unitedhealthgroup.com

Checked 22 October 2026, 11:15 UTC · via 8.8.8.8
!Passed with warnings
29 passed 2 warnings 0 failed 4 info

Registration

info

.com generic · CSC Corporate Domains, Inc. · expires 2027-10-01

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
CSC Corporate Domains, Inc.
Registered
2 October 1998
Last changed
27 September 2026
Expires
1 October 2027
Status
client transfer prohibited
Registry nameservers
edns4.ultradns.biz, edns4.ultradns.com, edns4.ultradns.net, edns4.ultradns.org, epla1.corpnamesvcs.com, epla2.corpnamesvcs.com
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-10-01 #3
    The registration is valid until 2027-10-01 (343 days).
  • ✓ Transfer locked #4
    Registry status: client transfer prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

edns4.ultradns.biz, edns4.ultradns.com, edns4.ultradns.net, edns4.ultradns.org, epla1.corpnamesvcs.com, epla2.corpnamesvcs.com

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
edns4.ultradns.biz, edns4.ultradns.com, edns4.ultradns.net, edns4.ultradns.org, epla1.corpnamesvcs.com, epla2.corpnamesvcs.com
NS in the zone
epla1.corpnamesvcs.com, epla2.corpnamesvcs.com
NameserverAddressesNetwork (AS)Glue
edns4.ultradns.biz (parent only)204.74.67.4 2610:a1:1015::204AS12008 VERCARA - Vercara, LLC, US AS12008 VERCARA - Vercara, LLC, US-
edns4.ultradns.com (parent only)204.74.66.4 2001:502:f3ff::204AS12008 VERCARA - Vercara, LLC, US AS12008 VERCARA - Vercara, LLC, US2001:502:f3ff::204 204.74.66.4
edns4.ultradns.net (parent only)204.74.110.4 2610:a1:1014::204AS12008 VERCARA - Vercara, LLC, US AS12008 VERCARA - Vercara, LLC, US-
edns4.ultradns.org (parent only)204.74.111.4 2001:502:4612::204AS12008 VERCARA - Vercara, LLC, US AS12008 VERCARA - Vercara, LLC, US-
epla1.corpnamesvcs.com149.111.128.204AS10879 UHC - Unitedhealthcare, US149.111.128.204
epla2.corpnamesvcs.com168.183.36.43AS10879 UHC - Unitedhealthcare, US168.183.36.43

Checks

  • ✓ 6 nameservers #6
    Delegated to edns4.ultradns.biz, edns4.ultradns.com, edns4.ultradns.net, edns4.ultradns.org, epla1.corpnamesvcs.com, epla2.corpnamesvcs.com.
  • !
    NS sets differ
    The nameservers at the parent and in the zone should be the same. Only at the parent: edns4.ultradns.biz, edns4.ultradns.com, edns4.ultradns.net, edns4.ultradns.org. edns4.ultradns.biz, edns4.ultradns.com, edns4.ultradns.net, edns4.ultradns.org, epla1.corpnamesvcs.com, epla2.corpnamesvcs.com report NS epla1.corpnamesvcs.com epla2.corpnamesvcs.com.
    #7
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 6 IPv4 /24s and 4 IPv6 /48s.
  • ✓ 2 autonomous systems #11
    The nameservers are spread over: AS10879 (UHC - Unitedhealthcare, US): 2 addresses; AS12008 (VERCARA - Vercara, LLC, US): 8 addresses.
  • ✓ Nameserver names under 4 TLDs #12
    Nameserver names use the TLDs .biz, .com, .net, .org.
  • i
    Partly IPv6
    These nameservers have no IPv6 address: epla1.corpnamesvcs.com, epla2.corpnamesvcs.com.
    #13

Nameservers

info

10 of 10 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
edns4.ultradns.biz 204.74.67.4NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns4.ultradns.biz 2610:a1:1015::204NOERROR, 4 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns4.ultradns.com 204.74.66.4NOERROR, 41 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns4.ultradns.com 2001:502:f3ff::204NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns4.ultradns.net 204.74.110.4NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns4.ultradns.net 2610:a1:1014::204NOERROR, 36 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns4.ultradns.org 204.74.111.4NOERROR, 13 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns4.ultradns.org 2001:502:4612::204NOERROR, 32 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
epla1.corpnamesvcs.com 149.111.128.204NOERROR, 134 ms, authoritativenoyes / yesrefused-
epla2.corpnamesvcs.com 168.183.36.43NOERROR, 127 ms, authoritativenoyes / yesrefused-

