xdfsh.com

Checked 22 October 2026, 11:34 UTC · via 8.8.8.8
✗Problems found
24 passed 1 warning 1 failed 5 info

Registration

info

.com generic · 22net, Inc. · expires 2027-08-11

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
22net, Inc.
Registered
11 August 2020
Last changed
4 August 2026
Expires
11 August 2027
Status
active
Registry nameservers
ns1.22.cn, ns2.22.cn
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2027-08-11 #3
    The registration is valid until 2027-08-11 (293 days).
  • i
    No transfer lock
    The domain has no transfer lock (status: active). A registrar lock protects against unauthorized transfers.
    #4
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

ns1.22.cn, ns2.22.cn

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
ns1.22.cn, ns2.22.cn
NS in the zone
ns1.22.cn, ns2.22.cn
NameserverAddressesNetwork (AS)Glue
ns1.22.cn61.158.128.10 218.98.111.136 2001:df2:f080:1::5AS4837 CHINA169-Backbone - CHINA UNICOM China169 Backbone, CN AS133775 CHINATELECOM-Fujian-Xiamen-IDC1 - