usbank.com

Checked 22 October 2026, 11:16 UTC · via 8.8.8.8
!Passed with warnings
24 passed 3 warnings 0 failed 4 info

Registration

info

.com generic · MarkMonitor Inc. · expires 2030-04-07

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
MarkMonitor Inc.
Registered
14 February 1995
Last changed
9 January 2025
Expires
7 April 2030
Status
client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers
ns2.usbank.com, ns4.usbank.com
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2030-04-07 #3
    The registration is valid until 2030-04-07 (1263 days).
  • ✓ Transfer locked #4
    Registry status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

ns2.usbank.com, ns4.usbank.com

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
ns2.usbank.com, ns4.usbank.com
NS in the zone
ns2.usbank.com, ns4.usbank.com
NameserverAddressesNetwork (AS)Glue
ns2.usbank.com170.135.176.55AS3147 US-BANCORP - U.S. BANCORP, US170.135.176.55
ns4.usbank.com170.135.96.75AS3147 US-BANCORP - U.S. BANCORP, US170.135.96.75

Checks

  • i
    2 nameservers
    Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: ns2.usbank.com, ns4.usbank.com.
    #6
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ Glue present and correct #8
    Glue is published for the nameservers inside the zone: ns2.usbank.com, ns4.usbank.com.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 2 IPv4 /24s and 0 IPv6 /48s.
  • i
    All nameservers in one AS
    All nameserver addresses are announced by one network operator (AS3147 (US-BANCORP - U.S. BANCORP, US): 2 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.
    #11
  • i
    All nameserver names under .com
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • !
    No IPv6
    None of the nameservers has an IPv6 address, so IPv6-only resolvers can't reach them.
    #13

Nameservers

pass

2 of 2 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns2.usbank.com 170.135.176.55NOERROR, 136 ms, authoritativenoyes / yesrefused-
ns4.usbank.com 170.135.96.75NOERROR, 125 ms, authoritativenoyes / yesrefused-

Checks

  • ✓ All respond #14
    All 2 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • ✓ No version disclosed #17
    The nameservers don't reveal their software version.
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

warn

serial 2026102107 · primary ns2.usbank.com

Found

Primary (MNAME)
ns2.usbank.com
Contact (RNAME)
domainadmin.usbank.com
Serial
2026102107
Refresh / retry
28800 s / 3600 s
Expire
604800 s
Negative TTL
180 s

Serial per nameserver

NameserverSerial
ns2.usbank.com (170.135.176.55)2026102107
ns4.usbank.com (170.135.96.75)2026102107

Checks

  • ✓ Serial 2026102107 everywhere #22
    All nameservers serve the same version of the zone.
  • !
    Unusual SOA timers
    negative caching TTL (minimum) 3m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 8h, retry 1h, expire 7d, negative TTL 3m.
    #23
  • ✓ Primary is a public nameserver #24
    The primary nameserver ns2.usbank.com is one of the listed nameservers.
  • ✓ Contact domainadmin@usbank.com #25
    The SOA RNAME domainadmin.usbank.com means domainadmin@usbank.com.
  • ✓ Date-based serial #26
    The serial 2026102107 follows the YYYYMMDDnn convention (2026-10-21).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

