Domain report: vk.com

Registration

info

.com generic · Regional Network Information Center, JSC dba RU-CENTER · expires 2027-06-23

Found

TLD: .com (generic)
ICANN policies apply: yes
Registrar: Regional Network Information Center, JSC dba RU-CENTER
Registered: 24 June 1997
Last changed: 22 June 2026
Expires: 23 June 2027
Status: client transfer prohibited
Registry nameservers: ns1.vk.com, ns2.vk.com, ns3.vk.com, ns4.vk.com
RDAP server: https://rdap.verisign.com/com/v1/

Checks

i

.com is a generic TLD (gTLD)

Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.

#1
✓ TLD delegated and signed #2

.com is delegated in the root zone and DNSSEC-signed.
✓ Expires on 2027-06-23 #3

The registration is valid until 2027-06-23 (243 days).
✓ Transfer locked #4

Registry status: client transfer prohibited.
✓ Registry and delegation match #5

The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

ns1.vk.com, ns2.vk.com, ns3.vk.com, ns4.vk.com

Found

Parent zone: com
Delegation from: a.gtld-servers.net (192.5.6.30)
NS at the parent: ns1.vk.com, ns2.vk.com, ns3.vk.com, ns4.vk.com
NS in the zone: ns1.vk.com, ns2.vk.com, ns3.vk.com, ns4.vk.com

Nameserver	Addresses	Network (AS)	Glue
ns1.vk.com	87.240.131.131 2a00:bdc0:ff:1::2	AS47541 VKONTAKTE-SPB-AS - LLC VK, RU AS47541 VKONTAKTE-SPB-AS - LLC VK, RU	87.240.131.131
ns2.vk.com	95.213.21.21 2a00:bdc0:ff:2::2	AS47541 VKONTAKTE-SPB-AS - LLC VK, RU AS47541 VKONTAKTE-SPB-AS - LLC VK, RU	95.213.21.21
ns3.vk.com	93.186.238.238 2a00:bdc0:ff:3::2	AS47541 VKONTAKTE-SPB-AS - LLC VK, RU AS47541 VKONTAKTE-SPB-AS - LLC VK, RU	93.186.238.238
ns4.vk.com	87.240.136.136 2a00:bdc0:ff:4::2	AS47541 VKONTAKTE-SPB-AS - LLC VK, RU AS47541 VKONTAKTE-SPB-AS - LLC VK, RU	87.240.136.136

Checks

✓ 4 nameservers #6

Delegated to ns1.vk.com, ns2.vk.com, ns3.vk.com, ns4.vk.com.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
!

Glue differs from the zone

The addresses at the parent (glue) differ from the addresses in the zone: ns1.vk.com (glue 87.240.131.131, zone 87.240.131.131, 2a00:bdc0:ff:1::2); ns2.vk.com (glue 95.213.21.21, zone 95.213.21.21, 2a00:bdc0:ff:2::2); ns3.vk.com (glue 93.186.238.238, zone 93.186.238.238, 2a00:bdc0:ff:3::2); ns4.vk.com (glue 87.240.136.136, zone 87.240.136.136, 2a00:bdc0:ff:4::2). Update the glue at your registrar.

#8
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
i

One address family in one network

all IPv6 addresses are in 2a00:bdc0:ff::/48, while the other address family is spread over several networks.

#10
i

All nameservers in one AS

All nameserver addresses are announced by one network operator (AS47541 (VKONTAKTE-SPB-AS - LLC VK, RU): 8 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.

#11
i

All nameserver names under .com

All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

#12
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

Nameservers

fail

4 of 8 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
ns1.vk.com 87.240.131.131	NOERROR, 41 ms, authoritative	no	yes / yes	refused	To be non-disclosed
ns1.vk.com 2a00:bdc0:ff:1::2	no response	no	no / no	-	-
ns2.vk.com 95.213.21.21	NOERROR, 44 ms, authoritative	no	yes / yes	refused	To be non-disclosed
ns2.vk.com 2a00:bdc0:ff:2::2	no response	no	no / no	-	-
ns3.vk.com 93.186.238.238	NOERROR, 39 ms, authoritative	no	yes / yes	refused	To be non-disclosed
ns3.vk.com 2a00:bdc0:ff:3::2	no response	no	no / no	-	-
ns4.vk.com 87.240.136.136	NOERROR, 44 ms, authoritative	no	yes / yes	refused	To be non-disclosed
ns4.vk.com 2a00:bdc0:ff:4::2	no response	no	no / no	-	-

Checks

✗

Nameservers not responding

These addresses did not answer, so resolvers waste time on timeouts: ns1.vk.com (2a00:bdc0:ff:1::2): read udp [2a01:4f8:1c1c:eebf::1]:57832->[2a00:bdc0:ff:1::2]:53: i/o timeout; ns2.vk.com (2a00:bdc0:ff:2::2): read udp [2a01:4f8:1c1c:eebf::1]:50132->[2a00:bdc0:ff:2::2]:53: i/o timeout; ns3.vk.com (2a00:bdc0:ff:3::2): read udp [2a01:4f8:1c1c:eebf::1]:58265->[2a00:bdc0:ff:3::2]:53: i/o timeout; ns4.vk.com (2a00:bdc0:ff:4::2): read udp [2a01:4f8:1c1c:eebf::1]:37048->[2a00:bdc0:ff:4::2]:53: i/o timeout.

