verisign.com

Checked 22 October 2026, 11:21 UTC · via 8.8.8.8
!Passed with warnings
29 passed 3 warnings 0 failed 3 info

Registration

info

.com generic · CSC Corporate Domains, Inc. · expires 2034-06-01

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
CSC Corporate Domains, Inc.
Registered
2 June 1995
Last changed
7 February 2025
Expires
1 June 2034
Status
client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers
av1.nstld.com, av2.nstld.com, av3.nstld.com, av4.nstld.com
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2034-06-01 #3
    The registration is valid until 2034-06-01 (2778 days).
  • ✓ Transfer locked #4
    Registry status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

av1.nstld.com, av2.nstld.com, av3.nstld.com, av4.nstld.com

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
av1.nstld.com, av2.nstld.com, av3.nstld.com, av4.nstld.com
NS in the zone
av1.nstld.com, av2.nstld.com, av3.nstld.com, av4.nstld.com
NameserverAddressesNetwork (AS)Glue
av1.nstld.com192.42.177.30 2001:500:124::30AS396549 VRSN-AC50-340 - VeriSign Global Registry Services, US AS10515 CLT-NIC - VeriSign Infrastructure & Operations, US192.42.177.30 2001:500:124::30
av2.nstld.com192.42.178.30 2001:500:125::30AS36631 ZGTLD - VeriSign Global Registry Services, US AS36631 ZGTLD - VeriSign Global Registry Services, US192.42.178.30 2001:500:125::30
av3.nstld.com192.82.133.30 2001:500:126::30AS19836 VERISIGNGRS - VeriSign Infrastructure & Operations, US AS19836 VERISIGNGRS - VeriSign Infrastructure & Operations, US192.82.133.30 2001:500:126::30
av4.nstld.com192.82.134.30 2001:500:127::30AS19836 VERISIGNGRS - VeriSign Infrastructure & Operations, US AS19836 VERISIGNGRS - VeriSign Infrastructure & Operations, US192.82.134.30 2001:500:127::30

Checks

  • ✓ 4 nameservers #6
    Delegated to av1.nstld.com, av2.nstld.com, av3.nstld.com, av4.nstld.com.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 4 IPv4 /24s and 4 IPv6 /48s.
  • ✓ 4 autonomous systems #11
    The nameservers are spread over: AS10515 (CLT-NIC - VeriSign Infrastructure & Operations, US): 1 address; AS19836 (VERISIGNGRS - VeriSign Infrastructure & Operations, US): 4 addresses; AS36631 (ZGTLD - VeriSign Global Registry Services, US): 2 addresses; AS396549 (VRSN-AC50-340 - VeriSign Global Registry Services, US): 1 address.
  • i
    All nameserver names under .com
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

info

8 of 8 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
av1.nstld.com 192.42.177.30NOERROR, 20 ms, authoritativenoyes / yesrefusedATLAS
av1.nstld.com 2001:500:124::30NOERROR, 20 ms, authoritativenoyes / yesrefusedATLAS
av2.nstld.com 192.42.178.30NOERROR, 9 ms, authoritativenoyes / yesrefusedATLAS
av2.nstld.com 2001:500:125::30NOERROR, 10 ms, authoritativenoyes / yesrefusedATLAS
av3.nstld.com 192.82.133.30NOERROR, 4 ms, authoritativenoyes / yesrefusedATLAS
av3.nstld.com 2001:500:126::30NOERROR, 4 ms, authoritativenoyes / yesrefusedATLAS
av4.nstld.com 192.82.134.30NOERROR, 4 ms, authoritativenoyes / yesrefusedATLAS
av4.nstld.com 2001:500:127::30NOERROR, 4 ms, authoritativenoyes / yesrefusedATLAS

Checks

  • ✓ All respond #14
    All 8 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • i
    Identifying string disclosed
    These nameservers answer version queries with a string that is not a version number: av1.nstld.com: "ATLAS"; av2.nstld.com: "ATLAS"; av3.nstld.com: "ATLAS"; av4.nstld.com: "ATLAS".
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

warn

serial 1792628366 · primary av1.nstld.com

Found

Primary (MNAME)
av1.nstld.com
Contact (RNAME)
mdnshelp.verisign.com
Serial
1792628366
Refresh / retry
300 s / 7200 s
Expire
1209600 s
Negative TTL
86400 s

Serial per nameserver

NameserverSerial
av1.nstld.com (192.42.177.30)1792628366
av1.nstld.com (2001:500:124::30)1792628366
av2.nstld.com (192.42.178.30)1792628366
av2.nstld.com (2001:500:125::30)1792628366
av3.nstld.com (192.82.133.30)1792628366
av3.nstld.com (2001:500:126::30)1792628366
av4.nstld.com (192.82.134.30)1792628366
av4.nstld.com (2001:500:127::30)1792628366

Checks

  • ✓ Serial 1792628366 everywhere #22
    All nameservers serve the same version of the zone.
  • !
    Unusual SOA timers
    refresh 5m is outside 20m–1d; retry 2h should be shorter than refresh 5m. Current values: refresh 5m, retry 2h, expire 14d, negative TTL 1d.
    #23
  • ✓ Primary is a public nameserver #24
    The primary nameserver av1.nstld.com is one of the listed nameservers.
  • ✓ Contact mdnshelp@verisign.com #25
    The SOA RNAME mdnshelp.verisign.com means mdnshelp@verisign.com.
  • ✓ Timestamp serial #26
    The serial 1792628366 is a Unix timestamp (2026-10-22 00:19 UTC).

