008 VERCARA - Vercara, LLC, US204.74.109.248
dns13.domainnetwork.com199.7.68.248AS12008 VERCARA - Vercara, LLC, US199.7.68.248
dns14.domainnetwork.net199.7.69.248AS12008 VERCARA - Vercara, LLC, US-
dns15.domainnetwork.net204.74.114.248AS12008 VERCARA - Vercara, LLC, US-
dns16.domainnetwork.net204.74.115.248AS12008 VERCARA - Vercara, LLC, US-

Checks

  • ✓ 6 nameservers #6
    Delegated to dns11.domainnetwork.com, dns12.domainnetwork.com, dns13.domainnetwork.com, dns14.domainnetwork.net, dns15.domainnetwork.net, dns16.domainnetwork.net.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 6 IPv4 /24s and 0 IPv6 /48s.
  • i
    All nameservers in one AS
    All nameserver addresses are announced by one network operator (AS12008 (VERCARA - Vercara, LLC, US): 6 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.
    #11
  • ✓ Nameserver names under 2 TLDs #12
    Nameserver names use the TLDs .com, .net.
  • !
    No IPv6
    None of the nameservers has an IPv6 address, so IPv6-only resolvers can't reach them.
    #13

Nameservers

info

6 of 6 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
dns11.domainnetwork.com 204.74.108.248NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
dns12.domainnetwork.com 204.74.109.248NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
dns13.domainnetwork.com 199.7.68.248NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
dns14.domainnetwork.net 199.7.69.248NOERROR, 34 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
dns15.domainnetwork.net 204.74.114.248NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
dns16.domainnetwork.net 204.74.115.248NOERROR, 31 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver

Checks

  • ✓ All respond #14
    All 6 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • i
    Identifying string disclosed
    These nameservers answer version queries with a string that is not a version number: dns11.domainnetwork.com: "UltraDNS Nameserver"; dns12.domainnetwork.com: "UltraDNS Nameserver"; dns13.domainnetwork.com: "UltraDNS Nameserver"; dns14.domainnetwork.net: "UltraDNS Nameserver"; dns15.domainnetwork.net: "UltraDNS Nameserver"; dns16.domainnetwork.net: "UltraDNS Nameserver".
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

warn

serial 2016115111 · primary dns11.domainnetwork.com

Found

Primary (MNAME)
dns11.domainnetwork.com
Contact (RNAME)
dns\.admin.riotinto.com
Serial
2016115111
Refresh / retry
21600 s / 3600 s
Expire
604800 s
Negative TTL
60 s

Serial per nameserver

NameserverSerial
dns11.domainnetwork.com (204.74.108.248)2016115111
dns12.domainnetwork.com (204.74.109.248)2016115111
dns13.domainnetwork.com (199.7.68.248)2016115111
dns14.domainnetwork.net (199.7.69.248)2016115111
dns15.domainnetwork.net (204.74.114.248)2016115111
dns16.domainnetwork.net (204.74.115.248)2016115111

Checks

  • ✓ Serial 2016115111 everywhere #22
    All nameservers serve the same version of the zone.
  • !
    Unusual SOA timers
    negative caching TTL (minimum) 1m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 6h, retry 1h, expire 7d, negative TTL 1m.
    #23
  • ✓ Primary is a public nameserver #24
    The primary nameserver dns11.domainnetwork.com is one of the listed nameservers.
  • ✓ Contact dns.admin@riotinto.com #25
    The SOA RNAME dns\.admin.riotinto.com means dns.admin@riotinto.com.
  • ✓ Timestamp serial #26
    The serial 2016115111 is a Unix timestamp (2033-11-20 15:58 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

