Domain report: walibi.nl

Registration

info

.nl country-code

Found

TLD: .nl (country-code)
ICANN policies apply: no

Lookup error: https://rdap.sidn.nl/domain/walibi.nl returned HTTP 429

Checks

i

.nl is a country-code TLD (ccTLD)

Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.

#1
✓ TLD delegated and signed #2

.nl is delegated in the root zone and DNSSEC-signed.
i

Could not be checked

The RDAP lookup failed, so this could not be checked: https://rdap.sidn.nl/domain/walibi.nl returned HTTP 429

#3

Delegation

pass

nsa.perf1.fr, nsb.perf1.com, nsc.perf1.com, nsz.perf1.com, nsz.perf1.fr

Found

Parent zone: nl
Delegation from: ns1.dns.nl (194.0.28.53)
NS at the parent: nsa.perf1.fr, nsb.perf1.com, nsc.perf1.com, nsz.perf1.com, nsz.perf1.fr
NS in the zone: nsa.perf1.fr, nsb.perf1.com, nsc.perf1.com, nsz.perf1.com, nsz.perf1.fr

Nameserver	Addresses	Network (AS)	Glue
nsa.perf1.fr	81.92.94.100 2a01:c8:100::100	AS20756 NAMESHIELD - NAMESHIELD SAS, FR AS20756 NAMESHIELD - NAMESHIELD SAS, FR	-
nsb.perf1.com	81.92.95.100 2a01:c8:101::100	AS20756 NAMESHIELD - NAMESHIELD SAS, FR AS20756 NAMESHIELD - NAMESHIELD SAS, FR	-
nsc.perf1.com	152.89.172.100 2a09:35c0:102::100	AS209510 NAMESHIELDGRP - NAMESHIELD SAS, FR AS209510 NAMESHIELDGRP - NAMESHIELD SAS, FR	-
nsz.perf1.com	208.80.124.13 2600:1801:6::1	AS16552 DIGICERT - Tiggee LLC, US AS16552 DIGICERT - Tiggee LLC, US	-
nsz.perf1.fr	208.80.126.13 2600:1802:7::1	AS16552 DIGICERT - Tiggee LLC, US AS16552 DIGICERT - Tiggee LLC, US	-

Checks

✓ 5 nameservers #6

Delegated to nsa.perf1.fr, nsb.perf1.com, nsc.perf1.com, nsz.perf1.com, nsz.perf1.fr.
✓ Parent and zone agree #7

The parent delegation and the zone's NS records list the same nameservers.
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✓ All names resolve #9

Every nameserver name has an address and is not an alias.
✓ Nameservers in different networks #10

The nameservers are spread over 5 IPv4 /24s and 5 IPv6 /48s.
✓ 3 autonomous systems #11

The nameservers are spread over: AS16552 (DIGICERT - Tiggee LLC, US): 4 addresses; AS20756 (NAMESHIELD - NAMESHIELD SAS, FR): 4 addresses; AS209510 (NAMESHIELDGRP - NAMESHIELD SAS, FR): 2 addresses.
✓ Nameserver names under 2 TLDs #12

Nameserver names use the TLDs .com, .fr.
✓ All reachable over IPv6 #13

Every nameserver has an IPv6 address.

Nameservers

info

10 of 10 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
nsa.perf1.fr 81.92.94.100	NOERROR, 3 ms, authoritative	no	yes / yes	refused	Secure
nsa.perf1.fr 2a01:c8:100::100	NOERROR, 4 ms, authoritative	no	yes / yes	refused	Secure
nsb.perf1.com 81.92.95.100	NOERROR, 3 ms, authoritative	no	yes / yes	refused	Secure
nsb.perf1.com 2a01:c8:101::100	NOERROR, 3 ms, authoritative	no	yes / yes	refused	Secure
nsc.perf1.com 152.89.172.100	NOERROR, 4 ms, authoritative	no	yes / yes	refused	Secure
nsc.perf1.com 2a09:35c0:102::100	NOERROR, 4 ms, authoritative	no	yes / yes	refused	Secure
nsz.perf1.com 208.80.124.13	NOERROR, 4 ms, authoritative	no	yes / yes	refused	DNS Made Easy Anycast
nsz.perf1.com 2600:1801:6::1	NOERROR, 3 ms, authoritative	no	yes / yes	refused	DNS Made Easy Anycast
nsz.perf1.fr 208.80.126.13	NOERROR, 3 ms, authoritative	no	yes / yes	refused	DNS Made Easy Anycast
nsz.perf1.fr 2600:1802:7::1	NOERROR, 4 ms, authoritative	no	yes / yes	refused	DNS Made Easy Anycast

Checks

✓ All respond #14

All 10 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
i

Identifying string disclosed

These nameservers answer version queries with a string that is not a version number: nsa.perf1.fr: "Secure"; nsb.perf1.com: "Secure"; nsc.perf1.com: "Secure"; nsz.perf1.com: "DNS Made Easy Anycast"; nsz.perf1.fr: "DNS Made Easy Anycast".