DNSSEC

warn

Signed, DS published at parent

Found

Validated by resolver
yes
Denial of existence
NSEC3
NSEC3
0 iterations, 6-byte salt
Signatures valid until
20 November 2026

DS at the parent

Key tagAlgorithmDigestMatches a key
55204RSASHA256 (8)SHA256 206D88653C43D99B…yes

DNSKEY in the zone

Key tagRoleAlgorithm
55204KSK (257)RSASHA256 (8)
30594ZSK (256)RSASHA256 (8)

Checks

  • ✓ Signed and validated #27
    The zone is signed, the parent publishes a DS record, and the resolver validates the answers.
  • ✓ DS matches a key #28
    The DS record at the parent matches a key in the zone: key tag 55204 (SHA256).
  • ✓ Modern algorithms #29
    Key algorithms: RSASHA256 (8).
  • ✓ Signatures valid until 2026-11-20 #30
    The earliest DNSKEY/SOA signature expires at 2026-11-20 23:19 UTC.
  • !
    NSEC3 with extra iterations or salt
    NSEC3 uses 0 iterations and a 6-byte salt. RFC 9276 recommends 0 iterations and no salt: extra iterations cost resolvers CPU and add no real protection, and some validators treat high counts as insecure.
    #31

Records

warn

38 records at the apex

Found

Read from
192.42.177.30:53
TypeValueTTL
SOAav1.nstld.com. mdnshelp.verisign.com. 1792628366 300 7200 1209600 8640086400
NSav3.nstld.com.86400
NSav1.nstld.com.86400
NSav4.nstld.com.86400
NSav2.nstld.com.86400
A69.58.187.4060
A209.131.162.14560
AAAA2620:74:14:3000::4060
AAAA2620:74:10:2900::4560
MX10 mail3.verisign.com.300
MX10 mail1.verisign.com.300
MX10 mail5.verisign.com.300
MX10 mail2.verisign.com.300
MX10 mail4.verisign.com.300
MX10 mail6.verisign.com.300
TXT"flexera-domain-verification-ajekzguntndwdhrv"300
TXT"_a6zbbdh9hz0vkncsvg2h22lp9h6brwj"300
TXT"apple-domain-verification=VZse3PQypofizVfj"300
TXT"spellbook-domain-verification-pyk3cc=cH6ehfsM1LL7GrB7uTQx27Rzh"300
TXT"7e72aa8348d91ff55b0359c441f8a2e3bc82be177ed89975025aa2b32de34b09"300
TXT"ciscocidomainverification=32ade0b0270c6e8fe212bc6cf3b1d9ab4574494cc66a5e79aeec56642d97bd7a"300
TXT"adobe-idp-site-verification=2265fe0e032bfd95522012da2d7a1bfe77b80c596e9b9d901f02fd5356dcddc2"300
TXT"_e2x8i8oup58c9rpbvqhncri0r9qygie"300
TXT"_qqahezze1mjnzudq7ajo1ur9fj7hlyv"300
TXT"flexera-domain-verification-mmhrajauocepbygu"300
TXT"jamf-site-verification=omIeBdZrvJKLHyEyUQ83Ow"300
TXT"google-site-verification=gcnnekAlEpu-EIsCSqvCAvtezhOec9Z6OqAfmeAECfA"300
TXT"emkPkSG0HbqECOPCBHWd1nTxAEaP9bU"300
TXT"atlassian-sending-domain-verification=492e13d2-f700-4710-ab58-67b0ed88fa30"300
TXT"atlassian-domain-verification=0XaK5Hx8Xwcrl8UiEhnlkcI5adHd5/XT753lV1mmBgR03dkHs49PFXZU4kQa6N79"300
TXT"facebook-domain-verification=9keft74qgbjbnzfmav0oeloqxpiiuf"300
TXT"paloaltonetworks-site-verification=594716eb8b31d7d7fee6308dba819de4360c027d04dfe809706ea0629330c0ef"300
TXT"v=spf1 include:spf-i.verisign.com include:spf-p.verisign.com ~all"300
TXT"ciscocidomainverification=7e72aa8348d91ff55b0359c441f8a2e3bc82be177ed89975025aa2b32de34b09"300
TXT"google-gws-recovery-domain-verification=71996230"300
TXT"openai-domain-verification=dv-YQwdMe6PrrxumyNHr1RgR7kv"300
CAA0 issue "amazonaws.com"900
CAA0 issue "digicert.com"900

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (1m), AAAA (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • ✓ CAA restricts issuance #35
    Certificates may be issued by: amazonaws.com, digicert.com.