Domain report: w-hs.de

Registration

info

.de country-code

i

.de is a country-code TLD (ccTLD)

Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.

#1
✓ TLD delegated and signed #2

.de is delegated in the root zone and DNSSEC-signed.
i

Registration data not available

No registration data via RDAP: the registry of .de offers no RDAP service. Many ccTLD registries don't offer RDAP; check the registry's WHOIS instead.

#3

info

deneb.dfn.de, dns-1.dfn.de, rz1.w-hs.de

Nameserver	Addresses	Network (AS)	Glue
deneb.dfn.de	192.76.176.9 2001:638:800:1::9	AS680 DFN - Verein zur Foerderung eines Deutschen Forschungsnetzes e.V., DE AS680 DFN - Verein zur Foerderung eines Deutschen Forschungsnetzes e.V., DE	-
dns-1.dfn.de	193.174.75.50 2001:638:d:b101::1	AS680 DFN - Verein zur Foerderung eines Deutschen Forschungsnetzes e.V., DE AS680 DFN - Verein zur Foerderung eines Deutschen Forschungsnetzes e.V., DE	-
rz1.w-hs.de	194.94.127.196	AS680 DFN - Verein zur Foerderung eines Deutschen Forschungsnetzes e.V., DE	194.94.127.196

✓ 3 nameservers #6

Delegated to deneb.dfn.de, dns-1.dfn.de, rz1.w-hs.de.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ Glue present and correct #8

Glue is published for the nameservers inside the zone: rz1.w-hs.de.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 3 IPv4 /24s and 2 IPv6 /48s.
i

All nameservers in one AS

All nameserver addresses are announced by one network operator (AS680 (DFN - Verein zur Foerderung eines Deutschen Forschungsnetzes e.V., DE): 5 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.

#11
i

All nameserver names under .de

All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

#12
i

Partly IPv6

These nameservers have no IPv6 address: rz1.w-hs.de.

#13

info

5 of 5 addresses answer authoritatively

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
deneb.dfn.de 192.76.176.9	NOERROR, 14 ms, authoritative	no	yes / yes	refused	0
deneb.dfn.de 2001:638:800:1::9	NOERROR, 14 ms, authoritative	no	yes / yes	refused	0
dns-1.dfn.de 193.174.75.50	NOERROR, 14 ms, authoritative	no	yes / yes	refused	0
dns-1.dfn.de 2001:638:d:b101::1	NOERROR, 14 ms, authoritative	no	yes / yes	refused	0
rz1.w-hs.de 194.94.127.196	NOERROR, 11 ms, authoritative	no	yes / yes	refused	-

✓ All respond #14

All 5 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
i

Identifying string disclosed

These nameservers answer version queries with a string that is not a version number: deneb.dfn.de: "0"; dns-1.dfn.de: "0".

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

warn

serial 991223877 · primary ibcluster.dmz5.local

✓ Serial 991223877 everywhere #22

All nameservers serve the same version of the zone.
!

Unusual SOA timers

refresh 15m is outside 20m–1d; retry 1h should be shorter than refresh 15m. Current values: refresh 15m, retry 1h, expire 30d, negative TTL 15m.

#23
i

Hidden master (not resolvable)

The primary nameserver ibcluster.dmz5.local is not listed as a nameserver and does not resolve publicly: a hidden master, or a placeholder name. Some tools (e.g. dynamic updates) use MNAME to find the primary.

#24
✓ Contact frank.neunemann@w-hs.de #25

The SOA RNAME frank\.neunemann.w-hs.de means frank.neunemann@w-hs.de.
✓ Counter serial #26

The serial 991223877 is a plain counter.

warn

Not signed

info

18 records at the apex

Type	Value	TTL
SOA	ibcluster.dmz5.local. frank\.neunemann.w-hs.de. 991223877 900 3600 2592000 900	400
NS	rz1.w-hs.de.	400
NS	deneb.dfn.de.	400
NS	dns-1.dfn.de.	400
A	134.119.0.141	400
AAAA	2a00:116a:100:e0::	400
MX	10 mail1.w-hs.de.	400
TXT	"spycloud-domain-verification=f02f64f4-9d69-44d7-b338-1ed082f7f8f7"	400
TXT	"google-site-verification=-yUHmCMmtvrjvsdk_DL0h9iS6aAbCRoCj8eTEaZ1K6I"	400
TXT	"sophos-domain-verification=aa4b5023e718be653df57473f371153f7e5aad969348a0baf3d4a40327d170e2"	400
TXT	"facebook-domain-verification=pvje9haq0xbwqc1cbwrg02abq0md6f"	400
TXT	"google-gws-recovery-domain-verification=70253254"	400
TXT	"ZOOM_verify_7co_0iC7SDSc7rs0EUTw6g"	400
TXT	"anny-verification=d6a9e83a-1921-407b-938a-20e017ca2d75"	400
TXT	"v=spf1 a:w-hs.managed-otrs.com a:mail.sop-at.com ip4:194.95.250.90 ~all"	400
TXT	"MS=215E24EFF2B9158284FBE886ABB7100AD373F172"	400
TXT	"61d74d4edaf8cccfa576048760bf10f1"	400
TXT	"google-site-verification=GirHo0TUdhygEoysllIzpED7ljzXnC6a-ctOXjmB0i0"	400

✓ TTLs within range #32

TTLs: A 6m40s, AAAA 6m40s, MX 6m40s, NS 6m40s. The NS TTL at the parent is 1d and in the zone 6m40s; resolvers may use either.
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35