wellsfargo.com

Checked 22 October 2026, 11:30 UTC · via 8.8.8.8
!Passed with warnings
25 passed 4 warnings 0 failed 2 info

Registration

info

.com generic · MarkMonitor Inc. · expires 2035-04-29

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
MarkMonitor Inc.
Registered
28 April 1993
Last changed
1 December 2025
Expires
29 April 2035
Status
client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers
a1-189.akam.net, a2-64.akam.net, a24-66.akam.net, edns1.ultradns.biz, edns1.ultradns.com, edns1.ultradns.net
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2035-04-29 #3
    The registration is valid until 2035-04-29 (3110 days).
  • ✓ Transfer locked #4
    Registry status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

warn

a1-189.akam.net, a2-64.akam.net, a24-66.akam.net, edns1.ultradns.biz, edns1.ultradns.com, edns1.ultradns.net

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
a1-189.akam.net, a2-64.akam.net, a24-66.akam.net, edns1.ultradns.biz, edns1.ultradns.com, edns1.ultradns.net
NS in the zone
a1-189.akam.net, a2-64.akam.net, a24-66.akam.net, edns1.ultradns.biz, edns1.ultradns.com, edns1.ultradns.net, edns1.ultradns.org
NameserverAddressesNetwork (AS)Glue
a1-189.akam.net193.108.91.189 2600:1401:2::bdAS20940 AKAMAI-ASN1 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a2-64.akam.net95.100.174.64 2600:1480:7000::40AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
a24-66.akam.net2.16.130.66 2600:1480:9800::42AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL-
edns1.ultradns.biz204.74.67.1 2610:a1:1015::201AS12008 VERCARA - Vercara, LLC, US AS12008 VERCARA - Vercara, LLC, US-
edns1.ultradns.com204.74.66.1 2001:502:f3ff::201AS12008 VERCARA - Vercara, LLC, US AS12008 VERCARA - Vercara, LLC, US2001:502:f3ff::201 204.74.66.1
edns1.ultradns.net204.74.110.1 2610:a1:1014::201AS12008 VERCARA - Vercara, LLC, US AS12008 VERCARA - Vercara, LLC, US-
edns1.ultradns.org (zone only)204.74.111.1 2001:502:4612::201AS12008 VERCARA - Vercara, LLC, US AS12008 VERCARA - Vercara, LLC, US-

Checks

  • ✓ 6 nameservers #6
    Delegated to a1-189.akam.net, a2-64.akam.net, a24-66.akam.net, edns1.ultradns.biz, edns1.ultradns.com, edns1.ultradns.net.
  • !
    NS sets differ
    The nameservers at the parent and in the zone should be the same. Only in the zone: edns1.ultradns.org. a1-189.akam.net, a2-64.akam.net, a24-66.akam.net, edns1.ultradns.biz, edns1.ultradns.com, edns1.ultradns.net, edns1.ultradns.org report NS a1-189.akam.net a2-64.akam.net a24-66.akam.net edns1.ultradns.biz edns1.ultradns.com edns1.ultradns.net edns1.ultradns.org.
    #7
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 7 IPv4 /24s and 7 IPv6 /48s.
  • ✓ 3 autonomous systems #11
    The nameservers are spread over: AS12008 (VERCARA - Vercara, LLC, US): 8 addresses; AS20940 (AKAMAI-ASN1 - Akamai International B.V., NL): 1 address; AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 5 addresses.
  • ✓ Nameserver names under 3 TLDs #12
    Nameserver names use the TLDs .biz, .com, .net.
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

warn

14 of 14 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
a1-189.akam.net 193.108.91.189NOERROR, 4 ms, authoritativenoyes / yesrefused41824.4
a1-189.akam.net 2600:1401:2::bdNOERROR, 5 ms, authoritativenoyes / yesrefused41824.6
a2-64.akam.net 95.100.174.64NOERROR, 5 ms, authoritativenoyes / yesrefused48878.26
a2-64.akam.net 2600:1480:7000::40NOERROR, 4 ms, authoritativenoyes / yesrefused48878.30
a24-66.akam.net 2.16.130.66NOERROR, 4 ms, authoritativenoyes / yesrefused48878.33
a24-66.akam.net 2600:1480:9800::42NOERROR, 5 ms, authoritativenoyes / yesrefused48878.30
edns1.ultradns.biz 204.74.67.1NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns1.ultradns.biz 2610:a1:1015::201NOERROR, 4 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns1.ultradns.com 204.74.66.1NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns1.ultradns.com 2001:502:f3ff::201NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns1.ultradns.net 204.74.110.1NOERROR, 3 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns1.ultradns.net 2610:a1:1014::201NOERROR, 4 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns1.ultradns.org 204.74.111.1NOERROR, 13 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver
edns1.ultradns.org 2001:502:4612::201NOERROR, 31 ms, authoritativenoyes / yesrefusedUltraDNS Nameserver

Checks

  • ✓ All respond #14
    All 14 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • !
    Software version disclosed
    These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: a1-189.akam.net: "41824.4"; a1-189.akam.net: "41824.6"; a2-64.akam.net: "48878.26"; a2-64.akam.net: "48878.30"; a24-66.akam.net: "48878.33"; a24-66.akam.net: "48878.30". Hide or replace the version string.
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 2009396884 · primary edns1.ultradns.com

