Domain report: westelm.com

Registration

info

.com generic · MarkMonitor Inc. · expires 2028-05-02

Found

TLD: .com (generic)
ICANN policies apply: yes
Registrar: MarkMonitor Inc.
Registered: 2 May 2001
Last changed: 31 March 2026
Expires: 2 May 2028
Status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers: eur1.akam.net, ns1-125.akam.net, ns1-212.akam.net, usc1.akam.net, use3.akam.net, use4.akam.net, usw1.akam.net, usw6.akam.net
RDAP server: https://rdap.verisign.com/com/v1/

Checks

i

.com is a generic TLD (gTLD)

Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.

#1
✓ TLD delegated and signed #2

.com is delegated in the root zone and DNSSEC-signed.
✓ Expires on 2028-05-02 #3

The registration is valid until 2028-05-02 (558 days).
✓ Transfer locked #4

Registry status: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
✓ Registry and delegation match #5

The nameservers registered at the registry are the ones published in DNS.

Delegation

fail

eur1.akam.net, ns1-125.akam.net, ns1-212.akam.net, usc1.akam.net, use3.akam.net, use4.akam.net, usw1.akam.net, usw6.akam.net

Found

Parent zone: com
Delegation from: a.gtld-servers.net (192.5.6.30)
NS at the parent: eur1.akam.net, ns1-125.akam.net, ns1-212.akam.net, usc1.akam.net, use3.akam.net, use4.akam.net, usw1.akam.net, usw6.akam.net
NS in the zone: inspire.westelm.com, n2-a1.aka-ns.net, n2-a14.aka-ns.net, n2-a20.aka-ns.net, n2-a7.aka-ns.net, n2-a8.aka-ns.net, n2-a9.aka-ns.net

Nameserver	Addresses	Network (AS)	Glue
eur1.akam.net (parent only)	2.16.130.64	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
inspire.westelm.com (zone only)	(does not resolve)		-
n2-a1.aka-ns.net (zone only)	23.2.10.2 2600:1405:4800::2	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
n2-a14.aka-ns.net (zone only)	184.29.151.2 2600:1405:c00::2	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
n2-a20.aka-ns.net (zone only)	184.29.154.2 2600:1405:2400::2	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
n2-a7.aka-ns.net (zone only)	96.16.208.2 2600:1405:a800::2	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
n2-a8.aka-ns.net (zone only)	96.16.209.2 2600:1405:b800::2	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
n2-a9.aka-ns.net (zone only)	96.16.210.2 2600:1405:c800::2	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
ns1-125.akam.net (parent only)	193.108.91.125 2600:1401:2::7d	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
ns1-212.akam.net (parent only)	193.108.91.212 2600:1401:2::d4	AS20940 AKAMAI-ASN1 - Akamai International B.V., NL AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
usc1.akam.net (parent only)	95.100.168.64	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
use3.akam.net (parent only)	96.7.49.65	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
use4.akam.net (parent only)	23.211.133.65	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
usw1.akam.net (parent only)	23.61.199.66	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-
usw6.akam.net (parent only)	23.61.199.64	AS21342 AKAMAI-ASN2 - Akamai International B.V., NL	-

Checks

✓ 8 nameservers #6

Delegated to eur1.akam.net, ns1-125.akam.net, ns1-212.akam.net, usc1.akam.net, use3.akam.net, use4.akam.net, usw1.akam.net, usw6.akam.net.
!

NS sets differ

The nameservers at the parent and in the zone should be the same. Only at the parent: eur1.akam.net, ns1-125.akam.net, ns1-212.akam.net, usc1.akam.net, use3.akam.net, use4.akam.net, usw1.akam.net, usw6.akam.net; only in the zone: inspire.westelm.com, n2-a1.aka-ns.net, n2-a14.aka-ns.net, n2-a20.aka-ns.net, n2-a7.aka-ns.net, n2-a8.aka-ns.net, n2-a9.aka-ns.net. eur1.akam.net, n2-a1.aka-ns.net, n2-a14.aka-ns.net, n2-a20.aka-ns.net, n2-a7.aka-ns.net, n2-a8.aka-ns.net, n2-a9.aka-ns.net, ns1-125.akam.net, ns1-212.akam.net, usc1.akam.net, use3.akam.net, use4.akam.net, usw1.akam.net, usw6.akam.net report NS inspire.westelm.com n2-a1.aka-ns.net n2-a14.aka-ns.net n2-a20.aka-ns.net n2-a7.aka-ns.net n2-a8.aka-ns.net n2-a9.aka-ns.net.

#7
✓ No glue needed #8

All nameservers are outside the zone, so no glue records are needed.
✗

Nameserver names don't resolve

These nameservers have no A or AAAA record, so they can't be reached (lame delegation): inspire.westelm.com.

