webgarden.com

Checked 22 October 2026, 11:24 UTC · via 8.8.8.8
!Passed with warnings
24 passed 4 warnings 0 failed 6 info

Registration

info

.com generic · Gransy, s.r.o. · expires 2027-01-07

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
Gransy, s.r.o.
Registered
8 January 1998
Last changed
30 December 2025
Expires
7 January 2027
Status
active
Registry nameservers
ns.gransy.com, ns2.gransy.com, ns3.gransy.com
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-01-07 #3
    The registration is valid until 2027-01-07 (76 days).
  • i
    No transfer lock
    The domain has no transfer lock (status: active). A registrar lock protects against unauthorized transfers.
    #4
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

ns.gransy.com, ns2.gransy.com, ns3.gransy.com

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
ns.gransy.com, ns2.gransy.com, ns3.gransy.com
NS in the zone
ns.gransy.com, ns2.gransy.com, ns3.gransy.com, ns4.gransy.com, ns5.gransy.com
NameserverAddressesNetwork (AS)Glue
ns.gransy.com45.76.90.43 95.179.136.180 77.78.104.149 2001:19f0:5001:1caf:5400:1ff:fec5:8d50AS20473 AS-VULTR - The Constant Company, LLC, US AS20473 AS-VULTR - The Constant Company, LLC, US AS15685 CASABLANCA-AS - CASABLANCA INT a.s., CZ AS20473 AS-VULTR - The Constant Company, LLC, US2001:19f0:5001:1caf:5400:1ff:fec5:8d50 45.76.90.43 77.78.104.149 95.179.136.180
ns2.gransy.com217.16.185.221 217.69.4.49 95.179.192.121 2001:19f0:6801:474:5400:1ff:fec5:8efb 2001:19f0:7401:81e0:5400:1ff:fec5:8ef6AS43541 VSHOSTING - VSHOSTING-CDN, CZ AS20473 AS-VULTR - The Constant Company, LLC, US AS20473 AS-VULTR - The Constant Company, LLC, US AS20473 AS-VULTR - The Constant Company, LLC, US AS20473 AS-VULTR - The Constant Company, LLC, US2001:19f0:6801:474:5400:1ff:fec5:8efb 2001:19f0:7401:81e0:5400:1ff:fec5:8ef6 217.16.185.221 217.69.4.49 95.179.192.121
ns3.gransy.com77.78.126.35 46.21.100.103 109.74.7.71 2a02:750:8::32 2a02:750:7::2e7AS15685 CASABLANCA-AS - CASABLANCA INT a.s., CZ AS42708 GLESYS - Glesys AB, SE AS42708 GLESYS - Glesys AB, SE AS42708 GLESYS - Glesys AB, SE AS42708 GLESYS - Glesys AB, SE109.74.7.71 2a02:750:7::2e7 2a02:750:8::32 46.21.100.103 77.78.126.35
ns4.gransy.com (zone only)80.67.7.209 66.42.94.136 2001:19f0:5401:69b:5400:1ff:fec5:8f3f 2a00:1a28:2010:1::89AS42708 GLESYS - Glesys AB, SE AS20473 AS-VULTR - The Constant Company, LLC, US AS20473 AS-VULTR - The Constant Company, LLC, US AS42708 GLESYS - Glesys AB, SE-
ns5.gransy.com (zone only)31.192.227.223 2a02:750:5::538AS42708 GLESYS - Glesys AB, SE AS42708 GLESYS - Glesys AB, SE-

Checks

  • ✓ 3 nameservers #6
    Delegated to ns.gransy.com, ns2.gransy.com, ns3.gransy.com.
  • !
    NS sets differ
    The nameservers at the parent and in the zone should be the same. Only in the zone: ns4.gransy.com, ns5.gransy.com. ns.gransy.com, ns2.gransy.com, ns3.gransy.com, ns4.gransy.com, ns5.gransy.com report NS ns.gransy.com ns2.gransy.com ns3.gransy.com ns4.gransy.com ns5.gransy.com.
    #7
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 12 IPv4 /24s and 8 IPv6 /48s.
  • ✓ 4 autonomous systems #11
    The nameservers are spread over: AS15685 (CASABLANCA-AS - CASABLANCA INT a.s., CZ): 2 addresses; AS20473 (AS-VULTR - The Constant Company, LLC, US): 9 addresses; AS42708 (GLESYS - Glesys AB, SE): 8 addresses; AS43541 (VSHOSTING - VSHOSTING-CDN, CZ): 1 address.
  • i
    All nameserver names under .com
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

warn

20 of 20 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns.gransy.com 45.76.90.43NOERROR, 4 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns.gransy.com 95.179.136.180NOERROR, 20 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns.gransy.com 77.78.104.149NOERROR, 9 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns.gransy.com 2001:19f0:5001:1caf:5400:1ff:fec5:8d50NOERROR, 20 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns2.gransy.com 217.16.185.221NOERROR, 9 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns2.gransy.com 217.69.4.49NOERROR, 13 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns2.gransy.com 95.179.192.121NOERROR, 21 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns2.gransy.com 2001:19f0:6801:474:5400:1ff:fec5:8efbNOERROR, 14 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns2.gransy.com 2001:19f0:7401:81e0:5400:1ff:fec5:8ef6NOERROR, 21 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns3.gransy.com 77.78.126.35NOERROR, 12 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns3.gransy.com 46.21.100.103NOERROR, 13 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns3.gransy.com 109.74.7.71NOERROR, 81 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns3.gransy.com 2a02:750:8::32NOERROR, 13 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns3.gransy.com 2a02:750:7::2e7NOERROR, 85 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns4.gransy.com 80.67.7.209NOERROR, 28 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns4.gransy.com 66.42.94.136NOERROR, 225 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns4.gransy.com 2001:19f0:5401:69b:5400:1ff:fec5:8f3fNOERROR, 223 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns4.gransy.com 2a00:1a28:2010:1::89NOERROR, 28 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns5.gransy.com 31.192.227.223NOERROR, 22 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2
ns5.gransy.com 2a02:750:5::538NOERROR, 25 ms, authoritativenoyes / yesrefusedGLUX-DNS 0.9.2

