rituals.com

Checked 22 October 2026, 10:31 UTC · via 8.8.8.8
!Passed with warnings
25 passed 3 warnings 0 failed 3 info

Registration

info

.com generic · Key-Systems GmbH · expires 2027-08-20

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
Key-Systems GmbH
Registered
21 August 1997
Last changed
19 July 2026
Expires
20 August 2027
Status
client transfer prohibited
Registry nameservers
pdns109.ultradns.biz, pdns109.ultradns.com, pdns109.ultradns.net, pdns109.ultradns.org
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-08-20 #3
    The registration is valid until 2027-08-20 (301 days).
  • ✓ Transfer locked #4
    Registry status: client transfer prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

pdns109.ultradns.biz, pdns109.ultradns.com, pdns109.ultradns.net, pdns109.ultradns.org

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
pdns109.ultradns.biz, pdns109.ultradns.com, pdns109.ultradns.net, pdns109.ultradns.org
NS in the zone
pdns109.ultradns.biz, pdns109.ultradns.com, pdns109.ultradns.net, pdns109.ultradns.org
NameserverAddressesNetwork (AS)Glue
pdns109.ultradns.biz156.154.66.109 2610:a1:1015::91AS12008 VERCARA - Vercara, LLC, US AS12008 VERCARA - Vercara, LLC, US-
pdns109.ultradns.com156.154.64.109 2001:502:f3ff::91AS12008 VERCARA - Vercara, LLC, US AS12008 VERCARA - Vercara, LLC, US156.154.64.109 2001:502:f3ff::91
pdns109.ultradns.net156.154.65.109 2610:a1:1014::91AS12008 VERCARA - Vercara, LLC, US AS12008 VERCARA - Vercara, LLC, US-
pdns109.ultradns.org156.154.67.109 2001:502:4612::91AS12008 VERCARA - Vercara, LLC, US AS12008 VERCARA - Vercara, LLC, US-

Checks

  • ✓ 4 nameservers #6
    Delegated to pdns109.ultradns.biz, pdns109.ultradns.com, pdns109.ultradns.net, pdns109.ultradns.org.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 4 IPv4 /24s and 4 IPv6 /48s.
  • i
    All nameservers in one AS
    All nameserver addresses are announced by one network operator (AS12008 (VERCARA - Vercara, LLC, US): 8 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.
    #11
  • ✓ Nameserver names under 4 TLDs #12
    Nameserver names use the TLDs .biz, .com, .net, .org.
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

info

8 of 8 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
pdns109.ultradns.biz 156.154.66.109NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
pdns109.ultradns.biz 2610:a1:1015::91NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
pdns109.ultradns.com 156.154.64.109NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
pdns109.ultradns.com 2001:502:f3ff::91NOERROR, 4 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
pdns109.ultradns.net 156.154.65.109NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
pdns109.ultradns.net 2610:a1:1014::91NOERROR, 4 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
pdns109.ultradns.org 156.154.67.109NOERROR, 31 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
pdns109.ultradns.org 2001:502:4612::91NOERROR, 32 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver

Checks

  • ✓ All respond #14
    All 8 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • i
    Identifying string disclosed
    These nameservers answer version queries with a string that is not a version number: pdns109.ultradns.biz: "UltraDNS Nameserver"; pdns109.ultradns.com: "UltraDNS Nameserver"; pdns109.ultradns.net: "UltraDNS Nameserver"; pdns109.ultradns.org: "UltraDNS Nameserver".
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

warn

serial 2021043475 · primary pdns109.ultradns.com

Found

Primary (MNAME)
pdns109.ultradns.com
Contact (RNAME)
tech.brandshelter.com
Serial
2021043475
Refresh / retry
86400 s / 86400 s
Expire
86400 s
Negative TTL
86400 s