pass

60 records at the apex

Found

Read from
170.135.176.55:53
TypeValueTTL
SOAns2.usbank.com. domainadmin.usbank.com. 2026102107 28800 3600 604800 1803600
NSns2.usbank.com.1800
NSns4.usbank.com.1800
A170.135.104.2541800
A170.135.184.2541800
MX10 mxa-00256501.gslb.pphosted.com.600
MX10 mxb-00256501.gslb.pphosted.com.600
MX20 mx0b-00256501.pphosted.com.600
MX20 mx0a-00256501.pphosted.com.600
TXT"flexera-domain-verification-edhchstllbngpgpq"1800
TXT"infoblox-domain-mastery=6dee16f99346137ce14a613c60da390c8f2e2cd9976cea5362193ae6ed20d91a70"1800
TXT"onetrust-domain-verification=5f8f60973f0f4df79ddc58636c81ef7a"1800
TXT"v=spf1 ip4:170.135.101.26 ip4:170.135.101.27 ip4:170.135.101.30 ip4:170.135.101.31 ip4:170.135.101.34 ip4:170.135.101.35 ip4:170.135.101.36 ip4:170.135.101.37 ip4:170.135.101.38 ip4:170.135.185.118 ip4:170.135.185.38 ip4:170.135.186.26 " "ip4:170.135.148.24 ip4:170.135.185.42 ip4:170.135.185.27 ip4:170.135.185.31 ip4:170.135.179.24 ip4:170.135.179.28 ip4:170.135.179.33 ip4:170.135.179.35 ip4:170.135.179.36 ip4:62.17.112.74 ip4:62.17.112.78 " "ip4:62.17.112.115 ip4:62.134.193.197 ip4:62.134.193.198 ip4:62.134.193.206 ip4:204.137.43.7 ip4:204.137.43.8 ip4:204.137.43.9 ip4:204.137.47.8 ip4:204.137.47.9 ip4:204.137.47.15 include:vspf.usbank.com -all"1800
TXT"google-site-verification=gsaaJdGmqag78mP9g70fMI1q8_NVijAAbfDdtL2I7zY"1800
TXT"jamf-site-verification=xRCb27ReoQ8hx6pd1sbl5g"1800
TXT"twilio-domain-verification=0fa9a02ac315b9343656dfb23392dda1"1800
TXT"56e1c764-c471-4959-ae97-0ffffda33432"1800
TXT"neat-pulse-domain-verification-9N4n4xX=46145a35-fd4d-451d-ad62-0ecc0f2f9be6"1800
TXT"mongodb-site-verification=nG9ZCzruXUJCmnKDBlgAzRGTvEeTW26G"1800
TXT"asv_domain=b9150fbca9afab7d4c95af747e69aca4"1800
TXT"segment-site-verification=DhY8ZaM7DwUhmyPnEeyPSViL3phQRJ9Y"1800
TXT"segment-site-verification=ghO0JIP2xE1HWuCKbDqcweoKKOkltKF9"1800
TXT"atlassian-domain-verification=6RAmUpqzBIbpyOnFrnp73qg8ez2sbpwFUB9owK2YbBGr8C6k96OeJI//P69559yA"1800
TXT"ZOOM_verify_bHnyeAyU7cJcsaJfDToEbY"1800
TXT"liveramp-site-verification=vkp6vjre63dwW_pz78oXOyaFuEBlrJgXEZgPeQwZExY"1800
TXT"google-site-verification=gROrSplrXq6REiqu_HtVIpbGW7axqlSB_P1WEChYlyg"1800
TXT"atlassian-domain-verification=SVYqNemE8E2HxF9Ehm0IibNxoqdCfa72zuL2a1trhxUahyETsL4Pvm1hw63K4lC1"1800
TXT"duffel-domain-verification-5em6q3=tnMIBkGT1RUYcJrLP3EkB9Wl7"1800
TXT"bob-verify=01d76d6d6cc09094582c2a89ddaa1a76"1800
TXT"MS=99F0C2D3C2A9644A766D082B3E0289D9647EA2C4"1800
TXT"docusign=64ec46d0-6d3e-491f-aaf1-1d4ba642d64f"1800
TXT"docusign=f4c51eee-f32f-4883-b331-14a17a6aa79d"1800
TXT"1VlKqI3cHFTucoIODqdMUdmghbtUYTe5uZ0kPs2DCiH7kxlX4rMsPZjt5Hr/2ES2H6NbCZnONf8H1sL3oR9YTw=="1800
TXT"821145468-58263427"1800
TXT"facebook-domain-verification=9wkbm6bart6a3ojbf93vmerbd7xzhi"1800
TXT"adobe-idp-site-verification=75c6a92e5bd1da6d1b2b75aeca310dc5baed720243e72cef82c91337e8c7e879"1800
TXT"webexdomainverification.ISL5=90c5bd95-bcad-4006-bfeb-ca2c327c0579"1800
TXT"webexdomainverification.ISLU=ebe9033e-b824-47f7-a4ff-b1244b65e681"1800
TXT"webexdomainverification.ISLA=dd569738-f2e3-428a-a420-6c5b22a34b44"1800
TXT"webexdomainverification.ISLP=a7b654b7-bbbd-47cb-a2b8-e98d3e30467d"1800
TXT"webexdomainverification.J40J=969c1aea-40c9-4e05-b192-4669d4d712f0"1800
TXT"webexdomainverification.I4EL=bf8b02ee-57e5-42db-81e3-3b49e37980c4"1800
TXT"webexdomainverification.=187e2ef7-61ca-4585-8aa5-7d526210e140"1800
TXT"webexdomainverification.ICIJ=cd828173-7fce-4dac-b0b9-bab417ed44ce"1800
TXT"webexdomainverification.KMZ0=ae50f84a-c3ec-4cd7-af6c-82e1edf0561e"1800
TXT"webexdomainverification.JNKZ=ce7fcdd7-badb-42d0-979f-50d6c9d9c5fa"1800
TXT"webexdomainverification.JNRN=56adf08c-ea3a-4b66-b3f0-1e6277ee63bf"1800
TXT"cisco-ci-domain-verification=6f848ef50af3d2788d274c787ca091efd2c268e57b667c10dbe228fd1b0bb331"1800
TXT"apple-domain-verification=hXefxiVp2E8pUCrD"1800
TXT"atlassian-domain-verification=i5/JbyXiBIjtGSlxku3TOEsi/OjmS6cHi321L0Tm3sGSpm1LAfUUsB03v2YS65S+"1800
TXT"mongodb-site-verification=F4hW5ZY8vKG3IEEXbhFVI1AEsv1dE1Yy"1800
TXT"atlassian-domain-verification=We1a45VsY1pqpcxCs1oPkjL4B6InxCKQANbjUOZRg2lyerQnCOvaszuS6oWJhfjN"1800
TXT"mixpanel-domain-verify=7927b4b7-62eb-4635-aafa-1fad7be0d982"1800
TXT"flexera-domain-verification-brhzitbkyejrcyxs"1800
TXT"flexera-domain-verification-hdnmtyjswowryslt"1800
CAA0 issuewild ";"1800
CAA0 iodef "mailto:domainadmin@usbank.com"1800
CAA0 iodef "mailto:certificateservicesshared@usbank.com"1800
CAA0 issue "digicert.com; account=34598d5fd7c7c32362dbd871f3557ebac0d69f11f52eca62212aa083919dd593"1800
CAA0 issue "entrust.net"1800

Checks

  • ✓ TTLs within range #32
    TTLs: A 30m, MX 10m, NS 30m. The NS TTL at the parent is 2d and in the zone 30m; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • ✓ CAA restricts issuance #35
    Certificates may be issued by: none (issuance forbidden), digicert.com, entrust.net.