waitrose.com

Checked 22 October 2026, 11:23 UTC · via 8.8.8.8
!Passed with warnings
26 passed 3 warnings 0 failed 2 info

Registration

info

.com generic · Ascio Technologies, Inc. Danmark - Filial af Ascio technologies, Inc. USA · expires 2027-02-22

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
Ascio Technologies, Inc. Danmark - Filial af Ascio technologies, Inc. USA
Registered
22 February 1999
Last changed
23 February 2026
Expires
22 February 2027
Status
client delete prohibited, client transfer prohibited
Registry nameservers
a1-162.akam.net, a13-67.akam.net, a20-64.akam.net, a24-65.akam.net, a28-66.akam.net, a3-67.akam.net
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-02-22 #3
    The registration is valid until 2027-02-22 (122 days).
  • ✓ Transfer locked #4
    Registry status: client delete prohibited, client transfer prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

a1-162.akam.net, a13-67.akam.net, a20-64.akam.net, a24-65.akam.net, a28-66.akam.net, a3-67.akam.net

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
a1-162.akam.net, a13-67.akam.net, a20-64.akam.net, a24-65.akam.net, a28-66.akam.net, a3-67.akam.net
NS in the zone
a1-162.akam.net, a13-67.akam.net, a20-64.akam.net, a24-65.akam.net, a28-66.akam.net, a3-67.akam.net
NameserverAddressesNetwork (AS)Glue
a1-162.akam.net193.108.91.162 2600:1401:2::a2AS20940 AKAMAI-ASN1 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a13-67.akam.net2.22.230.67 2600:1480:800::43AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a20-64.akam.net95.100.175.64 2a02:26f0:67::40AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a24-65.akam.net2.16.130.65 2600:1480:9800::41AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a28-66.akam.net95.100.173.66 2600:1480:d800::42AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a3-67.akam.net96.7.49.67 2600:1408:1c::43AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-

Checks

  • ✓ 6 nameservers #6
    Delegated to a1-162.akam.net, a13-67.akam.net, a20-64.akam.net, a24-65.akam.net, a28-66.akam.net, a3-67.akam.net.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 6 IPv4 /24s and 6 IPv6 /48s.
  • ✓ 2 autonomous systems #11
    The nameservers are spread over: AS20940 (AKAMAI-ASN1 - Akamai International B.V., NL): 1 address; AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 11 addresses.
  • i
    All nameserver names under .net
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

warn

12 of 12 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
a1-162.akam.net 193.108.91.162NOERROR, 3 ms, authoritativenoyes / yesrefused41824.10
a1-162.akam.net 2600:1401:2::a2NOERROR, 4 ms, authoritativenoyes / yesrefused41824.5
a13-67.akam.net 2.22.230.67NOERROR, 5 ms, authoritativenoyes / yesrefused41824.11
a13-67.akam.net 2600:1480:800::43NOERROR, 5 ms, authoritativenoyes / yesrefused41824.9
a20-64.akam.net 95.100.175.64NOERROR, 4 ms, authoritativenoyes / yesrefused48878.31
a20-64.akam.net 2a02:26f0:67::40NOERROR, 4 ms, authoritativenoyes / yesrefused48878.27
a24-65.akam.net 2.16.130.65NOERROR, 4 ms, authoritativenoyes / yesrefused48878.32
a24-65.akam.net 2600:1480:9800::41NOERROR, 4 ms, authoritativenoyes / yesrefused48878.27
a28-66.akam.net 95.100.173.66NOERROR, 5 ms, authoritativenoyes / yesrefused48878.29
a28-66.akam.net 2600:1480:d800::42NOERROR, 5 ms, authoritativenoyes / yesrefused48878.29
a3-67.akam.net 96.7.49.67NOERROR, 3 ms, authoritativenoyes / yesrefused41824.8
a3-67.akam.net 2600:1408:1c::43NOERROR, 5 ms, authoritativenoyes / yesrefused41824.4

Checks

  • ✓ All respond #14
    All 12 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: a1-162.akam.net: "41824.10"; a1-162.akam.net: "41824.5"; a13-67.akam.net: "41824.11"; a13-67.akam.net: "41824.9"; a20-64.akam.net: "48878.31"; a20-64.akam.net: "48878.27"; a24-65.akam.net: "48878.32"; a24-65.akam.net: "48878.27"; a28-66.akam.net: "48878.29"; a3-67.akam.net: "41824.8"; a3-67.akam.net: "41824.4". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 2016111540 · primary a1-162.akam.net