Serial per nameserver

NameserverSerial
pdns109.ultradns.biz (156.154.66.109)2021043475
pdns109.ultradns.biz (2610:a1:1015::91)2021043475
pdns109.ultradns.com (156.154.64.109)2021043475
pdns109.ultradns.com (2001:502:f3ff::91)2021043475
pdns109.ultradns.net (156.154.65.109)2021043475
pdns109.ultradns.net (2610:a1:1014::91)2021043475
pdns109.ultradns.org (156.154.67.109)2021043475
pdns109.ultradns.org (2001:502:4612::91)2021043475

Checks

  • ✓ Serial 2021043475 everywhere #22
    All nameservers serve the same version of the zone.
  • !
    Unusual SOA timers
    retry 1d should be shorter than refresh 1d; expire 1d is shorter than 7d; secondaries stop answering too soon when the primary is down; expire 1d must be longer than refresh + retry. Current values: refresh 1d, retry 1d, expire 1d, negative TTL 1d.
    #23
  • ✓ Primary is a public nameserver #24
    The primary nameserver pdns109.ultradns.com is one of the listed nameservers.
  • ✓ Contact tech@brandshelter.com #25
    The SOA RNAME tech.brandshelter.com means tech@brandshelter.com.
  • ✓ Timestamp serial #26
    The serial 2021043475 is a Unix timestamp (2034-01-16 16:57 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

