Domain report: tt.com

Registration

info

.com generic · Network Solutions, LLC · expires 2027-03-31

i

.com is a generic TLD (gTLD)

Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.

#1
✓ TLD delegated and signed #2

.com is delegated in the root zone and DNSSEC-signed.
✓ Expires on 2027-03-31 #3

The registration is valid until 2027-03-31 (159 days).
✓ Transfer locked #4

Registry status: client transfer prohibited.
✓ Registry and delegation match #5

The nameservers registered at the registry are the ones published in DNS.

info

ns3.apa.at, ns4.apa.net

Nameserver	Addresses	Network (AS)	Glue
ns3.apa.at	192.174.68.100 2001:67c:1bc::100	AS1921 RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT AS1921 RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT	-
ns4.apa.net	176.97.158.100 2001:67c:10b8::100	AS1921 RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT AS1921 RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT	-

i

2 nameservers

Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: ns3.apa.at, ns4.apa.net.

#6
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 2 IPv4 /24s and 2 IPv6 /48s.
i

All nameservers in one AS

All nameserver addresses are announced by one network operator (AS1921 (RCODEZERO-ANYCAST-SEC1-TLD - ipcom GmbH, AT): 4 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.

#11
✓ Nameserver names under 2 TLDs #12

Nameserver names use the TLDs .at, .net.
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

info

4 of 4 addresses answer authoritatively

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
ns3.apa.at 192.174.68.100	NOERROR, 5 ms, authoritative	no	yes / yes	refused	RcodeZero DNS
ns3.apa.at 2001:67c:1bc::100	NOERROR, 5 ms, authoritative	no	yes / yes	refused	RcodeZero DNS
ns4.apa.net 176.97.158.100	NOERROR, 13 ms, authoritative	no	yes / yes	refused	reg-wie1
ns4.apa.net 2001:67c:10b8::100	NOERROR, 12 ms, authoritative	no	yes / yes	refused	reg-wie1

✓ All respond #14

All 4 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
i

Identifying string disclosed

These nameservers answer version queries with a string that is not a version number: ns3.apa.at: "RcodeZero DNS"; ns4.apa.net: "reg-wie1".

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

warn

serial 2026101901 · primary ns6.apa.net

✓ Serial 2026101901 everywhere #22

All nameservers serve the same version of the zone.
!

Unusual SOA timers

negative caching TTL (minimum) 30s is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 3h, retry 1h, expire 7d, negative TTL 30s.

#23
i

Hidden master

The primary nameserver ns6.apa.net is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.

#24
✓ Contact domain-admin@apa.at #25

The SOA RNAME domain-admin.apa.at means domain-admin@apa.at.
✓ Date-based serial #26

The serial 2026101901 follows the YYYYMMDDnn convention (2026-10-19).

warn

Not signed

info

22 records at the apex

Type	Value	TTL
SOA	ns6.apa.net. domain-admin.apa.at. 2026101901 10800 3600 604800 30	3600
NS	ns3.apa.at.	86400
NS	ns4.apa.net.	86400
A	75.2.32.234	3600
A	99.83.255.193	3600
MX	10 tt-com.mail.protection.outlook.com.	3600
TXT	"MS=ms47308762"	600
TXT	"_2d9fskyyeom3m7r5y2po0i98lft7ue7"	600
TXT	"_8dur0cwpi10nczjnv61jcwrms424mzf"	600
TXT	"_ekqcutr9lu7wdwashbxzb8lv4ww7bo4"	600
TXT	"bmg2y3p54vqgjlsbzdmh47r0n2w6dgst"	600
TXT	"apple-domain-verification=5OJVp2SNqSgRp6BC"	600
TXT	"openai-domain-verification=dv-ekqXL1yqxzKwawVxM47cq2Cr"	600
TXT	"facebook-domain-verification=ih3cszhtx22a80acxjxrp73zbuqhtq"	600
TXT	"anthropic-domain-verification-hg4q5a=3NaI3hBKCm7UTIftej6M6c7w0"	600
TXT	"adobe-idp-site-verification=70700228-d5bc-4647-9b94-4a7a08c075b3"	600
TXT	"google-site-verification=wH8p8t4h-WHTrdugmjYuoteUQxjcQCAxNcmFy1wuQp4"	600
TXT	"google-site-verification=xNjgvufljn6upjxqkUW7oQhpfFWxvFZrDXSD_PeGHVw"	600
TXT	"lovable_verification=743ee6e7860b7d8f1408440c0adcf7664f1693631712182cda04de70f2eb17a7"	600
TXT	"lovable_verification=ab1f666280ace8fcd8896d0d9fa4abc82ca6057baa7823713e8d95d7fd556f5a"	600
TXT	"k+Vrkcn5RH8dydRj8PP3AP2OOZbRhknrhCrGMtejTYkB1UWlY8ihQ+hvIwAUn67CgE2lyGevcKDwgs9hTZl/jg=="	600
TXT	"v=spf1 include:spf.emailsignatures365.com include:spf.protection.outlook.com include:sparkpostmail.com include:emarsys.net include:amazonses.com include:_spf.xurrent.com -all"	600

✓ TTLs within range #32

TTLs: A 1h, MX 1h, NS 1d. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35