Found

Primary (MNAME)
edns1.ultradns.com
Contact (RNAME)
hostmaster.wellsfargo.com
Serial
2009396884
Refresh / retry
1800 s / 900 s
Expire
2592000 s
Negative TTL
300 s

Serial per nameserver

NameserverSerial
a1-189.akam.net (193.108.91.189)2009396884
a1-189.akam.net (2600:1401:2::bd)2009396884
a2-64.akam.net (95.100.174.64)2009396884
a2-64.akam.net (2600:1480:7000::40)2009396884
a24-66.akam.net (2.16.130.66)2009396884
a24-66.akam.net (2600:1480:9800::42)2009396884
edns1.ultradns.biz (204.74.67.1)2009396884
edns1.ultradns.biz (2610:a1:1015::201)2009396884
edns1.ultradns.com (204.74.66.1)2009396884
edns1.ultradns.com (2001:502:f3ff::201)2009396884
edns1.ultradns.net (204.74.110.1)2009396884
edns1.ultradns.net (2610:a1:1014::201)2009396884
edns1.ultradns.org (204.74.111.1)2009396884
edns1.ultradns.org (2001:502:4612::201)2009396884

Checks

  • ✓ Serial 2009396884 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 30m, retry 15m, expire 30d, negative TTL 5m.
  • ✓ Primary is a public nameserver #24
    The primary nameserver edns1.ultradns.com is one of the listed nameservers.
  • ✓ Contact hostmaster@wellsfargo.com #25
    The SOA RNAME hostmaster.wellsfargo.com means hostmaster@wellsfargo.com.
  • ✓ Timestamp serial #26
    The serial 2009396884 is a Unix timestamp (2033-09-03 21:48 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

35 records at the apex

Found

Read from
193.108.91.189:53
TypeValueTTL
SOAedns1.ultradns.com. hostmaster.wellsfargo.com. 2009396884 1800 900 2592000 3003600
NSa1-189.akam.net.3600
NSedns1.ultradns.biz.3600
NSedns1.ultradns.org.3600
NSa2-64.akam.net.3600
NSa24-66.akam.net.3600
NSedns1.ultradns.net.3600
NSedns1.ultradns.com.3600
A2.16.183.1820
A2.16.183.2520
MX10 mxb-00004003.gslb.pphosted.com.3600
MX20 mx0b-00004003.pphosted.com.3600
MX10 mxa-00004003.gslb.pphosted.com.3600
MX20 mx0a-00004003.pphosted.com.3600
TXT"mongodb-site-verification=pdRPv2gbrHzIqdzHpPtCUwOMZBHgPbIQ"3600
TXT"google-site-verification=JhIekmpe90l9Nsvux7qqfwNmrhbJDI1xKSXsMWlXzYs"3600
TXT"apple-domain-verification=fjpdn_0YZHIPxbMISJedC6zNIlntneK35XOgGcoDH_M"3600
TXT"mongodb-site-verification=jqcFvnzHPnWaB8kuVRCCbrQN1zJQRPQT"3600
TXT"poppulo-domain-verification=a43ab4c6-cf0c-408d-892c-910d39b46aec"3600
TXT"liveramp-site-verification=eTqekxddhK8on3hD12UkjC56Be8HZGRuzGG9BwQxfRM"3600
TXT"yahoo-verification-key=obqVt160b6+HxLHztMj4LYjtSIXf2WUl7wuBDv+AZpE="3600
TXT"XKNBNPXX3FGJAJI4IGHIWBRYY6IBLYJKA9TFFIQU"3600
TXT"SFMC-RBMdi4jKmGLzx309qUUmF_jRLq0ZhtELtiy7L3Qh"3600
TXT"MS=ms55239285"3600
TXT"cisco-ci-domain-verification=611fc9e560697d73912de2f3755da55f7277c7811d44297c0a0a567a21e7a249"3600
TXT"facebook-domain-verification=5m0hrk0snw5sgvxwxdump2kob1wm5u"3600
TXT"cisco-ci-domain-verification=27d3d23d53cbc01f28bb1e90d2772e1ef8671ef1306d8a6aea2dd98b16973b99"3600
TXT"slack-domain-verification=TZylPJmHnWc38hjAZndFjbqpORzFahh0CXOLCYBI"3600
TXT"cisco-ci-domain-verification=60939a4d2f539880950cf4f6cd4e97b18a07e85391ff5671f2b7045b2be84f9"3600
TXT"atlassian-domain-verification=3iSn26f6aafKa7o1mfwsx1tZl9Ach7BhUpRmglO24La1WPXoyanfEd3zs1Y0VqiL"3600
TXT"docusign=182ba0bd-f7cc-423a-b69f-6597f3418125"3600
TXT"docusign=fa86331e-ce88-4150-9e03-49999c4542a5"3600
TXT"hcp-domain-verification=bed540868e214034c62df7863b2f90e7b217905a6c69831138e93312bcca62c2"3600
TXT"google-site-verification=I_ja-LuIqEJ76WNc4saij8AC-JrnkDqe3--MBdH2LHU"3600
TXT"v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all"3600

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (20s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1h; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35