theguardian.com

Checked 22 October 2026, 11:02 UTC · via 8.8.8.8
!Passed with warnings
26 passed 1 warning 0 failed 4 info

Registration

info

.com generic · GoDaddy.com, LLC · expires 2027-07-05

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
GoDaddy.com, LLC
Registered
6 July 1994
Last changed
5 July 2026
Expires
5 July 2027
Status
client delete prohibited, client renew prohibited, client transfer prohibited, client update prohibited
Registry nameservers
dns1.p04.nsone.net, dns2.p04.nsone.net, dns3.p04.nsone.net, dns4.p04.nsone.net, ns01.theguardiandns.com, ns02.theguardiandns.com, ns03.theguardiandns.com, ns04.theguardiandns.com
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-07-05 #3
    The registration is valid until 2027-07-05 (255 days).
  • ✓ Transfer locked #4
    Registry status: client delete prohibited, client renew prohibited, client transfer prohibited, client update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

dns1.p04.nsone.net, dns2.p04.nsone.net, dns3.p04.nsone.net, dns4.p04.nsone.net, ns01.theguardiandns.com, ns02.theguardiandns.com, ns03.theguardiandns.com, ns04.theguardiandns.com

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
dns1.p04.nsone.net, dns2.p04.nsone.net, dns3.p04.nsone.net, dns4.p04.nsone.net, ns01.theguardiandns.com, ns02.theguardiandns.com, ns03.theguardiandns.com, ns04.theguardiandns.com
NS in the zone
dns1.p04.nsone.net, dns2.p04.nsone.net, dns3.p04.nsone.net, dns4.p04.nsone.net, ns01.theguardiandns.com, ns02.theguardiandns.com, ns03.theguardiandns.com, ns04.theguardiandns.com
NameserverAddressesNetwork (AS)Glue
dns1.p04.nsone.net198.51.44.4 2620:4d:4000:6259:7:4:0:1AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US-
dns2.p04.nsone.net198.51.45.4 2a00:edc0:6259:7:4::2AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US-
dns3.p04.nsone.net198.51.44.68 2620:4d:4000:6259:7:4:0:3AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US-
dns4.p04.nsone.net198.51.45.68 2a00:edc0:6259:7:4::4AS62597 NSONE - NSONE Inc, US AS62597 NSONE - NSONE Inc, US-
ns01.theguardiandns.com45.54.51.1AS63911 NETACTUATE-AS-AP - NetActuate, Inc, US45.54.51.1
ns02.theguardiandns.com45.54.51.65AS63911 NETACTUATE-AS-AP - NetActuate, Inc, US45.54.51.65
ns03.theguardiandns.com45.54.51.129AS63911 NETACTUATE-AS-AP - NetActuate, Inc, US45.54.51.129
ns04.theguardiandns.com45.54.51.193AS63911 NETACTUATE-AS-AP - NetActuate, Inc, US45.54.51.193

Checks

  • ✓ 8 nameservers #6
    Delegated to dns1.p04.nsone.net, dns2.p04.nsone.net, dns3.p04.nsone.net, dns4.p04.nsone.net, ns01.theguardiandns.com, ns02.theguardiandns.com, ns03.theguardiandns.com, ns04.theguardiandns.com.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 3 IPv4 /24s and 2 IPv6 /48s.
  • ✓ 2 autonomous systems #11
    The nameservers are spread over: AS62597 (NSONE - NSONE Inc, US): 8 addresses; AS63911 (NETACTUATE-AS-AP - NetActuate, Inc, US): 4 addresses.
  • ✓ Nameserver names under 2 TLDs #12
    Nameserver names use the TLDs .com, .net.
  • i
    Partly IPv6
    These nameservers have no IPv6 address: ns01.theguardiandns.com, ns02.theguardiandns.com, ns03.theguardiandns.com, ns04.theguardiandns.com.
    #13

Nameservers

info

12 of 12 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
dns1.p04.nsone.net 198.51.44.4NOERROR, 4 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns1.p04.nsone.net 2620:4d:4000:6259:7:4:0:1NOERROR, 6 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns2.p04.nsone.net 198.51.45.4NOERROR, 4 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns2.p04.nsone.net 2a00:edc0:6259:7:4::2NOERROR, 6 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns3.p04.nsone.net 198.51.44.68NOERROR, 4 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns3.p04.nsone.net 2620:4d:4000:6259:7:4:0:3NOERROR, 4 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns4.p04.nsone.net 198.51.45.68NOERROR, 4 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
dns4.p04.nsone.net 2a00:edc0:6259:7:4::4NOERROR, 7 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
ns01.theguardiandns.com 45.54.51.1NOERROR, 16 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
ns02.theguardiandns.com 45.54.51.65NOERROR, 16 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
ns03.theguardiandns.com 45.54.51.129NOERROR, 16 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9
ns04.theguardiandns.com 45.54.51.193NOERROR, 20 ms, authoritativenoyes / yesrefused19dd46e347df36b70933bf2be8023258586586a9