Checks

  • ✓ All respond #14
    All 20 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: ns.gransy.com: "GLUX-DNS 0.9.2"; ns2.gransy.com: "GLUX-DNS 0.9.2"; ns3.gransy.com: "GLUX-DNS 0.9.2"; ns4.gransy.com: "GLUX-DNS 0.9.2"; ns5.gransy.com: "GLUX-DNS 0.9.2". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 2783513909 · primary ns.gransy.com

Found

Primary (MNAME)
ns.gransy.com
Contact (RNAME)
root.gransy.com
Serial
2783513909
Refresh / retry
86400 s / 900 s
Expire
1209600 s
Negative TTL
1800 s

Serial per nameserver

NameserverSerial
ns.gransy.com (45.76.90.43)2783513909
ns.gransy.com (95.179.136.180)2783513909
ns.gransy.com (77.78.104.149)2783513909
ns.gransy.com (2001:19f0:5001:1caf:5400:1ff:fec5:8d50)2783513909
ns2.gransy.com (217.16.185.221)2783513909
ns2.gransy.com (217.69.4.49)2783513909
ns2.gransy.com (95.179.192.121)2783513909
ns2.gransy.com (2001:19f0:6801:474:5400:1ff:fec5:8efb)2783513909
ns2.gransy.com (2001:19f0:7401:81e0:5400:1ff:fec5:8ef6)2783513909
ns3.gransy.com (77.78.126.35)2783513909
ns3.gransy.com (46.21.100.103)2783513909
ns3.gransy.com (109.74.7.71)2783513909
ns3.gransy.com (2a02:750:8::32)2783513909
ns3.gransy.com (2a02:750:7::2e7)2783513909
ns4.gransy.com (80.67.7.209)2783513909
ns4.gransy.com (66.42.94.136)2783513909
ns4.gransy.com (2001:19f0:5401:69b:5400:1ff:fec5:8f3f)2783513909
ns4.gransy.com (2a00:1a28:2010:1::89)2783513909
ns5.gransy.com (31.192.227.223)2783513909
ns5.gransy.com (2a02:750:5::538)2783513909

Checks

  • ✓ Serial 2783513909 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 1d, retry 15m, expire 14d, negative TTL 30m.
  • ✓ Primary is a public nameserver #24
    The primary nameserver ns.gransy.com is one of the listed nameservers.
  • ✓ Contact root@gransy.com #25
    The SOA RNAME root.gransy.com means root@gransy.com.
  • ✓ Timestamp serial #26
    The serial 2783513909 is a Unix timestamp (2058-03-16 14:18 UTC).

DNSSEC

warn

Signed, but no DS at parent

Found

Validated by resolver
no
Denial of existence
NSEC
Signatures valid until
8 July 2027

DNSKEY in the zone

Key tagRoleAlgorithm
56890ZSK (256)RSASHA1-NSEC3-SHA1 (7)
52247KSK (257)RSASHA1-NSEC3-SHA1 (7)

Checks

  • !
    Signed but not delegated securely
    The zone is signed but the parent has no DS record, so the signatures are not used. Publish the DS record at your registrar.
    #27
  • !
    Deprecated algorithm
    SHA-1 based algorithms are deprecated and rejected by some validators: RSASHA1-NSEC3-SHA1 (7). Roll over to ECDSAP256SHA256 (13).
    #29
  • ✓ Signatures valid until 2027-07-08 #30
    The earliest DNSKEY/SOA signature expires at 2027-07-08 12:31 UTC.
  • i
    NSEC
    The zone uses NSEC, so its full contents can be listed by walking the NSEC chain. That is fine unless the names are sensitive.
    #31

Records

info

9 records at the apex

Found

Read from
45.76.90.43:53
TypeValueTTL
SOAns.gransy.com. root.gransy.com. 2783513909 86400 900 1209600 18001800
NSns3.gransy.com.1800
NSns4.gransy.com.1800
NSns2.gransy.com.1800
NSns.gransy.com.1800
NSns5.gransy.com.1800
A185.59.208.125600
MX10 mx.webgarden.com.900
TXT"google-site-verification=DyQ3UCSe3LaZ8PSKKNxDEHES9ZF6xe6nvOPQ-afePmo"900

Checks

  • ✓ TTLs within range #32
    TTLs: A 10m, MX 15m, NS 30m. The NS TTL at the parent is 2d and in the zone 30m; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • i
    Wildcard record
    A random name under the zone resolves, so there is a wildcard (*) record. Typos and non-existent hosts resolve too, which can confuse mail and certificate checks.
    #34
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35