Domain report: subway.com

Registration

info

.com generic · CSC Corporate Domains, Inc. · expires 2027-01-18

Found

TLD: .com (generic)
ICANN policies apply: yes
Registrar: CSC Corporate Domains, Inc.
Registered: 17 January 1996
Last changed: 14 January 2026
Expires: 18 January 2027
Status: client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers: a1-109.akam.net, a11-65.akam.net, a13-65.akam.net, a16-66.akam.net, a6-64.akam.net, a8-66.akam.net
RDAP server: https://rdap.verisign.com/com/v1/

Checks

i

.com is a generic TLD (gTLD)

Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.

#1
✓ TLD delegated and signed #2

.com is delegated in the root zone and DNSSEC-signed.
✓ Expires on 2027-01-18 #3

The registration is valid until 2027-01-18 (87 days).
✓ Transfer locked #4

Registry status: client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
✓ Registry and delegation match #5

The nameservers registered at the registry are the ones published in DNS.

Delegation

info

a1-109.akam.net, a11-65.akam.net, a13-65.akam.net, a16-66.akam.net, a6-64.akam.net, a8-66.akam.net

Found

Parent zone: com
Delegation from: a.gtld-servers.net (192.5.6.30)
NS at the parent: a1-109.akam.net, a11-65.akam.net, a13-65.akam.net, a16-66.akam.net, a6-64.akam.net, a8-66.akam.net
NS in the zone: a1-109.akam.net, a11-65.akam.net, a13-65.akam.net, a16-66.akam.net, a6-64.akam.net, a8-66.akam.net

Nameserver	Addresses	Network (AS)	Glue
a1-109.akam.net	193.108.91.109 2600:1401:2::6d	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a11-65.akam.net	84.53.139.65 2600:1480:1::41	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a13-65.akam.net	2.22.230.65 2600:1480:800::41	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a16-66.akam.net	23.211.132.66 2600:1406:1b::42	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a6-64.akam.net	23.211.133.64 2600:1401:1::40	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
a8-66.akam.net	2.16.40.66 2600:1403:a::42	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-

Checks

✓ 6 nameservers #6

Delegated to a1-109.akam.net, a11-65.akam.net, a13-65.akam.net, a16-66.akam.net, a6-64.akam.net, a8-66.akam.net.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 6 IPv4 /24s and 6 IPv6 /48s.
i

All nameservers in one AS

All nameserver addresses are announced by one network operator (AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 12 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.

#11
i

All nameserver names under .net

All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

#12
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

Nameservers

warn

12 of 12 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
a1-109.akam.net 193.108.91.109	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.7
a1-109.akam.net 2600:1401:2::6d	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.11
a11-65.akam.net 84.53.139.65	NOERROR, 6 ms, authoritative	no	yes / yes	refused	41824.4
a11-65.akam.net 2600:1480:1::41	NOERROR, 5 ms, authoritative	no	yes / yes	refused	41824.9
a13-65.akam.net 2.22.230.65	NOERROR, 7 ms, authoritative	no	yes / yes	refused	41824.11
a13-65.akam.net 2600:1480:800::41	NOERROR, 6 ms, authoritative	no	yes / yes	refused	41824.7
a16-66.akam.net 23.211.132.66	NOERROR, 7 ms, authoritative	no	yes / yes	refused	48878.31
a16-66.akam.net 2600:1406:1b::42	NOERROR, 7 ms, authoritative	no	yes / yes	refused	48878.29
a6-64.akam.net 23.211.133.64	NOERROR, 7 ms, authoritative	no	yes / yes	refused	48878.32
a6-64.akam.net 2600:1401:1::40	NOERROR, 7 ms, authoritative	no	yes / yes	refused	48878.27
a8-66.akam.net 2.16.40.66	NOERROR, 6 ms, authoritative	no	yes / yes	refused	48878.26
a8-66.akam.net 2600:1403:a::42	NOERROR, 7 ms, authoritative	no	yes / yes	refused	48878.27

Checks

✓ All respond #14

All 12 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
!