Checks

  • ✓ All respond #14
    All 12 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • i
    Identifying string disclosed
    These nameservers answer version queries with a string that is not a version number: dns1.p04.nsone.net: "19dd46e347df36b70933bf2be8023258586586a9"; dns2.p04.nsone.net: "19dd46e347df36b70933bf2be8023258586586a9"; dns3.p04.nsone.net: "19dd46e347df36b70933bf2be8023258586586a9"; dns4.p04.nsone.net: "19dd46e347df36b70933bf2be8023258586586a9"; ns01.theguardiandns.com: "19dd46e347df36b70933bf2be8023258586586a9"; ns02.theguardiandns.com: "19dd46e347df36b70933bf2be8023258586586a9"; ns03.theguardiandns.com: "19dd46e347df36b70933bf2be8023258586586a9"; ns04.theguardiandns.com: "19dd46e347df36b70933bf2be8023258586586a9".
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 1648114615 · primary dns1.p04.nsone.net

Found

Primary (MNAME)
dns1.p04.nsone.net
Contact (RNAME)
hostmaster.nsone.net
Serial
1648114615
Refresh / retry
3600 s / 600 s
Expire
604800 s
Negative TTL
3600 s

Serial per nameserver

NameserverSerial
dns1.p04.nsone.net (198.51.44.4)1648114615
dns1.p04.nsone.net (2620:4d:4000:6259:7:4:0:1)1648114615
dns2.p04.nsone.net (198.51.45.4)1648114615
dns2.p04.nsone.net (2a00:edc0:6259:7:4::2)1648114615
dns3.p04.nsone.net (198.51.44.68)1648114615
dns3.p04.nsone.net (2620:4d:4000:6259:7:4:0:3)1648114615
dns4.p04.nsone.net (198.51.45.68)1648114615
dns4.p04.nsone.net (2a00:edc0:6259:7:4::4)1648114615
ns01.theguardiandns.com (45.54.51.1)1648114615
ns02.theguardiandns.com (45.54.51.65)1648114615
ns03.theguardiandns.com (45.54.51.129)1648114615
ns04.theguardiandns.com (45.54.51.193)1648114615

Checks

  • ✓ Serial 1648114615 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 1h, retry 10m, expire 7d, negative TTL 1h.
  • ✓ Primary is a public nameserver #24
    The primary nameserver dns1.p04.nsone.net is one of the listed nameservers.
  • ✓ Contact hostmaster@nsone.net #25
    The SOA RNAME hostmaster.nsone.net means hostmaster@nsone.net.
  • ✓ Timestamp serial #26
    The serial 1648114615 is a Unix timestamp (2022-03-24 09:36 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