#9
✓ Nameservers in different networks #10

The nameservers are spread over 12 IPv4 /24s and 7 IPv6 /48s.
✓ 2 autonomous systems #11

The nameservers are spread over: AS20940 (AKAMAI-ASN1 - Akamai International B.V., NL): 1 address; AS21342 (AKAMAI-ASN2 - Akamai International B.V., NL): 21 addresses.
i

All nameserver names under .net

All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.

#12
i

Partly IPv6

These nameservers have no IPv6 address: eur1.akam.net, usc1.akam.net, use3.akam.net, use4.akam.net, usw1.akam.net, usw6.akam.net.

#13

Nameservers

warn

22 of 22 addresses answer authoritatively

Found

Nameserver	Answer	Recursion	TCP / EDNS	AXFR	Version
eur1.akam.net 2.16.130.64	NOERROR, 4 ms, authoritative	no	yes / yes	refused	48878.32
n2-a1.aka-ns.net 23.2.10.2	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.6
n2-a1.aka-ns.net 2600:1405:4800::2	NOERROR, 3 ms, authoritative	no	yes / yes	refused	41824.11
n2-a14.aka-ns.net 184.29.151.2	NOERROR, 3 ms, authoritative	no	yes / yes	refused	48878.31
n2-a14.aka-ns.net 2600:1405:c00::2	NOERROR, 4 ms, authoritative	no	yes / yes	refused	48878.33
n2-a20.aka-ns.net 184.29.154.2	NOERROR, 4 ms, authoritative	no	yes / yes	refused	48878.26
n2-a20.aka-ns.net 2600:1405:2400::2	NOERROR, 3 ms, authoritative	no	yes / yes	refused	48878.32
n2-a7.aka-ns.net 96.16.208.2	NOERROR, 3 ms, authoritative	no	yes / yes	refused	41824.7
n2-a7.aka-ns.net 2600:1405:a800::2	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.8
n2-a8.aka-ns.net 96.16.209.2	NOERROR, 3 ms, authoritative	no	yes / yes	refused	48878.30
n2-a8.aka-ns.net 2600:1405:b800::2	NOERROR, 4 ms, authoritative	no	yes / yes	refused	48878.32
n2-a9.aka-ns.net 96.16.210.2	NOERROR, 3 ms, authoritative	no	yes / yes	refused	41824.11
n2-a9.aka-ns.net 2600:1405:c800::2	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.5
ns1-125.akam.net 193.108.91.125	NOERROR, 3 ms, authoritative	no	yes / yes	refused	41824.4
ns1-125.akam.net 2600:1401:2::7d	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.5
ns1-212.akam.net 193.108.91.212	NOERROR, 3 ms, authoritative	no	yes / yes	refused	41824.11
ns1-212.akam.net 2600:1401:2::d4	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.8
usc1.akam.net 95.100.168.64	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.9
use3.akam.net 96.7.49.65	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.7
use4.akam.net 23.211.133.65	NOERROR, 3 ms, authoritative	no	yes / yes	refused	48878.27
usw1.akam.net 23.61.199.66	NOERROR, 5 ms, authoritative	no	yes / yes	refused	41824.11
usw6.akam.net 23.61.199.64	NOERROR, 4 ms, authoritative	no	yes / yes	refused	41824.8

Checks

✓ All respond #14

All 22 nameserver addresses answered.
✓ All authoritative #15

Every responding nameserver answers authoritatively for the zone.
✓ No recursion #16

The nameservers do not answer recursive queries for other domains.
!

Software version disclosed

These nameservers report their software version via version.bind/version.server, which helps attackers find known vulnerabilities: eur1.akam.net: "48878.32"; n2-a1.aka-ns.net: "41824.6"; n2-a1.aka-ns.net: "41824.11"; n2-a14.aka-ns.net: "48878.31"; n2-a14.aka-ns.net: "48878.33"; n2-a20.aka-ns.net: "48878.26"; n2-a20.aka-ns.net: "48878.32"; n2-a7.aka-ns.net: "41824.7"; n2-a7.aka-ns.net: "41824.8"; n2-a8.aka-ns.net: "48878.30"; n2-a8.aka-ns.net: "48878.32"; n2-a9.aka-ns.net: "41824.11"; n2-a9.aka-ns.net: "41824.5"; ns1-125.akam.net: "41824.4"; ns1-125.akam.net: "41824.5"; ns1-212.akam.net: "41824.11"; ns1-212.akam.net: "41824.8"; usc1.akam.net: "41824.9"; use3.akam.net: "41824.7"; use4.akam.net: "48878.27"; usw1.akam.net: "41824.11"; usw6.akam.net: "41824.8". Hide or replace the version string.

#17
✓ Zone transfers refused #18

No nameserver allows a zone transfer to the public.
✓ TCP supported #19

All nameservers answer over TCP.
✓ EDNS supported #20

All nameservers support EDNS(0).
✓ Public addresses #21

All nameserver addresses are publicly routable.