Software version disclosed

These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: a1-109.akam.net: "41824.7"; a1-109.akam.net: "41824.11"; a11-65.akam.net: "41824.4"; a11-65.akam.net: "41824.9"; a13-65.akam.net: "41824.11"; a13-65.akam.net: "41824.7"; a16-66.akam.net: "48878.31"; a16-66.akam.net: "48878.29"; a6-64.akam.net: "48878.32"; a6-64.akam.net: "48878.27"; a8-66.akam.net: "48878.26"; a8-66.akam.net: "48878.27". Hide or replace the version string.

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

warn

serial 2007076285 · primary a1-109.akam.net

Found

Primary (MNAME): a1-109.akam.net
Contact (RNAME): hostmaster.subway.com
Serial: 2007076285
Refresh / retry: 3600 s / 600 s
Expire: 604800 s
Negative TTL: 60 s

Serial per nameserver

Nameserver	Serial
a1-109.akam.net (193.108.91.109)	2007076285
a1-109.akam.net (2600:1401:2::6d)	2007076285
a11-65.akam.net (84.53.139.65)	2007076285
a11-65.akam.net (2600:1480:1::41)	2007076285
a13-65.akam.net (2.22.230.65)	2007076285
a13-65.akam.net (2600:1480:800::41)	2007076285
a16-66.akam.net (23.211.132.66)	2007076285
a16-66.akam.net (2600:1406:1b::42)	2007076285
a6-64.akam.net (23.211.133.64)	2007076285
a6-64.akam.net (2600:1401:1::40)	2007076285
a8-66.akam.net (2.16.40.66)	2007076285
a8-66.akam.net (2600:1403:a::42)	2007076285

Checks

✓ Serial 2007076285 everywhere #22

All nameservers serve the same version of the zone.
!

Unusual SOA timers

negative caching TTL (minimum) 1m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 1h, retry 10m, expire 7d, negative TTL 1m.

#23
✓ Primary is a public nameserver #24

The primary nameserver a1-109.akam.net is one of the listed nameservers.
✓ Contact hostmaster@subway.com #25

The SOA RNAME hostmaster.subway.com means hostmaster@subway.com.
✓ Timestamp serial #26

The serial 2007076285 is a Unix timestamp (2033-08-08 01:11 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