#14
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
i

Identifying string disclosed

These nameservers answer version queries with a string that is not a version number: ns1.vk.com: "To be non-disclosed"; ns2.vk.com: "To be non-disclosed"; ns3.vk.com: "To be non-disclosed"; ns4.vk.com: "To be non-disclosed".

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

warn

serial 3583786347 · primary ns1.vkontakte.ru

Found

Primary (MNAME): ns1.vkontakte.ru
Contact (RNAME): ncc.vk.com
Serial: 3583786347
Refresh / retry: 900 s / 600 s
Expire: 604800 s
Negative TTL: 900 s

Serial per nameserver

Nameserver	Serial
ns1.vk.com (87.240.131.131)	3583786347
ns2.vk.com (95.213.21.21)	3583786347
ns3.vk.com (93.186.238.238)	3583786347
ns4.vk.com (87.240.136.136)	3583786347

Checks

✓ Serial 3583786347 everywhere #22

All nameservers serve the same version of the zone.
!

Unusual SOA timers

refresh 15m is outside 20m–1d. Current values: refresh 15m, retry 10m, expire 7d, negative TTL 15m.

#23
i

Hidden master

The primary nameserver ns1.vkontakte.ru is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.

#24
✓ Contact ncc@vk.com #25

The SOA RNAME ncc.vk.com means ncc@vk.com.
✓ Timestamp serial #26

The serial 3583786347 is a Unix timestamp (2083-07-26 00:12 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

info

27 records at the apex

Found

Read from: 87.240.131.131:53

Type	Value	TTL
SOA	ns1.vkontakte.ru. ncc.vk.com. 3583786347 900 600 604800 900	900
NS	ns4.vk.com.	900
NS	ns3.vk.com.	900
NS	ns1.vk.com.	900
NS	ns2.vk.com.	900
A	87.240.132.78	900
A	87.240.137.164	900
A	87.240.129.133	900
A	87.240.132.72	900
A	93.186.225.194	900
A	87.240.132.67	900
MX	0 mxs.mail.ru.	900
TXT	"_globalsign-domain-verification=YM9xQ7VIOTNzoxGpxAE1kwy28slNTGWXflmZgt73D9"	900
TXT	"wmail-verification: 646ff42e916a2be1aa86be6d3c742949"	900
TXT	"_4j4teuhb465z435owek6hyyfc35290u"	900
TXT	"HARICA-fLc9OEonBmci43ogW3C"	900
TXT	"HARICA-qudxcvYVXjYWrJvbUoX"	900
TXT	"LD6VaYCKete4UB5FIx7snCoJ8bt1nGdeCWe4my5HH5psRaTl" "zAmvc"	900
TXT	"_5xh7h8y2o1u5jl2oopv1rylwxrupy8x"	900
TXT	"yandex-verification: 0bb3aeafaf40a3fa"	900
TXT	"_b7mejalrrswko9c86w0p4di0x09of12"	900
TXT	"v=spf1 ip4:93.186.224.0/20 ip4:87.240.128.0/18 i" "p4:95.142.192.0/21 mx include:_spf.google.com in" "clude:_spf.mail.ru ~all"	900
TXT	"HARICA-A1PCCe7rY17J2K2Ifov"	900
TXT	"_globalsign-domain-verification=aXxk884iIZmgR5ON_CbluBYfK4GyZLo08hLo293AHC"	900
TXT	"google-site-verification=bQE4SQUYC7KTvk4XCaMdwF0e_tj-O-6ZXMfXW2a8mHY"	900
TXT	"_globalsign-domain-verification=3qRKI9FWh1UX5CIN5FXwL6SJnSKkJzaDkVqSPaxdfC"	900
TXT	"_globalsign-domain-verification=yIHjfPiraw7292KzmmdOaN_HbhuOagFIXRGHf_3WH4"	900

Checks

✓ TTLs within range #32

TTLs: A 15m, MX 15m, NS 15m. The NS TTL at the parent is 2d and in the zone 15m; resolvers may use either.
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
i

Wildcard record

A random name under the zone resolves, so there is a wildcard (*) record. Typos and non-existent hosts resolve too, which can confuse mail and certificate checks.

#34
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35