SOA

warn

serial 2009095218 · primary sast101rc02ib63.wsgc.com

Found

Primary (MNAME): sast101rc02ib63.wsgc.com
Contact (RNAME): techcontact.wsgc.com
Serial: 2009095218
Refresh / retry: 900 s / 3600 s
Expire: 604800 s
Negative TTL: 86400 s

Serial per nameserver

Nameserver	Serial
eur1.akam.net (2.16.130.64)	2009095218
n2-a1.aka-ns.net (23.2.10.2)	2009095218
n2-a1.aka-ns.net (2600:1405:4800::2)	2009095218
n2-a14.aka-ns.net (184.29.151.2)	2009095218
n2-a14.aka-ns.net (2600:1405:c00::2)	2009095218
n2-a20.aka-ns.net (184.29.154.2)	2009095218
n2-a20.aka-ns.net (2600:1405:2400::2)	2009095218
n2-a7.aka-ns.net (96.16.208.2)	2009095218
n2-a7.aka-ns.net (2600:1405:a800::2)	2009095218
n2-a8.aka-ns.net (96.16.209.2)	2009095218
n2-a8.aka-ns.net (2600:1405:b800::2)	2009095218
n2-a9.aka-ns.net (96.16.210.2)	2009095218
n2-a9.aka-ns.net (2600:1405:c800::2)	2009095218
ns1-125.akam.net (193.108.91.125)	2009095218
ns1-125.akam.net (2600:1401:2::7d)	2009095218
ns1-212.akam.net (193.108.91.212)	2009095218
ns1-212.akam.net (2600:1401:2::d4)	2009095218
usc1.akam.net (95.100.168.64)	2009095218
use3.akam.net (96.7.49.65)	2009095218
use4.akam.net (23.211.133.65)	2009095218
usw1.akam.net (23.61.199.66)	2009095218
usw6.akam.net (23.61.199.64)	2009095218

Checks

✓ Serial 2009095218 everywhere #22

All nameservers serve the same version of the zone.
!

Unusual SOA timers

refresh 15m is outside 20m–1d; retry 1h should be shorter than refresh 15m. Current values: refresh 15m, retry 1h, expire 7d, negative TTL 1d.

#23
i

Hidden master

The primary nameserver sast101rc02ib63.wsgc.com is not listed as a nameserver: a hidden master that only feeds the public secondaries. That is a common setup; make sure it is not reachable for zone transfers from outside.

#24
✓ Contact techcontact@wsgc.com #25

The SOA RNAME techcontact.wsgc.com means techcontact@wsgc.com.
✓ Timestamp serial #26

The serial 2009095218 is a Unix timestamp (2033-08-31 10:00 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver: no

Checks

!

Not signed

The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.

#27

Records

warn

23 records at the apex

Found

Read from: 2.16.130.64:53

Type	Value	TTL
SOA	sast101rc02ib63.wsgc.com. techcontact.wsgc.com. 2009095218 900 3600 604800 86400	300
NS	inspire.westelm.com.	300
NS	n2-a1.aka-ns.net.	300
NS	n2-a14.aka-ns.net.	300
NS	n2-a20.aka-ns.net.	300
NS	n2-a9.aka-ns.net.	300
NS	n2-a7.aka-ns.net.	300
NS	n2-a8.aka-ns.net.	300
A	23.222.80.188	20
MX	0 westelm-com.mail.protection.outlook.com.	300
TXT	"rovag_verification_token=38C3DDA416A14F70B27ED52565183BAC"	300
TXT	"google-site-verification=Kysv8C5PERdqx7bqXipspJHMaaZJQ96bhFZch7hkur0"	300
TXT	"v=spf1 a mx ip4:199.87.8.81 ip4:4.31.160.80 ip4:173.213.2.250 ip4:173.213.2.251 include:_spf.salesforce.com include:spf-0041aa01.pphosted.com ~all"	300
TXT	"v=spf1 include:spf.protection.outlook.com -all"	300
TXT	"_7oihpr3rce03gg5pruj83vwjfx423xs"	300
TXT	"MS=ms77275276"	300
TXT	"spf2.0/pra +a mx include:wshome.com ~all"	300
TXT	"h91eh5o2jfvfqva5sb6tid90dk"	300
TXT	"_h07gx5vqa10kpgz59zy44o2pwbuw2lq"	300
TXT	"facebook-domain-verification=pqzu4xyufmop8cniijwtj9eeej6lu3"	300
CAA	0 issue "digicert.com"	300
CAA	0 issue "amazonaws.com"	300
CAA	0 issue "letsencrypt.org"	300

Checks

!

Very low TTLs

These records have a TTL below 5m, causing extra queries and slower lookups: A (20s). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 5m; resolvers may use either.

#32
✓ No CNAME at the apex #33

The zone apex has no CNAME record.
✓ No wildcard #34

Names that don't exist return NXDOMAIN.
✓ CAA restricts issuance #35

Certificates may be issued by: digicert.com, amazonaws.com, letsencrypt.org.