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

pass

serial 2026100710 · primary nsa.perf1.fr

Found

Primary (MNAME): nsa.perf1.fr
Contact (RNAME): technical.nameshield.net
Serial: 2026100710
Refresh / retry: 28800 s / 7200 s
Expire: 604800 s
Negative TTL: 7200 s

Serial per nameserver

Nameserver	Serial
nsa.perf1.fr (81.92.94.100)	2026100710
nsa.perf1.fr (2a01:c8:100::100)	2026100710
nsb.perf1.com (81.92.95.100)	2026100710
nsb.perf1.com (2a01:c8:101::100)	2026100710
nsc.perf1.com (152.89.172.100)	2026100710
nsc.perf1.com (2a09:35c0:102::100)	2026100710
nsz.perf1.com (208.80.124.13)	2026100710
nsz.perf1.com (2600:1801:6::1)	2026100710
nsz.perf1.fr (208.80.126.13)	2026100710
nsz.perf1.fr (2600:1802:7::1)	2026100710

Checks

✓ Serial 2026100710 everywhere #22

All nameservers serve the same version of the zone.
✓ Timers within recommendations #23

SOA refresh 8h, retry 2h, expire 7d, negative TTL 2h.
✓ Primary is a public nameserver #24

The primary nameserver nsa.perf1.fr is one of the listed nameservers.
✓ Contact technical@nameshield.net #25

The SOA RNAME technical.nameshield.net means technical@nameshield.net.
✓ Date-based serial #26

The serial 2026100710 follows the YYYYMMDDnn convention (2026-10-07).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

info

25 records at the apex

Found

Read from: 81.92.94.100:53

Type	Value	TTL
SOA	nsa.perf1.fr. technical.nameshield.net. 2026100710 28800 7200 604800 7200	3600
NS	nsb.perf1.com.	86400
NS	nsc.perf1.com.	86400
NS	nsz.perf1.fr.	86400
NS	nsz.perf1.com.	86400
NS	nsa.perf1.fr.	86400
A	151.101.67.10	300
A	151.101.3.10	300
A	151.101.195.10	300
A	151.101.131.10	300
MX	0 walibi-nl.mail.protection.outlook.com.	3600
TXT	"globalsign-domain-verification=LOWe8o5b8M5jF91_NdqFCcp55JzNqaG9vaYxpU1A2p lostgravity.nl IN TXT _globalsign-domain-verification=LOWe8o5b8M5jF91_NdqFCcp55JzNqaG9vaYxpU1A2p walibiholland.nl IN TXT _globalsign-domain-verification" "=LOWe8o5b8M5jF91_NdqFCcp55JzNqaG9vaYxpU1A2p"	3600
TXT	"xRmZ5ENKN8VAGW09Zksj8rQGo9A9HeWKV0TsTziYMAcFSsT1ZdhRLnGMAoK2g4hHoyCJFZ9YNfL6WGSPC4xwrg=="	3600
TXT	"_globalsign-domain-verification=LOWe8o5b8M5jF91_NdqFCcp55JzNqaG9vaYxpU1A2p"	3600
TXT	"google-site-verification=kTH6no6S-SkTDDkNIXvS2S0eVXZLM8MFk2MzFdurJ0E"	3600
TXT	"amazonses:9rdhpJcvsEJYrq9OjDzxfttQDK9K/DyaokyKZd4TPb0="	3600
TXT	"v=spf1 mx a ip4:90.145.97.32/29 ip4:94.75.246.0/25 ip4:193.169.65.24/32 include:spf.protection.outlook.com include:spf.mailjet.com -all"	3600
TXT	"pinterest-site-verification=9f5f37940c8debf28eaf75f821203481"	3600
TXT	"google-site-verification=A082F2gKvrkLUj1oHjOr_4tjiIs-fwUMURwqWMxpBcE"	3600
TXT	"zscaler-verification-179242867-28022026-vcTLn"	3600
TXT	"MS=ms54715058"	3600
TXT	"google-site-verification=A7pE6xJq7ocz-G9mQeyOIAz4_sBJdVxg4esYew_VKxg"	3600
TXT	"fastly-domain-delegation-ACHCVAg54iOfJObKX8yX-740634"	3600
TXT	"google-site-verification=RZDWUq93YoIpHMqYqFfidhMqi8o6mHwQcVYnfTu7gEU"	3600
TXT	"google-site-verification=p1-zTgXOru4zIPQApyZZSvT1Q8OElP_rx-7hzw31Dqo"	3600

Checks

✓ TTLs within range #32

TTLs: A 5m, MX 1h, NS 1d. The NS TTL at the parent is 1h and in the zone 1d; resolvers may use either.
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
i

Wildcard record

A random name under the zone resolves, so there is a wildcard (*) record. Typos and non-existent hosts resolve too, which can confuse mail and certificate checks.

#34
i

No CAA records

Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.

#35