warn

60 records at the apex

Found

Read from: 193.108.91.109:53

Type	Value	TTL
SOA	a1-109.akam.net. hostmaster.subway.com. 2007076285 3600 600 604800 60	21600
NS	a6-64.akam.net.	86400
NS	a11-65.akam.net.	86400
NS	a8-66.akam.net.	86400
NS	a1-109.akam.net.	86400
NS	a16-66.akam.net.	86400
NS	a13-65.akam.net.	86400
A	104.101.253.66	20
AAAA	2a02:26f0:b700:392::2989	20
AAAA	2a02:26f0:b700:384::2989	20
MX	10 fwh-mail-onmicrosoft-com.mail.protection.outlook.com.	3600
TXT	"amazonses:IVt2mlynAK3WsbvNCsXkHJ/Jwoec4Vn7PuhiYJpSGt8="	300
TXT	"MS=ms45332749"	300
TXT	"_wfmjcqncwns5kjc701z1274fe51b4p9"	300
TXT	"_xb3hf9ozq4ftpre79rej7cr3hdm9xnk"	300
TXT	"adobe-idp-site-verification=c780fdf0a32f6f8ca3d2aed6a01d69016c27b9182374f34214ba80e9ea81f931"	300
TXT	"apple-domain-verification=ZePlie9LX2l3lM7J"	300
TXT	"flfivcv809cpb8tv46a1ims5pa"	300
TXT	"d365mktkey=27h4szq8axqtjclmkrdhoydvx"	300
TXT	"_qqdjbhl6yfl1s6qu8m3rbju0h907lny"	300
TXT	"apple-domain-verification=b5CpkBhV8vIzZtP8"	300
TXT	"smartsheet-site-validation=WtEHNAAL4WG877SNeundsGrK2ks3oevQ"	300
TXT	"docusign=5d070834-6746-415f-8a1c-48a729c4928e"	300
TXT	"onetrust-domain-verification=0423cc8be9fc48a6a8221dbb3b6df59d"	300
TXT	"cloudhealth=b7d0679d-5571-410b-8073-7c7483a0aed9"	300
TXT	"ecostruxure-it-verification=650a765a-c7dc-49a6-85ef-63d7ae790f21"	300
TXT	"v7cehmoklrdicplaf13ac8k2ua"	300
TXT	"3bcvb797i9bokin5jdb6np2r3k"	300
TXT	"Dynatrace-site-verification=da9ae839-07f7-479f-a048-f3c40b64337c__ovr7cl3o83h6v8k6sgf7qac8nt"	300
TXT	"amazonses:WouvrcaLNwm9MeOA8mPHl3iSO4PJt4GRJpbhFF3crDw="	300
TXT	"v=spf1 mx include:spf.protection.outlook.com ~all"	300
TXT	"_rrkgo7ymt9tvgtbyc18htgca1uymclb"	300
TXT	"Dynatrace-site-verification=37764e30-4ee4-403b-a66b-f2dacc3a7734__6vthkjdn478aftj5kmo2ghajeo"	300
TXT	"CpWwpQX5DV75F+ZKWAyCyNDUxbYo4InxXeA0PTtdjTCuoo1nm1F6BnEU/LMCxoQsHSQEcffbI4tufAWu8lwICw=="	300
TXT	"facebook-domain-verification=9411x4korp3etqeg7zd5ihfmhimgbz"	300
TXT	"EmEjLLL4QADoazTzqtvan1bv6YMyVFwGL2jNXpikJzhI8o//7A6fOpAcg1iqih5QidRx9U0i2lae15h3PWY8Xw=="	300
TXT	"_m9mz38zyi79jntjchyy474p39sqhp2k"	300
TXT	"amazonses:rfeDc6IPwWwqIeXxLTkMIFIehh1+o5FR+AEIBPo+aDM="	300
TXT	"amazonses:lQ7e4of+cGMztoZEmpEpxOv439FwHEC4BXhcspQhdY4="	300
TXT	"onetrust-domain-verification=e353972587624065aec066201135b725"	300
TXT	"postman-domain-verification=5e170be124ac49506592a4877255b533a56f7ed12bd9259f527d78c5695bca99401d8fef051f767bb7bd04e7f228acd25151145fb954cecb801f09372715b1f6"	300
TXT	"GtuUJJbOSsufY0shVDZxs5FXpBrxJCCVyF/V3rBqKtzqdGEdfAfFd/cx8n7J71VUE1GGoDLjFYW44q5uEmZ0UQ=="	300
TXT	"anthropic-domain-verification-111pyz=1nPjXqAfargZnEgGLARKRSDUr"	300
TXT	"google-site-verification=bUgaQaOMKw_x8QqEELf8-07tgm1Rk0ojsUl0wJr7qJ8"	300
TXT	"d365mktkey=4vh8zlupmija2mggwyfzad1yv"	300
TXT	"2paqitupt4v2gfj371i85act53"	300
TXT	"jamf-site-verification=8LRBBQ03vXBLvd73kMnJfA"	300
TXT	"_o4x70rw643ior6dk07wcma2wa5lv4al"	300
TXT	"tlJrgGGNYW1T6TOpf3LBRcwsOaS3gelSZgfy60SdzvpTW5WpiAHY4v/hdv/R7WxtcYJ7HF1bBKjSFk7iX6T2tA=="	300
TXT	"apple-domain-verification=oeE28ZHe_eQoKq4vPnj1g-ZEqQBgf55X9GyfpeOh5qs"	300
CAA	0 issue "amazon.com"	21600
CAA	0 issue "godaddy.com"	21600
CAA	0 issue "letsencrypt.org"	21600
CAA	0 issue "sectigo.com"	21600
CAA	0 issue "amazonaws.com"	21600
CAA	0 issue "pki.goog"	21600
CAA	0 issue "digicert.com"	21600
CAA	0 iodef "\"mailto:sysadmin@subway.com\""	21600
CAA	0 issue "awstrust.com"	21600
CAA	0 issue "amazontrust.com"	21600

Checks

!

Very low TTLs

These records have a TTL below 5m, causing extra queries and slower lookups: A (20s), AAAA (20s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.

#32
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
✓ CAA restricts issuance #35

Certificates may be issued by: amazon.com, godaddy.com, letsencrypt.org, sectigo.com, amazonaws.com, pki.goog, digicert.com, awstrust.com, amazontrust.com.