69 records at the apex

Found

Read from
156.154.66.109:53
TypeValueTTL
SOApdns109.ultradns.com. tech.brandshelter.com. 2021043475 86400 86400 86400 8640086400
NSpdns109.ultradns.biz.300
NSpdns109.ultradns.com.300
NSpdns109.ultradns.net.300
NSpdns109.ultradns.org.300
A146.75.119.5254
MX10 de-smtp-inbound-1.mimecast.com.300
MX10 de-smtp-inbound-2.mimecast.com.300
TXT"MS=ms64843056"3600
TXT"00DJW00000JIKGf=1TBJW0000000ERB"3600
TXT"00DJW00000JIKJt=1TBJW0000000DwX"3600
TXT"00DVc00000528TF=1TBVc0000000CfV"3600
TXT"4q6zb8r7f638qwkl97gv0z4h8wctkpd3"3600
TXT"83pk29zpbb12j4gdnst18xvlwq69nhqb"3600
TXT"87g3r80rz5lttdt3fk80nr6kty8rnsbn"3600
TXT"9t1n62cpwc1h8n42781hnvhg4pttwk6g"3600
TXT"_6x58p21u0qlxq14ip982o37wqutn62z"3600
TXT"_8jzf41chbrmlhvsg7ze65sifrnelirx"3600
TXT"_980146sekd02lerswva4fq8s460zhsi"3600
TXT"_9iic4en2s4u27oh435uw6sk47ngdryz"3600
TXT"_9s9teef8o477cbg5bdhrxbhvaly00nm"3600
TXT"_co0ire8df42xwflsckszvqo28s1ecu7"3600
TXT"_ehyf6203hp6bkkchwicnc2bfsfx8t9i"3600
TXT"_gsi6uu9c5kw8vv4sct5vwlrg5u1107b"3600
TXT"_oyxz0s0xakr8gm7w7u02s5pplachm9p"3600
TXT"_s73b1dnptij3vmtq03uhw01i8btp4mu"3600
TXT"_sro45retof78yq8zfx6tyop0kaljzpj"3600
TXT"_wgwezb4okpr2t3dwkd7x9waysdarfs1"3600
TXT"_yckh4t9iypmf18zvyube3wg62zgmqof"3600
TXT"b4tx3wz5zccm5z3l9l6680361yw7cwgm"3600
TXT"c34975lwhv45sz4w645wlyxmrkqdp1j0"3600
TXT"glvvdw717g5wj79vf17l5wj1gzkgxym1"3600
TXT"n33hm9y5vzwg9bh5v3m6crss8mm7ltrg"3600
TXT"t7yn7kp2m69ljwv20ryw7z2dzzxlswyt"3600
TXT"zk4j0hk6k6h41t8hhrcn4rrvgdgpqktf"3600
TXT"ZOOM_verify_WLXuBDUEQCWm9PaOTeRCmg"3600
TXT"v=spf1 redirect=ag7habik._spf._d.mim.ec"3600
TXT"apple-domain-verification=AH27rgGG3ctUcd6x"3600
TXT"docusign=fc78b5b6-d822-446d-9602-d5a93d8440b4"3600
TXT"jamf-site-verification=N9-HahGJ2_Kv-Yr1Xetyzw"3600
TXT"canva-site-verification=-w-851XtHkYllBDbBtT5FA"3600
TXT"amazonses:4GkKovaahZLiZ7iWwthrIjRAkAMsI8n/Cc15dcdfbEU="3600
TXT"amazonses:a1FO3lDRaXrC8+Hq/anbJZon3scFwobtJOT0tQ5j2/w="3600
TXT"miro-verification=56ef6f569190d0f65e8187a63577a125e77e2f9e"3600
TXT"facebook-domain-verification=4y14qsafk53wqmyeacdz1ghu0lewhk"3600
TXT"onetrust-domain-verification=5a5458640852434c860cc11436703bfa"3600
TXT"anthropic-domain-verification-3e4hya=IliU0zVf4ytdrMRfzC4ka3TeX"3600
TXT"fastly-domain-delegation-ioyiu7zytcivtjuyo4ra-809988-2024-09-09"3600
TXT"fastly-domain-delegation-u3dcm4wjwp7bycxtbg79-779338-2024-06-18"3600
TXT"google-site-verification=6gcF4cfjOUgFYhjdy7eSaH3SoMbVOHOKZeFOutZVe9U"3600
TXT"google-site-verification=7_O32Ety40FmOdRhaCEZVIYvpZh4v40lKiCcvGiSQW8"3600
TXT"google-site-verification=JuuU90sZtDvh5_3Bc_YlxfWVGh9yyla1s792UOGaqGA"3600
TXT"google-site-verification=M0HNPvI_P1oVKPyPlcJqGmf4xQH46Bv9XW1nqQgqD8Y"3600
TXT"google-site-verification=oRRyLGovco_DHy7x0bFowdPSSTr1P72mC1FMTCJ7YVE"3600
TXT"google-site-verification=rclYg_BXSQFAB9VAeIb7Ow6Lhj4hafU_LLJ0cVFef_g"3600
TXT"google-site-verification=wZBdxXyemkIuBovZudh2seHj5olMIg1nAgvl3rBn-zc"3600
TXT"apple-domain-verification=uSkXEoTiBeBHs4b-lI8c1cumxMfOQ7Cgicojbo9Dqs8"3600
TXT"+NSUrW4oGrKWmn1NIit/gBJ/Rg2PxuYcUR6z7gMfepDbf+vX7yUhetiMZW/wv8ihKJ2bxpW1kjvEJM+PztKtVg=="3600
TXT"EuQeC19tDVTNod3Ump5GMd48jgYq2o9i4cnkRL47C2bnXwdXBfFv8ZZ7Abvq3lxqyBk6QpHcqXKezOAueHSqpA=="3600
TXT"adobe-idp-site-verification=8fd1699420bba5b18ccc70995cd45d5197ce311bb35422e0f260eff60d8107e8"3600
TXT"atlassian-domain-verification=zHam6v0BW+0eE/hkKTRVvmu/JkqZfMdDpAebwVPQVK8lyb/KiS4Ol4WLgumoIvI8"3600
TXT"_smtp._tls.rituals.com. IN TXT \"v=TLSRPTv1; rua=mailto:7505cab7b3ca397@tlsrpt.de.mimecastdmarcanalyzer.com"3600
CAA0 iodef "mailto:hqict@rituals.com"300
CAA0 issue "amazonaws.com"300
CAA0 issue "digicert.com"300
CAA0 issue "letsencrypt.org"300
CAA0 issue "pki.goog"300
CAA0 issue "sectigo.com"300
CAA0 issue "trustproviderbv.digitalcertvalidation.com"300

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (54s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 5m; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • ✓ CAA restricts issuance #35
    Certificates may be issued by: amazonaws.com, digicert.com, letsencrypt.org, pki.goog, sectigo.com, trustproviderbv.digitalcertvalidation.com.