tom.com

Checked 22 October 2026, 11:10 UTC · via 8.8.8.8
✗Problems found
23 passed 4 warnings 1 failed 3 info

Registration

info

.com generic · Web Commerce Communications Limited dba WebNic.cc · expires 2030-12-08

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
Web Commerce Communications Limited dba WebNic.cc
Registered
13 March 1995
Last changed
23 April 2026
Expires
8 December 2030
Status
client delete prohibited, client transfer prohibited, client update prohibited
Registry nameservers
a.dnspod.com, b.dnspod.com, c.dnspod.com
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2030-12-08 #3
    The registration is valid until 2030-12-08 (1508 days).
  • ✓ Transfer locked #4
    Registry status: client delete prohibited, client transfer prohibited, client update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

a.dnspod.com, b.dnspod.com, c.dnspod.com

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
a.dnspod.com, b.dnspod.com, c.dnspod.com
NameserverAddressesNetwork (AS)Glue
a.dnspod.com (parent only)43.134.249.74 101.227.168.75 43.130.172.75 117.135.128.175AS132203 TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue, CN AS4811 CHINANET-SHANGHAI-MAN - China Telecom (Group), CN AS132203 TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue, CN AS24400 CMNET-V4shanghai-AS-AP - Shanghai Mobile Communications Co.,Ltd., CN101.227.168.75 117.135.128.175 43.130.172.75 43.134.249.74
b.dnspod.com (parent only)163.177.5.79 220.196.136.75 43.161.3.75AS136958 UNICOM-GuangZhou-IDC - China Unicom Guangdong IP network, CN AS140979 UNICOM-SHFT-IDC - China Unicom Shanghai FuTe IDC network, CN AS132203 TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue, CN163.177.5.79 220.196.136.75 43.161.3.75
c.dnspod.com (parent only)125.94.59.175 43.134.249.75 112.80.181.175AS4134 CHINANET-BACKBONE - No.31,Jin-rong Street, CN AS132203 TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue, CN AS4837 CHINA169-Backbone - CHINA UNICOM China169 Backbone, CN112.80.181.175 125.94.59.175 43.134.249.75

Checks

  • ✓ 3 nameservers #6
    Delegated to a.dnspod.com, b.dnspod.com, c.dnspod.com.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 9 IPv4 /24s and 0 IPv6 /48s.
  • ✓ 7 autonomous systems #11
    The nameservers are spread over: AS132203 (TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue, CN): 4 addresses; AS136958 (UNICOM-GuangZhou-IDC - China Unicom Guangdong IP network, CN): 1 address; AS140979 (UNICOM-SHFT-IDC - China Unicom Shanghai FuTe IDC network, CN): 1 address; AS24400 (CMNET-V4shanghai-AS-AP - Shanghai Mobile Communications Co.,Ltd., CN): 1 address; AS4134 (CHINANET-BACKBONE - No.31,Jin-rong Street, CN): 1 address; AS4811 (CHINANET-SHANGHAI-MAN - China Telecom (Group), CN): 1 address; AS4837 (CHINA169-Backbone - CHINA UNICOM China169 Backbone, CN): 1 address.
  • i
    All nameserver names under .com
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • !
    No IPv6
    None of the nameservers has an IPv6 address, so IPv6-only resolvers can't reach them.
    #13

Nameservers

warn

10 of 10 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
a.dnspod.com 43.134.249.74NOERROR, 162 ms, authoritativenoyes / yesrefusedDNSPod AUTHORITY DNS 7.3.2512.01
a.dnspod.com 101.227.168.75NOERROR, 228 ms, authoritativenoyes / yesrefusedDNSPod AUTHORITY DNS 7.3.2512.01
a.dnspod.com 43.130.172.75NOERROR, 100 ms, authoritativenoyes / yesrefusedDNSPod AUTHORITY DNS 7.3.2512.01
a.dnspod.com 117.135.128.175NOERROR, 156 ms, authoritativenoyes / yesrefusedDNSPod AUTHORITY DNS 7.3.2512.00
b.dnspod.com 163.177.5.79NOERROR, 228 ms, authoritativenoyes / yesrefusedDNSPod AUTHORITY DNS 7.3.2512.00
b.dnspod.com 220.196.136.75NOERROR, 163 ms, authoritativenoyes / yesrefusedDNSPod AUTHORITY DNS 7.3.2512.01
b.dnspod.com 43.161.3.75NOERROR, 267 ms, authoritativenoyes / yesrefusedDNSPod AUTHORITY DNS 7.3.2512.00
c.dnspod.com 125.94.59.175NOERROR, 200 ms, authoritativenoyes / yesrefusedDNSPod AUTHORITY DNS 7.3.2512.01
c.dnspod.com 43.134.249.75NOERROR, 165 ms, authoritativenoyes / yesrefusedDNSPod AUTHORITY DNS 7.3.2512.00
c.dnspod.com 112.80.181.175NOERROR, 155 ms, authoritativenoyes / yesrefusedDNSPod AUTHORITY DNS 7.3.2512.00

