vlaanderen.be

Checked 22 October 2026, 07:21 UTC · via 8.8.8.8
!Passed with warnings
23 passed 2 warnings 0 failed 8 info

Registration

info

.be country-code

Found

TLD
.be (country-code)
ICANN policies apply
no

Checks

  • i
    .be is a country-code TLD (ccTLD)
    Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.
    #1
  • ✓ TLD delegated and signed #2
    .be is delegated in the root zone and DNSSEC-signed.
  • i
    Registration data not available
    No registration data via RDAP: the registry of .be offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.
    #3

Delegation

info

ns1.f5clouddns.com, ns2.f5clouddns.com

Found

Parent zone
be
Delegation from
a.nsset.be (194.0.6.1)
NS at the parent
ns1.f5clouddns.com, ns2.f5clouddns.com
NS in the zone
ns1.f5clouddns.com, ns2.f5clouddns.com
NameserverAddressesNetwork (AS)Glue
ns1.f5clouddns.com107.162.234.197 2604:e180:1071::3:1AS55002 DEFENSE-NET - F5, Inc., US AS55002 DEFENSE-NET - F5, Inc., US-
ns2.f5clouddns.com107.162.176.221 2604:e180:1071::ffff:6ba2:b0ddAS55002 DEFENSE-NET - F5, Inc., US AS55002 DEFENSE-NET - F5, Inc., US-

Checks

  • i
    2 nameservers
    Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: ns1.f5clouddns.com, ns2.f5clouddns.com.
    #6
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • i
    One address family in one network
    all IPv6 addresses are in 2604:e180:1071::/48, while the other address family is spread over several networks.
    #10
  • i
    All nameservers in one AS
    All nameserver addresses are announced by one network operator (AS55002 (DEFENSE-NET - F5, Inc., US): 4 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.
    #11
  • i
    All nameserver names under .com
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

pass

4 of 4 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns1.f5clouddns.com 107.162.234.197NOERROR, 9 ms, authoritativenoyes / yesrefused-
ns1.f5clouddns.com 2604:e180:1071::3:1NOERROR, 170 ms, authoritativenoyes / yesrefused-
ns2.f5clouddns.com 107.162.176.221NOERROR, 10 ms, authoritativenoyes / yesrefused-
ns2.f5clouddns.com 2604:e180:1071::ffff:6ba2:b0ddNOERROR, 24 ms, authoritativenoyes / yesrefused-

Checks

  • ✓ All respond #14
    All 4 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • ✓ No version disclosed #17
    The nameservers don't reveal their software version.
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

warn

serial 679228 · primary itr1425_grid_res01.vlaanderen.be

Found

Primary (MNAME)
itr1425_grid_res01.vlaanderen.be
Contact (RNAME)
dnsmaster.vlaanderen.be
Serial
679228
Refresh / retry
7200 s / 3600 s
Expire
1728000 s
Negative TTL
60 s

Serial per nameserver

NameserverSerial
ns1.f5clouddns.com (107.162.234.197)679228
ns1.f5clouddns.com (2604:e180:1071::3:1)679228
ns2.f5clouddns.com (107.162.176.221)679228
ns2.f5clouddns.com (2604:e180:1071::ffff:6ba2:b0dd)679228

Checks

  • ✓ Serial 679228 everywhere #22
    All nameservers serve the same version of the zone.
  • !
    Unusual SOA timers
    negative caching TTL (minimum) 1m is outside 5m–1d (RFC 2308 recommends 1–3 hours). Current values: refresh 2h, retry 1h, expire 20d, negative TTL 1m.
    #23
  • i
    Hidden master
    The primary nameserver itr1425_grid_res01.vlaanderen.be is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.
    #24
  • ✓ Contact dnsmaster@vlaanderen.be #25
    The SOA RNAME dnsmaster.vlaanderen.be means dnsmaster@vlaanderen.be.
  • ✓ Counter serial #26
    The serial 679228 is a plain counter.