Checks

  • ✓ All respond #14
    All 10 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • i
    Identifying string disclosed
    These nameservers answer version queries with a string that is not a version number: edns4.ultradns.biz: "UltraDNS Nameserver"; edns4.ultradns.com: "UltraDNS Nameserver"; edns4.ultradns.net: "UltraDNS Nameserver"; edns4.ultradns.org: "UltraDNS Nameserver".
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

warn

serial 18033 · primary epla1.corpnamesvcs.com

Found

Primary (MNAME)
epla1.corpnamesvcs.com
Contact (RNAME)
hostmaster.uhc.com
Serial
18033
Refresh / retry
300 s / 30 s
Expire
604800 s
Negative TTL
900 s

Serial per nameserver

NameserverSerial
edns4.ultradns.biz (204.74.67.4)18033
edns4.ultradns.biz (2610:a1:1015::204)18033
edns4.ultradns.com (204.74.66.4)18033
edns4.ultradns.com (2001:502:f3ff::204)18033
edns4.ultradns.net (204.74.110.4)18033
edns4.ultradns.net (2610:a1:1014::204)18033
edns4.ultradns.org (204.74.111.4)18033
edns4.ultradns.org (2001:502:4612::204)18033
epla1.corpnamesvcs.com (149.111.128.204)18033
epla2.corpnamesvcs.com (168.183.36.43)18033

Checks

  • ✓ Serial 18033 everywhere #22
    All nameservers serve the same version of the zone.
  • !
    Unusual SOA timers
    refresh 5m is outside 20m–1d. Current values: refresh 5m, retry 30s, expire 7d, negative TTL 15m.
    #23
  • ✓ Primary is a public nameserver #24
    The primary nameserver epla1.corpnamesvcs.com is one of the listed nameservers.
  • ✓ Contact hostmaster@uhc.com #25
    The SOA RNAME hostmaster.uhc.com means hostmaster@uhc.com.
  • ✓ Counter serial #26
    The serial 18033 is a plain counter.

DNSSEC

pass

Signed, DS published at parent

Found

Validated by resolver
yes
Denial of existence
NSEC3
NSEC3
0 iterations, 0-byte salt
Signatures valid until
25 October 2026

DS at the parent

Key tagAlgorithmDigestMatches a key
59755RSASHA256 (8)SHA256 AF5A038D1A996F0E…yes

DNSKEY in the zone

Key tagRoleAlgorithm
56245ZSK (256)RSASHA256 (8)
21055ZSK (256)RSASHA256 (8)
59755KSK (257)RSASHA256 (8)
5794KSK (257)RSASHA256 (8)

Checks

  • ✓ Signed and validated #27
    The zone is signed, the parent publishes a DS record, and the resolver validates the answers.
  • ✓ DS matches a key #28
    The DS record at the parent matches a key in the zone: key tag 59755 (SHA256).
  • ✓ Modern algorithms #29
    Key algorithms: RSASHA256 (8).
  • ✓ Short-lived signatures (online signing) #30
    Signatures are valid for 97h0m0s and created on demand; the current one was made at 2026-10-21 11:13 UTC and expires at 2026-10-25 11:59 UTC.
  • ✓ NSEC3 as recommended #31
    The zone uses NSEC3 with 0 iterations and no salt (RFC 9276).

Records

info

15 records at the apex

Found

Read from
204.74.67.4:53
TypeValueTTL
SOAepla1.corpnamesvcs.com. hostmaster.uhc.com. 18033 300 30 604800 900300
NSepla1.corpnamesvcs.com.300
NSepla2.corpnamesvcs.com.300
A151.101.67.10300
A151.101.3.10300
A151.101.195.10300
A151.101.131.10300
MX5 mxa-0077b904.gslb.pphosted.com.300
MX5 mxb-0077b904.gslb.pphosted.com.300
TXT"MS=ms29272145"300
TXT"dcd1dbab-48c8-4241-9720-5fc762b200e0"300
TXT"verification_token=AWpAf74fZfaG3JXTOJg48bEEm"300
TXT"v=spf1 include:res.cisco.com include:_spfv4.corpmailsvcs.com -all"300
TXT"google-site-verification=vniyUHF1XW1sFJcM4VplBnRFQU_Qh2vEqiXDHzq6qCA"300
TXT"adobe-idp-site-verification=9a5c47599b4f379d5e29ede339f3da7f9e1689f8e16709c98e397c86a1c68122"300

Checks

  • ✓ TTLs within range #32
    TTLs: A 5m, MX 5m, NS 5m. The NS TTL at the parent is 2d and in the zone 5m; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35