rolex.com

Checked 22 October 2026, 10:32 UTC · via 8.8.8.8
!Passed with warnings
28 passed 1 warning 0 failed 6 info

Registration

info

.com generic · Key-Systems GmbH · expires 2036-08-19

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
Key-Systems GmbH
Registered
20 August 1998
Last changed
3 September 2026
Expires
19 August 2036
Status
client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers
dns1.p03.nsone.net, dns2.p03.nsone.net, dns3.p03.nsone.net, dns4.p03.nsone.net
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2036-08-19 #3
    The registration is valid until 2036-08-19 (3588 days).
  • ✓ Transfer locked #4
    Registry status: client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

dns1.p03.nsone.net, dns2.p03.nsone.net, dns3.p03.nsone.net, dns4.p03.nsone.net

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
dns1.p03.nsone.net, dns2.p03.nsone.net, dns3.p03.nsone.net, dns4.p03.nsone.net
NS in the zone
dns1.p03.nsone.net, dns2.p03.nsone.net, dns3.p03.nsone.net, dns4.p03.nsone.net
NameserverAddressesNetwork (AS)Glue
dns1.p03.nsone.net198.51.44.3 2620:4d:4000:6259:7:3:0:1AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US-
dns2.p03.nsone.net198.51.45.3 2a00:edc0:6259:7:3::2AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US-
dns3.p03.nsone.net198.51.44.67 2620:4d:4000:6259:7:3:0:3AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US-
dns4.p03.nsone.net198.51.45.67 2a00:edc0:6259:7:3::4AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US-

Checks

  • ✓ 4 nameservers #6
    Delegated to dns1.p03.nsone.net, dns2.p03.nsone.net, dns3.p03.nsone.net, dns4.p03.nsone.net.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 2 IPv4 /24s and 2 IPv6 /48s.
  • i
    All nameservers in one AS
    All nameserver addresses are announced by one network operator (AS62597 (NSONE - NSONE Inc, US): 8 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.
    #11
  • i
    All nameserver names under .net
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

info

8 of 8 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
dns1.p03.nsone.net 198.51.44.3NOERROR, 4 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns1.p03.nsone.net 2620:4d:4000:6259:7:3:0:1NOERROR, 4 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns2.p03.nsone.net 198.51.45.3NOERROR, 4 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns2.p03.nsone.net 2a00:edc0:6259:7:3::2NOERROR, 4 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns3.p03.nsone.net 198.51.44.67NOERROR, 6 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns3.p03.nsone.net 2620:4d:4000:6259:7:3:0:3NOERROR, 7 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns4.p03.nsone.net 198.51.45.67NOERROR, 4 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns4.p03.nsone.net 2a00:edc0:6259:7:3::4NOERROR, 4 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9

Checks

  • ✓ All respond #14
    All 8 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • i
    Identifying string disclosed
    These nameservers answer version queries with a string that is not a version number: dns1.p03.nsone.net: "19dd46e347df36b70933bf2be8023258586586a9"; dns2.p03.nsone.net: "19dd46e347df36b70933bf2be8023258586586a9"; dns3.p03.nsone.net: "19dd46e347df36b70933bf2be8023258586586a9"; dns4.p03.nsone.net: "19dd46e347df36b70933bf2be8023258586586a9".
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 1648140797 · primary dns1.p03.nsone.net

Found

Primary (MNAME)
dns1.p03.nsone.net
Contact (RNAME)
hostmaster.nsone.net
Serial
1648140797
Refresh / retry
3600 s / 600 s
Expire
604800 s
Negative TTL
3600 s

Serial per nameserver

NameserverSerial
dns1.p03.nsone.net (198.51.44.3)1648140797
dns1.p03.nsone.net (2620:4d:4000:6259:7:3:0:1)1648140797
dns2.p03.nsone.net (198.51.45.3)1648140797
dns2.p03.nsone.net (2a00:edc0:6259:7:3::2)1648140797
dns3.p03.nsone.net (198.51.44.67)1648140797
dns3.p03.nsone.net (2620:4d:4000:6259:7:3:0:3)1648140797
dns4.p03.nsone.net (198.51.45.67)1648140797
dns4.p03.nsone.net (2a00:edc0:6259:7:3::4)1648140797

Checks

  • ✓ Serial 1648140797 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 1h, retry 10m, expire 7d, negative TTL 1h.
  • ✓ Primary is a public nameserver #24
    The primary nameserver dns1.p03.nsone.net is one of the listed nameservers.
  • ✓ Contact hostmaster@nsone.net #25
    The SOA RNAME hostmaster.nsone.net means hostmaster@nsone.net.
  • ✓ Timestamp serial #26
    The serial 1648140797 is a Unix timestamp (2022-03-24 16:53 UTC).