DNSSEC

warn

Signed, DS published at parent

Found

Validated by resolver
yes
Denial of existence
NSEC3
NSEC3
10 iterations, 5-byte salt
Signatures valid until
25 October 2026

DS at the parent

Key tagAlgorithmDigestMatches a key
6993ECDSAP256SHA256 (13)SHA256 79B8D8391BDE084F…yes

DNSKEY in the zone

Key tagRoleAlgorithm
4676ZSK (256)ECDSAP256SHA256 (13)
6993KSK (257)ECDSAP256SHA256 (13)
53685ZSK (256)ECDSAP256SHA256 (13)

Checks

  • ✓ Signed and validated #27
    The zone is signed, the parent publishes a DS record, and the resolver validates the answers.
  • ✓ DS matches a key #28
    The DS record at the parent matches a key in the zone: key tag 6993 (SHA256).
  • ✓ Modern algorithms #29
    Key algorithms: ECDSAP256SHA256 (13).
  • ✓ Short-lived signatures (online signing) #30
    Signatures are valid for 96h0m0s and created on demand; the current one was made at 2026-10-21 14:18 UTC and expires at 2026-10-25 14:30 UTC.
  • !
    NSEC3 with extra iterations or salt
    NSEC3 uses 10 iterations and a 5-byte salt. RFC 9276 recommends 0 iterations and no salt: extra iterations cost resolvers CPU and add no real protection, and some validators treat high counts as insecure.
    #31

Records

info

37 records at the apex

Found

Read from
107.162.234.197:53
TypeValueTTL
SOAitr1425_grid_res01.vlaanderen.be. dnsmaster.vlaanderen.be. 679228 7200 3600 1728000 607200
NSns2.f5clouddns.com.7200
NSns1.f5clouddns.com.7200
A2.16.106.1597200
A2.16.106.1347200
MX2 vlaanderen-be.mail.protection.outlook.com.7200
TXT"2al6kdnrn85te4jev638jiavpu"120
TXT"4m31ev2k62t67ins3lcuqi3885"120
TXT"573mbdbl1nd5i1lfjb92tv444g"120
TXT"6fjak9qrrsctr5e0qvd4vcpsg0"120
TXT"7263l7vgdpg8u8cs8lupuhr5sr"120
TXT"833nt59fi5gls554d61b7a18as"120
TXT"HARICA-G9xIadrLoRQiP54bd17"120
TXT"HARICA-nD6iQNMRWaYzX9kXCsD"120
TXT"HARICA-rLpcLTpeBEie6KZpREg"120
TXT"OSSRH-86666"120
TXT"_globalsign-domain-verification=SzMNk092G7xd5MTiQdFQcz0xWqrUFR8QS3aA-54i2m"120
TXT"aaeb3mp17j2gb1jm2i7r7tvn30"120
TXT"amqqjbl6gb6mscf5bo8v73gb4n"120
TXT"atlassian-domain-verification=LXWmw4ntrTHmGVSB96nqPhsHhyLVVlba7apDuCwzutIN8gT8vXAkfnueiu4qAWhs"120
TXT"atlassian-sending-domain-verification=61affb14-164a-4b20-8917-8a34600a85d8"120
TXT"bia6nbdqnv4q3ou1r223plnfr7"120
TXT"d365mktkey=6m1CFQKXJpXwLvmLHYyrHG7ieDgZ97KmMbL1C6Jm5wYx"120
TXT"d4vpbmdjiablfak8o7i2inn0r6"120
TXT"drlmtk2su302j7rhoo5nltb9gl"120
TXT"f6eogv9s7si1js37ch9h9aev95"120
TXT"f6ta0gnu2bl5rsmtveicu2hsk7"120
TXT"google-site-verification=uSVLTSmFzCkNwbnv4MYkuRqZbmcemLOdseG52OFtr4E"120
TXT"l46lii5sv93h3f3bp7ge0sj530"120
TXT"ms-domain-verification=ffd0b518-d002-4010-abe8-ce0b0d0d9918"120
TXT"mtlgq7mpd6f1pqmbckpclgjt8n"120
TXT"odqnp5d39pt1fti46iv4q4qdnj"120
TXT"rk043308b4mujhn42rc806ag4j"120
TXT"sff4ia7a49luj8m8i1er0eic9a"120
TXT"teamviewer-sso-verification=1729b099bb0745acb2eda37280f3e1fa"120
TXT"teamviewer-sso-verification=9ee963800c6e47ce9d59a9c01a8c587c"120
TXT"v=spf1 include:_netblocks0.vlaanderen.be include:_netblocks1.vlaanderen.be include:_netblocks2.vlaanderen.be include:_netblocks3.vlaanderen.be include:_netblocks4.vlaanderen.be include:_netblocks5.vlaanderen.be include:_netblocks6.vlaanderen.be ~all"120

Checks

  • ✓ TTLs within range #32
    TTLs: A 2h, MX 2h, NS 2h. The NS TTL at the parent is 1d and in the zone 2h; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35