info

57 records at the apex

Found

Read from
198.51.44.4:53
TypeValueTTL
SOAdns1.p04.nsone.net. hostmaster.nsone.net. 1648114615 3600 600 604800 36003600
NSdns1.p04.nsone.net.3600
NSdns2.p04.nsone.net.3600
NSdns3.p04.nsone.net.3600
NSdns4.p04.nsone.net.3600
NSns01.theguardiandns.com.3600
NSns02.theguardiandns.com.3600
NSns03.theguardiandns.com.3600
NSns04.theguardiandns.com.3600
A151.101.1.1113600
A151.101.65.1113600
A151.101.129.1113600
A151.101.193.1113600
AAAA2a04:4e42::3673600
AAAA2a04:4e42:200::3673600
AAAA2a04:4e42:400::3673600
AAAA2a04:4e42:600::3673600
MX10 aspmx.l.google.com.14400
MX30 alt4.aspmx.l.google.com.14400
MX30 alt3.aspmx.l.google.com.14400
MX20 alt2.aspmx.l.google.com.14400
MX20 alt1.aspmx.l.google.com.14400
TXT"google-site-verification=6-wiFtmcPHY78jVuZUE3io1c6c9SrSyjPVmUr7XRW2I"300
TXT"google-site-verification=9SMJbNVsYm0GCVZbGVOMSzXajrK_pqVtjW3P007kaQo"300
TXT"google-site-verification=I3xSjID5V7E9UDa3WSvvvpCqiqw1_34kG1Y_rz5dlV4"300
TXT"facebook-domain-verification=9qqmd2kl745hph02i64iyoxvdphmi9"300
TXT"brave-ledger-verification=7e309ab3cd9203b886205458254a13f930f79821ea05031742f7dfc9285370c8"300
TXT"adobe-idp-site-verification=af3ef20fdc1d370aee02414a73ce0db9f1b465c21d53a369080184cd8e4b60f1"300
TXT"google-site-verification=ujq5XlF5Ty7dwXv7S3AV99WRr8IwetZIjNqqloPpKmA"300
TXT"google-site-verification=M9Q_QcvQQCoQEca1--d55J0QKwKZt0XgAAj9DJrJ0jQ"300
TXT"pardot709753=1cfbb8fa5dabcb6befc9faa15661f500a64a6f22eb83bb146848633dbe7633cf"300
TXT"amazonses:2s68hEXFIHnDWOVNuEbZ06pSFJhN0qCtTx8lztmngls="300
TXT"google-site-verification=IU-vqTBscxkgU3J_f5i10_i624mvE3IjvYpeVPB2A98"300
TXT"apple-domain-verification=sVI2atim1Brh4UUx\010"300
TXT"google-site-verification=4l7NequdA4a20U0D9YSw7ENlF69-hDeHXx21aU2UUC0"300
TXT"apple-domain-verification=4qbvNZKyKKZyBtdU"300
TXT"MS=ms94953828"300
TXT"MS=B95E020056873FBC8A077EEE2104192B3DBC1D61"300
TXT"docusign=1f00efb3-0975-459c-b221-e46452a0f92a"300
TXT"intersight=123333260936a76db6d9dedc01d0ab4d61a9aae47515abbf0087e02a395747f9"300
TXT"RDOAB9Z9GAJESXAA11TST3LEI0RN5LQ4TES408NS"300
TXT"google-site-verification=iLS6vcS8qLmM07nG-W_M3TAmaSEAAwoLBKovJCGOrOs"300
TXT"google-site-verification=LCHObeC_7NyDBnXVNSqm5VJAve2qxx04PmUFc697Rf0"300
TXT"73t2Qr1jv9^4RG3CsYKp#F&^5S1fxpHtq9X5bLBQtc4q2PhMvMBmUrIh%LLGPb3V!XpnW9tvQd$tg^rLv!8ALDOQhhss%c9K%Xt"300
TXT"docker-verification=42d9d88d-f950-4407-a675-3d843c16a983"300
TXT"onetrust-domain-verification=ce4031d6f7b94fdb9ed409ab9cf643d3"300
TXT"stripe-verification=85178DB4E6F4EC41721B7F20BD9F04B21E2B630ADA8156BDFE421272EBC2056F"300
TXT"openai-domain-verification=dv-m8f1SR7Sj1HI4BIM0XsZAOxx"300
TXT"formstack-domain-verification=0cc5b58e5ea4088ab9333fcd9721a72f"300
TXT"v=spf1 include:_spf.google.com include:spf_c.oraclecloud.com include:_spf.salesforce.com include:_spf1.theguardian.com ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ip4:69.169.224.0/20 ip4:23.249.208.0/20 ip4:23.251.224.0/19 ip4:76.223.176.0" "/20 ip4:54.240.64.0/18 ip4:76.223.128.0/19 ip4:216.221.160.0/19 ip4:206.55.144.0/20 ip4:24.110.64.0/18 -all"300
TXT"asv=d971bc0397a95b5da450b9bfbad1212a"300
TXT"lucidlink-verification=4K96N0ZDHCHPKDZ538AFRVH54G"300
TXT"miro-verification=9bbe1ce0f13ab2efbbda64d44bd0db3c1f17fd60"300
TXT"cisco-ci-domain-verification=394bd3979592402fa40244fcf11f48e5e5014697e1f7e8587eba08075cdd79e3"300
TXT"_hfmu2x1szay737kpys7nmqjko311kxu"300
TXT"multiverse-domain-verification=3e7e7acf-12cc-4934-a23a-b8c0127fb091"300
TXT"slack-domain-verification=K3gfZj51sHXR6hxk5BVVfunkmGnHxc4NvwNtqo77"300

Checks

  • ✓ TTLs within range #32
    TTLs: A 1h, AAAA 1h, MX 4h, NS 1h. The NS TTL at the parent is 2d and in the zone 1h; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35