DNSSEC

info

Signed, DS published at parent

Found

Validated by resolver
yes
Denial of existence
NSEC
Signatures valid until
23 October 2026

DS at the parent

Key tagAlgorithmDigestMatches a key
48553ECDSAP256SHA256 (13)SHA256 F7E88FCFC75E39AD…yes

DNSKEY in the zone

Key tagRoleAlgorithm
48553KSK (257)ECDSAP256SHA256 (13)
12196ZSK (256)ECDSAP256SHA256 (13)

Checks

  • ✓ Signed and validated #27
    The zone is signed, the parent publishes a DS record, and the resolver validates the answers.
  • ✓ DS matches a key #28
    The DS record at the parent matches a key in the zone: key tag 48553 (SHA256).
  • ✓ Modern algorithms #29
    Key algorithms: ECDSAP256SHA256 (13).
  • ✓ Short-lived signatures (online signing) #30
    Signatures are valid for 26h0m0s and created on demand; the current one was made at 2026-10-22 09:32 UTC and expires at 2026-10-23 11:32 UTC.
  • i
    NSEC
    The zone uses NSEC, so its full contents can be listed by walking the NSEC chain. That is fine unless the names are sensitive.
    #31

Records

warn

60 records at the apex

Found

Read from
198.51.44.3:53
TypeValueTTL
SOAdns1.p03.nsone.net. hostmaster.nsone.net. 1648140797 3600 600 604800 36003600
NSdns1.p03.nsone.net.3600
NSdns2.p03.nsone.net.3600
NSdns3.p03.nsone.net.3600
NSdns4.p03.nsone.net.3600
A2.16.241.22720
A2.16.241.20620
AAAA2a02:26f0:3400::1703:584220
AAAA2a02:26f0:3400::1703:582320
MX1 rolex-com.t-v1.mx.microsoft.60
TXT"v=spf1 include:spf.protection.outlook.com ip4:194.150.21.198/32 ip4:195.21.23.241/32 ip4:52.166.186.164/32 ip4:137.117.196.23/32 ip4:13.80.129.71/32 a:m1p.rolex.com a:m2p.rolex.com -all"300
TXT"2ghhrwtqxlf32gr5gv52mhjf0qflfqjz"300
TXT"Dynatrace-site-verification=ae453f0c-9541-47a0-a0c3-2e499f1bb134__4armukauqr41lmk682ebdk6eur"300
TXT"cisco-ci-domain-verification=6a1b1b53c2bb667f9343bc39f5552c0be81eb88471fe27897e080b6e5313ff65"300
TXT"fhzjt3m41qp93xn5d06nb2hfx5wxtgqq"300
TXT"adobe-idp-site-verification=5099abbd9d94160ec5ab5fc9471f88754178ccffb456de595de65e2bc0df6b18"300
TXT"google-site-verification=x0VyG-O0vGCQfqBtER1_SornXuNp9CoC05ZDCqWWjZU"300
TXT"d365mktkey=iiqrts9ffo869wd0q258mgb6"300
TXT"ZOOM_verify_4Ecf9HjPQtKnRyt5yQQlBQ"300
TXT"code-8cjZWv1bMu.rolex.com"300
TXT"iQFG0aqyMfgTmeyBjcA9ruTedgN+Wlif1FlD0K1N+L8rTYqv3F9egIyxLZisCm4uJNiYf3KB37ATBm9qBmpH+A=="300
TXT"atlassian-domain-verification=g5aaWmWrowiRkBKx5skDNhqILvlIQjz5KyhJPRIRckYSWGuuFl9jB7laNuiY7il/"300
TXT"invisionapp-verification=2212087184309908586730700111021435300832"300
