selor.be

Checked 22 October 2026, 07:10 UTC · via 8.8.8.8
✗Problems found
18 passed 4 warnings 1 failed 6 info

Registration

info

.be country-code

Found

TLD
.be (country-code)
ICANN policies apply
no

Checks

  • i
    .be is a country-code TLD (ccTLD)
    Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.
    #1
  • ✓ TLD delegated and signed #2
    .be is delegated in the root zone and DNSSEC-signed.
  • i
    Registration data not available
    No registration data via RDAP: the registry of .be offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.
    #3

Delegation

fail

ns1.belnet.be, ns2.belnet.be, ns3.belnet.be, ns3.selor.be

Found

Parent zone
be
Delegation from
a.nsset.be (194.0.6.1)
NS at the parent
ns1.belnet.be, ns2.belnet.be, ns3.belnet.be, ns3.selor.be
NS in the zone
ns1.belnet.be, ns2.belnet.be, ns3.belnet.be, ns3.selor.be, sprodads005.selorp.local, sprodads006.selorp.local
NameserverAddressesNetwork (AS)Glue
ns1.belnet.be193.190.198.14 2001:6a8:3c80::14AS2611 BELNET - BELNET, BE AS2611 BELNET - BELNET, BE193.190.198.14 2001:6a8:3c80::14
ns2.belnet.be193.190.182.40 2001:6a8:3c80:c000::40AS2611 BELNET - BELNET, BE AS2611 BELNET - BELNET, BE193.190.182.40 2001:6a8:3c80:c000::40
ns3.belnet.be194.58.196.32 2a01:3f1:832::53AS8674 NETNOD-IX - Netnod AB, SE AS8674 NETNOD-IX - Netnod AB, SE194.58.196.32 2a01:3f1:832::53
ns3.selor.be193.191.209.107AS2611 BELNET - BELNET, BE193.191.209.107
sprodads005.selorp.local (zone only)(does not resolve)-
sprodads006.selorp.local (zone only)(does not resolve)-

Checks

  • ✓ 4 nameservers #6
    Delegated to ns1.belnet.be, ns2.belnet.be, ns3.belnet.be, ns3.selor.be.
  • !
    NS sets differ
    The nameservers at the parent and in the zone should be the same. Only in the zone: sprodads005.selorp.local, sprodads006.selorp.local. ns1.belnet.be, ns2.belnet.be, ns3.belnet.be, ns3.selor.be report NS ns1.belnet.be ns2.belnet.be ns3.belnet.be ns3.selor.be sprodads005.selorp.local sprodads006.selorp.local.
    #7
  • ✓ Glue present and correct #8
    Glue is published for the nameservers inside the zone: ns3.selor.be.
  • ✗
    Nameserver names don't resolve
    These nameservers have no A or AAAA record, so they can't be reached (lame delegation): sprodads005.selorp.local, sprodads006.selorp.local.
    #9
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 4 IPv4 /24s and 2 IPv6 /48s.
  • ✓ 2 autonomous systems #11
    The nameservers are spread over: AS2611 (BELNET - BELNET, BE): 5 addresses; AS8674 (NETNOD-IX - Netnod AB, SE): 2 addresses.
  • i
    All nameserver names under .be
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • i
    Partly IPv6
    These nameservers have no IPv6 address: ns3.selor.be.
    #13

Nameservers

warn

7 of 7 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns1.belnet.be 193.190.198.14NOERROR, 17 ms, authoritativenoyes / yesrefusedFor me to know, for you to guess!
ns1.belnet.be 2001:6a8:3c80::14NOERROR, 14 ms, authoritativenoyes / yesrefusedFor me to know, for you to guess!
ns2.belnet.be 193.190.182.40NOERROR, 14 ms, authoritativenoyes / yesrefused-
ns2.belnet.be 2001:6a8:3c80:c000::40NOERROR, 14 ms, authoritativenoyes / yesrefused-
ns3.belnet.be 194.58.196.32NOERROR, 8 ms, authoritativenoyes / yesrefused-
ns3.belnet.be 2a01:3f1:832::53NOERROR, 9 ms, authoritativenoyes / yesrefused-
ns3.selor.be 193.191.209.107NOERROR, 14 ms, authoritativenoyes / yesrefusedMicrosoft DNS 6.1.7601 (1DB15F75)

Checks

  • ✓ All respond #14
    All 7 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: ns3.selor.be: "Microsoft DNS 6.1.7601 (1DB15F75)". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

info

serial 1283 · primary sprodads005

Found

Primary (MNAME)
sprodads005
Contact (RNAME)
ict.selor.be
Serial
1283
Refresh / retry
1800 s / 600 s
Expire
1209600 s
Negative TTL
14400 s

Serial per nameserver

NameserverSerial
ns1.belnet.be (193.190.198.14)1283
ns1.belnet.be (2001:6a8:3c80::14)1283
ns2.belnet.be (193.190.182.40)1283
ns2.belnet.be (2001:6a8:3c80:c000::40)1283
ns3.belnet.be (194.58.196.32)1283
ns3.belnet.be (2a01:3f1:832::53)1283
ns3.selor.be (193.191.209.107)1283

Checks

  • ✓ Serial 1283 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 30m, retry 10m, expire 14d, negative TTL 4h.
  • i
    Hidden master (not resolvable)
    The primary nameserver sprodads005 is not listed as a nameserver and does not resolve publicly: a hidden master, or a placeholder name. Some tools (e.g. dynamic updates) use MNAME to find the primary.
    #24
  • ✓ Contact ict@selor.be #25
    The SOA RNAME ict.selor.be means ict@selor.be.
  • ✓ Counter serial #26
    The serial 1283 is a plain counter.

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

15 records at the apex

Found

Read from
193.190.198.14:53
TypeValueTTL
SOAsprodads005. ict.selor.be. 1283 1800 600 1209600 14400300
NSns2.belnet.be.180
NSns3.selor.be.180
NSns3.belnet.be.180
NSsprodads005.selorp.local.180
NSsprodads006.selorp.local.180
NSns1.belnet.be.180
A193.191.245.121300
AAAA2a01:690:35:100::f5:7914400
MX10 mailgate.fediap.be.14400
TXT"v=spf1 include:spf.smtp2go.com include:spf.fediap.be include:spf.addemar.com ip4:193.191.209.69 ip4:193.191.209.126 ip4:193.191.209.65 include:spf.protection.outlook.com -all"14400
TXT"HARICA-rSMmFBaYlYh0DheVZVa"14400
TXT"MS=ms28932933"14400
TXT"/8MIDA4++/BSJPW+9OmDR1rECrFcgUgf5s87F40aNzg="14400
TXT"62cc5c1394f84cac86f0337674d6fd77"14400

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: NS (3m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 1d and in the zone 3m; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35