info

57 records at the apex

Found

Read from
204.74.108.248:53
TypeValueTTL
SOAdns11.domainnetwork.com. dns\.admin.riotinto.com. 2016115111 21600 3600 604800 603600
NSdns11.domainnetwork.com.86400
NSdns12.domainnetwork.com.86400
NSdns13.domainnetwork.com.86400
NSdns14.domainnetwork.net.86400
NSdns15.domainnetwork.net.86400
NSdns16.domainnetwork.net.86400
A45.60.198.13486400
A45.60.200.13486400
MX0 riotinto-com.mail.protection.outlook.com.3600
TXT"MS=ms32875429"3600
TXT"3kh44kvfgfhm451ob51g64jn3l"3600
TXT"kr00cqrge6r3sdiaudj24sh4jg"3600
TXT"2s95775p4696gvnn4jkrfdppwd82zy5v"3600
TXT"_30qly7boakc1tx6eibpfyzhkr4jsjst"3600
TXT"_hl6dogj5okhc0dxa3qiu39fr8aonjj3"3600
TXT"_qm4uqtvmrw1cut1ageeip50nmv84ez6"3600
TXT"bndkbn08rqmbcw40f1wfnmdxqcqqg6v5"3600
TXT"gxkxd5s76mlwlcmpckkjythmn64qwljf"3600
TXT"j2tdf4w62gqqj19d57bkyr22vldq92q7"3600
TXT"n2jljmv1191jtnym33g8vmwcv1fw9v0f"3600
TXT"prb9l0fm3p1jhhym8h688s941hbyj6sz"3600
TXT"qrbv9svhy3dw2ymmjl03k7wgcq0c81zw"3600
TXT"tgxyfgznybjcf1n8ycn6k4v1bpbvhd35"3600
TXT"vnyqptz2m58fqvjdy1m17jdf774tgqtf"3600
TXT"vyf7f13gv9802cgj05swkxn821s690mg"3600
TXT"xcpq2x05v7x85gq84c7n3gqw0xv2m153"3600
TXT"xz32dmvvr0whkm34m9swgn86nlr840lw"3600
TXT"d365mktkey=ychfosc72wz3ci9h5ov53wba"3600
TXT"apple-domain-verification=M7a8jqKFLvcSwwWr"3600
TXT"apple-domain-verification=TDmZl1EhXR7QYmA4"3600
TXT"apple-domain-verification=kmIdRWj81aFv2sPO"3600
TXT"docusign=1729138f-cb6c-47c6-be94-d8d207ee6f37"3600
TXT"docusign=ee110089-7963-4dd8-9d8f-3e2fad64e851"3600
TXT"canva-site-verification=L3muY1chtiNlnRcB-PRSSA"3600
TXT"openai-domain-verification=dv-dHFaFfUBtDg6tubYMPOxIvqb"3600
TXT"docker-verification=23e700a9-97b9-4913-8929-c8df7a162155"3600
TXT"miro-verification=357c965b9c8be9702911c362ddb72c1959227ff2"3600
TXT"teamviewer-sso-verification=741d796e12bb408dbb6766e0f3ac6b30"3600
TXT"workplace-domain-verification=D4j4L0ihB76NPZU32Nlotb2xlGX2rC"3600
TXT"globalsign-domain-verification=1505763E272B8F151050219814F87D6E"3600
TXT"globalsign-domain-verification=F15F01F4C704302FB974C74EC3A7A324"3600
TXT"globalsign-domain-verification=f68df60504bc65355eec6a252bff889c"3600
TXT"6c8192b8b16e61b79fa6ff1018cf5a2234da9d8d4d1a55d585c8d71893dd714a"3600
TXT"d78e3258ac8716d0be2efdc97104998e797c6fc718b5685e03cca5e2e13b84de"3600
TXT"dtm-domain-verification=bmVgDQ0LntXbuyykTMKmOWgoRR0BK1vmaQmEyD3hY0w"3600
TXT"dtm-domain-verification=sRjT7RXdKgsUxYkq_4viDdeyOTP097pMbxpxF2PFykw"3600
TXT"pexip-ms-tenant-domain-verification=0f3f3800-d6b3-449d-87ba-e81f6341bbc6"3600
TXT"_globalsign-domain-verification=AGPloDOvkD4Wr2TKw92KqYzI5QaeN-wzUM3HRbSx-E"3600
TXT"XcVJU8t5BTApd9ynj8GuQblKtoD2wItUVB2ammJdpUq3PS0bZM7D3aU4LMsy09qD0GCBYQmVZa0vbUv3Yiah8Q=="3600
TXT"wdbnwv31ARXNDTtK1XTcmrsbKAvp2qUJE2smun10S8vSDeaMcffM/xRSBPGJRtFlr99qfrdDTAc7z2WSUTwgVA=="3600
TXT"Dynatrace-site-verification=87e22acd-8e28-4878-bf85-81491916e677__ojakb6jcr9a2enoedbk5m143nb"3600
TXT"adobe-idp-site-verification=a115a72dee4b216a2c454c5b98a72af4c5eea21e8da9637d30781f3be7cfd1a8"3600
TXT"atlassian-domain-verification=dBq7OjGxqxBRqVpkFzoawvkz/7KVFvAApfiXH4NiMpRslxOn5hcdE0zDaRsFVPjD"3600
TXT"hpe-greenlake-domain-verification=657536633437656a72584f64706f4668756d674e49424c397335526346525867"3600
TXT"successfactors-site-verification=YzJjZmU5MWU0ODA2ZDI2MzJiNTBhNmNiZTUzNDRhMDg1NzAwYzdmZjU0MGJjZWIxYTI3MTMwMWFlMWVkZGE3Yg=="3600
TXT"v=spf1 ip4:203.15.191.188/32 ip4:203.15.191.189/32 ip4:203.15.191.252/32 ip4:203.15.191.253/32 ip4:203.15.190.226/32 ip4:203.15.190.227/32 ip4:208.185.229.0/24 ip4:208.185.235.0/24 ip4:148.59.108.0/23 ip4:148.59.106.0/23 ip4:148.59.107.25/32" " ip4:148.59.109.25/32 ip4:182.160.163.188/32 ip4:157.133.127.52/32 ip4:205.236.155.25/32 ip4:69.20.6.34/32 ip4:87.253.233.6/32 ip4:3.226.40.151/32 ip4:159.183.181.113 ip4:149.72.116.19 ip4:149.72.117.225 ip4:149.72.119.192 ip4:149.72.119.197" " ip4:149.72.119.199 ip4:149.72.119.210 ip4:149.72.147.106 ip4:149.72.148.50 ip4:149.72.155.21 ip4:149.72.160.121 ip4:149.72.166.148 ip4:35.80.141.6 ip4:44.229.121.55 ip4:74.179.243.94 ip4:172.214.67.207 ip4:4.236.81.254 ip4:148.59.100.16/28" " include:spf.protection.outlook.com include:_spf01.mykronos.com include:spf.mandrillapp.com include:_spf.salesforce.com include:servers.mcsv.net include:spf1.fraedom.com include:spfa.mailendo.com include:spf1.workhuman.com include:spf-us.wfs.cloud" " ip4:159.135.229.88/32 ip4:159.135.237.231/32 ip4:207.134.161.197/32 ip4:20.5.80.155/32 ip4:20.5.82.25/32 ip4:74.201.88.25/32 ip4:12.239.120.27/32 ip4:195.200.255.124 ip4:20.53.141.40 ip4:20.11.185.19 -all"3600

Checks

  • ✓ TTLs within range #32
    TTLs: A 1d, MX 1h, NS 1d. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35