TXT"d365mktkey=2cxxibehRTPMWnbNYNNd6hpMYI8DliVJ4fc4x6v8WWQx"300
TXT"d365mktkey=xqijsc9KJkCBjX9VG8sbey26iN78ZxINVTHaCYtx4gEx"300
TXT"d365mktkey=QcZzYgZH5YOmERrWOb9icIUcIf5QbLge3ssKbbXtoxkx"300
TXT"apple-domain-verification=WWn2AROxSDgMGdec"300
TXT"apple-domain-verification=vsLKQxTdb91HKmRw"300
TXT"docusign=7e6d5f2c-e6c3-4740-9725-11001e3e6112"300
TXT"pyf1hssbmdyr1q6257vvwk6pmthp3207"300
TXT"applause-verification:ab427a6d-95ea-42d5-bd33-6c841ab6508b"300
TXT"d365mktkey=u6JE0aaCOmxrwZ1BdoZIj8d91IOQnCxHW7KO3sunyqIx"300
TXT"d365mktkey=0Wcy3byYA5m7saxqxUVmVVKLEtDsKMcKuauxEmG72wQx"300
TXT"facebook-domain-verification=o6rtqq3rb6a8dk1o1v2whrmg0s5g59"300
TXT"qfxwdf6nqzb0ktkb651vf58vx8yt0vsw"300
TXT"skt3bzt03qk9rtwzjkmpv4ln8bv1hbgv"300
TXT"duo_sso_verification=og3O5NfzlsCym1cIayeoUgdQHy1QbbdP2PBn1jqkEcHpG1fnfjMPRpUi92ZOPfqL"300
TXT"airtable-verification=e64555f4b97390e0f7e6d73bb9b9e3ee"300
TXT"pexip-ms-tenant-domain-verification=8a4e56ce-b733-4785-9d95-dab641a310c2"300
TXT"monday-com-verification=6VEZ2LDAWLQm7O5nzj4z8jNzSgH6x0Lzo4yHfPpt8_o"300
TXT"_globalsign-domain-verification=AZGN4c9H6scV-Na7Od6SoFakW7cFpY1b1gi21ZCWsr"300
TXT"twilio-domain-verification=d28b65795f1c6a7e6d691d918ff4319b"300
TXT"_kkck0r1didzmax218oh7tnax0lykcia"300
TXT"figma-domain-verification=e4f81bc25c4ca28ff29c8147e3f88cdc9ecff27fc1934046eb1fea9acd659c31-1722038184"300
TXT"_globalsign-domain-verification=Qdso5DRRpAivz6dRl1SFykARAOePx0o6jrvke9x7C1"300
TXT"_1vsy8y7lpj5pwz0rnsx7dd2tdffti2v"300
TXT"Dynatrace-site-verification=55389db2-2b5c-471e-9929-dd590aa4325d__1cg4pp1eb7ci39onud7ir7no81"300
TXT"d365mktkey=Y8SbLgWXAjr4V7zczTMxHUiklRUgVOvxYXBY04U4UJ4x"300
TXT"d365mktkey=gH2Jkw8gVQg2g4emxV2M0x3GPwzXzLaXo3ldvN5BsXMx"300
TXT"ks-odr=59040ad6-2c9f-4f5a-9851-33043d833bb1"300
TXT"_zsohl06a0mxktuh46rjfiumyzbbj7ou"300
TXT"autodesk-domain-verification=-cnfIuXKwa2hemIkWOkb"300
TXT"lucidlink-verification=WP2E1EFZ84F158FN2A3CSV7QKM"300
TXT"lucidlink-verification=0JYAS1R7NT7P5A1C46SFKCPYPM"300
TXT"lucidlink-verification=KGJM2MSS0RA0D0EQ4DM0EKGBRG"300
TXT"lucidlink-verification=0SR1RFRMG74JGG5FS56C8N5C3W"300
TXT"lucidlink-verification=SR3A1MW6DZEPCHMW98A27X79SR"300
TXT"cloudflare_dashboard_sso=06b0928946a89490dd1902361b2ffef9"300
TXT"stripe-verification=94AC602BB6251EF36E8BDE2F73C382F5070D3BEDCCA8B753C3DAD401758E7257"300
TXT"_7594xfv0slacqh42mgihz9gw8rk3jut"300

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (20s), AAAA (20s), MX (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1h; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35