Checks

  • ✓ All respond #14
    All 10 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: a.dnspod.com: "DNSPod AUTHORITY DNS 7.3.2512.01"; a.dnspod.com: "DNSPod AUTHORITY DNS 7.3.2512.00"; b.dnspod.com: "DNSPod AUTHORITY DNS 7.3.2512.00"; b.dnspod.com: "DNSPod AUTHORITY DNS 7.3.2512.01"; c.dnspod.com: "DNSPod AUTHORITY DNS 7.3.2512.01"; c.dnspod.com: "DNSPod AUTHORITY DNS 7.3.2512.00". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

warn

serial 1789632992 · primary a.dnspod.com

Found

Primary (MNAME)
a.dnspod.com
Contact (RNAME)
domainadmin.dnspod.com
Serial
1789632992
Refresh / retry
3600 s / 180 s
Expire
1209600 s
Negative TTL
180 s

Serial per nameserver

NameserverSerial
a.dnspod.com (43.134.249.74)1789632992
a.dnspod.com (101.227.168.75)1789632992
a.dnspod.com (43.130.172.75)1789632992
a.dnspod.com (117.135.128.175)1789632992
b.dnspod.com (163.177.5.79)1789632992
b.dnspod.com (220.196.136.75)1789632992
b.dnspod.com (43.161.3.75)1789632992
c.dnspod.com (125.94.59.175)1789632992
c.dnspod.com (43.134.249.75)1789632992
c.dnspod.com (112.80.181.175)1789632992

Checks

  • ✓ Serial 1789632992 everywhere #22
    All nameservers serve the same version of the zone.
  • !
    Unusual SOA timers
    negative caching TTL (minimum) 3m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 1h, retry 3m, expire 14d, negative TTL 3m.
    #23
  • ✓ Primary is a public nameserver #24
    The primary nameserver a.dnspod.com is one of the listed nameservers.
  • ✓ Contact domainadmin@dnspod.com #25
    The SOA RNAME domainadmin.dnspod.com means domainadmin@dnspod.com.
  • ✓ Timestamp serial #26
    The serial 1789632992 is a Unix timestamp (2026-09-17 08:16 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

fail

22 records at the apex

Found

Read from
43.134.249.74:53
TypeValueTTL
SOAa.dnspod.com. domainadmin.dnspod.com. 1789632992 3600 180 1209600 180180
NSa.dnspod.com.86400
NSb.dnspod.com.86400
NSc.dnspod.com.86400
MX10 tommx.tom.com.600
TXT"google-site-verification=wQJW6bfIVOcoj3ZEdQzg6b24hoVeusrTWS5Ic3z2o7g"600
TXT"qqmail-site-verification=5693eae81d7a0c0324331deb7d7951fcd6264b2bed4"600
TXT"v=spf1 include:spf.tom.com -all"600
TXT"zkdjmr4z1xv0rsmlb42ybnd674yq3c0"600
TXT"9ll83n2xhr9v90gf4pfjmvw0475h75ds"600
TXT"_0ja1di5vi8e8xtwubnevx73rl9c66i9"600
TXT"_3usd0wmc81x3fghtmf6l7jep4eqmysk"600
TXT"_5bttw7j5svc5u4h636znge60qhsk3vm"600
TXT"_aqgy7ez32qgpgd4jyj7pn1ptkhkbtgj"600
TXT"_g1cs1bn5rdj3zs5di6efpyykiv6gbab"600
TXT"_hwrx4onfedoorqvqmy4zyxykc5c0u25"600
TXT"_pphzkslky4jq845dovmd9tdcfhuqe1i"600
TXT"_yps4n3nwnn8kldlie4d6gt18v7x29kj"600
TXT"pc8z876y8thxqfhny03y729lghtnm3hf"600
TXT"wlhc151qlxqp5btdw0rtvbrwg3rq2q0z"600
TXT"zxk47cb1n1fl4g268d4rmpq8xqbrdf1x"600
TXT"google-site-verification=JySgTJ6NUmE5HO7LVEqI6N7KNqn2EkqC5tlkqM1UpoU"600

Checks

  • ✓ TTLs within range #32
    TTLs: MX 10m, NS 1d. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.
  • ✗
    CNAME at the apex
    The zone apex is a CNAME to www.tom.com.3thj0n4b8fls.e.aliyunwaf2.com. A CNAME can't coexist with the SOA and NS records (RFC 1034); use your provider's ALIAS/flattening feature instead.
    #33
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35