Found

Primary (MNAME)
a1-162.akam.net
Contact (RNAME)
noc.johnlewis.co.uk
Serial
2016111540
Refresh / retry
10800 s / 3600 s
Expire
1814400 s
Negative TTL
7200 s

Serial per nameserver

NameserverSerial
a1-162.akam.net (193.108.91.162)2016111540
a1-162.akam.net (2600:1401:2::a2)2016111540
a13-67.akam.net (2.22.230.67)2016111540
a13-67.akam.net (2600:1480:800::43)2016111540
a20-64.akam.net (95.100.175.64)2016111540
a20-64.akam.net (2a02:26f0:67::40)2016111540
a24-65.akam.net (2.16.130.65)2016111540
a24-65.akam.net (2600:1480:9800::41)2016111540
a28-66.akam.net (95.100.173.66)2016111540
a28-66.akam.net (2600:1480:d800::42)2016111540
a3-67.akam.net (96.7.49.67)2016111540
a3-67.akam.net (2600:1408:1c::43)2016111540

Checks

  • ✓ Serial 2016111540 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 3h, retry 1h, expire 21d, negative TTL 2h.
  • ✓ Primary is a public nameserver #24
    The primary nameserver a1-162.akam.net is one of the listed nameservers.
  • ✓ Contact noc@johnlewis.co.uk #25
    The SOA RNAME noc.johnlewis.co.uk means noc@johnlewis.co.uk.
  • ✓ Date-based serial #26
    The serial 2016111540 follows the YYYYMMDDnn convention (2016-11-15).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

33 records at the apex

Found

Read from
193.108.91.162:53
TypeValueTTL
SOAa1-162.akam.net. noc.johnlewis.co.uk. 2016111540 10800 3600 1814400 7200300
NSa20-64.akam.net.86400
NSa24-65.akam.net.86400
NSa3-67.akam.net.86400
NSa28-66.akam.net.86400
NSa1-162.akam.net.86400
NSa13-67.akam.net.86400
A104.102.0.1420
TXT"v4vdtmfh84m465716hkp7xp0wbv5z1w3"300
TXT"yb1wgyh7x4f743gd3lyvyfy7my9tw7df"300
TXT"apple-domain-verification=IWX6-vuN_WAmdQqA9Y8Vn-uB7Ks5D0KFtxOLYt1MGRQ"300
TXT"5836a9d3-4c84-446a-91d6-911fbfda879a"300
TXT"stripe-verification=38106845848f7677b964d9cb8c59306bb6b7333977fb7ccbef40dae727f1395d"300
TXT"ynht0h3n0llvjd1r9dx7chc3p5d5vn14"300
TXT"_e5x8avuwm26ek5qjk7hkkkpmjjbaumr"300
TXT"269tdn5cv0508p13n6bbkypsk98kv1r7"300
TXT"adobe-idp-site-verification=ec5478fb46ee84b278f2b8c16e951fa187f62ed39cf4ad0382856e9f8ab377a5"300
TXT"_yb19gvi9kz844dmq5hw52kesbszcji8"300
TXT"_iairqeo2j1wbu552fksulqjyrq372zh"300
TXT"google-site-verification=PBKUMAomtYGf250eOmvuO7OXygj-5isUJPKw_3F1VUY"300
TXT"_gw9e2i96a0uc0qzb7rrtdvsa759kd5h"300
TXT"qqcf0rtz854r7ktg6ykz8wx1ftz3rq8t"300
TXT"_j9s5p464emvt73j6aiuendi7ki2y90x"300
TXT"_z46xi55j2r9x0a2frvihb3v6ahhjm6n"300
TXT"_p300hxp2gmhktn69kgh40bkv19edwqe"300
TXT"verification code=bx9f7hlm3k61sdq2y1zktsyf5jk05lpd"300
TXT"l59xgsjhq63hwj5xcb52q07lyxqwv88y"300
TXT"google-site-verification=qNk6HCuCwyDTdRUim2qXcEGL1VWgDGBELl2D6nz_XXk"300
CAA0 iodef "mailto:information.security@waitrose.co.uk"1800
CAA0 issue "amazon.com"1800
CAA0 issue "digicert.com"1800
CAA0 issue "pki.goog"1800
CAA0 issue "letsencrypt.org"1800

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (20s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • ✓ CAA restricts issuance #35
    Certificates may be issued by: amazon.com, digicert.com, pki.goog, letsencrypt.org.