wur.nl

Checked 21 October 2026, 21:27 UTC · via 8.8.8.8
✗Problems found
23 passed 2 warnings 1 failed 3 info

Registration

info

.nl country-code

Found

TLD
.nl (country-code)
ICANN policies apply
no
Lookup error: https://rdap.sidn.nl/domain/wur.nl returned HTTP 429

Checks

  • i
    .nl is a country-code TLD (ccTLD)
    Country-code TLD: governed by its local registry under national policy, not by an ICANN contract. Registrar accreditation, dispute resolution and RDAP/WHOIS rules are set by the registry.
    #1
  • ✓ TLD delegated and signed #2
    .nl is delegated in the root zone and DNSSEC-signed.
  • i
    Could not be checked
    The RDAP lookup failed, so this could not be checked: https://rdap.sidn.nl/domain/wur.nl returned HTTP 429
    #3

Delegation

pass

ns-ext-01.wur.nl, ns1.surfnet.nl, ns1.zurich.surf.net

Found

Parent zone
nl
Delegation from
ns1.dns.nl (194.0.28.53)
NS at the parent
ns-ext-01.wur.nl, ns1.surfnet.nl, ns1.zurich.surf.net
NS in the zone
ns-ext-01.wur.nl, ns1.surfnet.nl, ns1.zurich.surf.net
NameserverAddressesNetwork (AS)Glue
ns-ext-01.wur.nl137.224.210.229 2001:610:a38:4302::229AS1103 SURFNET-NL - SURF B.V., NL AS1103 SURFNET-NL - SURF B.V., NL137.224.210.229 2001:610:a38:4302::229
ns1.surfnet.nl192.87.106.101 2001:610:1:800a:192:87:106:101AS1103 SURFNET-NL - SURF B.V., NL AS1103 SURFNET-NL - SURF B.V., NL192.87.106.101 2001:610:1:800a:192:87:106:101
ns1.zurich.surf.net195.176.255.9 2001:620:0:9::1103AS559 Switch - SWITCH, CH AS559 Switch - SWITCH, CH-

Checks

  • ✓ 3 nameservers #6
    Delegated to ns-ext-01.wur.nl, ns1.surfnet.nl, ns1.zurich.surf.net.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ Glue present and correct #8
    Glue is published for the nameservers inside the zone: ns-ext-01.wur.nl.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 3 IPv4 /24s and 3 IPv6 /48s.
  • ✓ 2 autonomous systems #11
    The nameservers are spread over: AS1103 (SURFNET-NL - SURF B.V., NL): 4 addresses; AS559 (Switch - SWITCH, CH): 2 addresses.
  • ✓ Nameserver names under 2 TLDs #12
    Nameserver names use the TLDs .net, .nl.
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

fail

5 of 6 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns-ext-01.wur.nl 137.224.210.229NOERROR, 14 ms, authoritativenoyes / yesrefused-
ns-ext-01.wur.nl 2001:610:a38:4302::229no responsenono / no--
ns1.surfnet.nl 192.87.106.101NOERROR, 9 ms, authoritativenoyes / yesrefusedThis is a SURFnet nameserver - dns-beheer@surfnet.nl
ns1.surfnet.nl 2001:610:1:800a:192:87:106:101NOERROR, 10 ms, authoritativenoyes / yesrefusedThis is a SURFnet nameserver - dns-beheer@surfnet.nl
ns1.zurich.surf.net 195.176.255.9NOERROR, 9 ms, authoritativenoyes / yesrefusedThis is a SURFnet nameserver - dns-beheer@surf.nl
ns1.zurich.surf.net 2001:620:0:9::1103NOERROR, 9 ms, authoritativenoyes / yesrefusedThis is a SURFnet nameserver - dns-beheer@surf.nl

Checks

  • ✗
    Nameservers not responding
    These addresses did not answer, so resolvers waste time on timeouts: ns-ext-01.wur.nl (2001:610:a38:4302::229): read udp [2a01:4f8:1c1c:eebf::1]:38404->[2001:610:a38:4302::229]:53: i/o timeout.
    #14
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • i
    Identifying string disclosed
    These nameservers answer version queries with a string that is not a version number: ns1.surfnet.nl: "This is a SURFnet nameserver - dns-beheer@surfnet.nl"; ns1.zurich.surf.net: "This is a SURFnet nameserver - dns-beheer@surf.nl".
    #17
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 2024038054 · primary ns-ext-01.wur.nl

Found

Primary (MNAME)
ns-ext-01.wur.nl
Contact (RNAME)
hostmaster.wur.nl
Serial
2024038054
Refresh / retry
10800 s / 3600 s
Expire
2419200 s
Negative TTL
900 s

Serial per nameserver

NameserverSerial
ns-ext-01.wur.nl (137.224.210.229)2024038054
ns1.surfnet.nl (192.87.106.101)2024038054
ns1.surfnet.nl (2001:610:1:800a:192:87:106:101)2024038054
ns1.zurich.surf.net (195.176.255.9)2024038054
ns1.zurich.surf.net (2001:620:0:9::1103)2024038054

Checks

  • ✓ Serial 2024038054 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 3h, retry 1h, expire 28d, negative TTL 15m.
  • ✓ Primary is a public nameserver #24
    The primary nameserver ns-ext-01.wur.nl is one of the listed nameservers.
  • ✓ Contact hostmaster@wur.nl #25
    The SOA RNAME hostmaster.wur.nl means hostmaster@wur.nl.
  • ✓ Timestamp serial #26
    The serial 2024038054 is a Unix timestamp (2034-02-20 08:47 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

11 records at the apex

Found

Read from
137.224.210.229:53
TypeValueTTL
SOAns-ext-01.wur.nl. hostmaster.wur.nl. 2024038054 10800 3600 2419200 90028800
NSns1.zurich.surf.net.28800
NSns-ext-01.wur.nl.28800
NSns1.surfnet.nl.28800
A185.135.13.198300
MX20 wur-nl.mail.protection.outlook.com.60
CAA0 iodef "mailto:servicedesk.it@wur.nl"28800
CAA0 issue "sectigo.com"28800
CAA0 issue "harica.gr"28800
CAA0 issue "letsencrypt.org"28800
CAA0 issue "godaddy.com"28800

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: MX (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 1h and in the zone 8h; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • ✓ CAA restricts issuance #35
    Certificates may be issued by: sectigo.com, harica.gr, letsencrypt.org, godaddy.com.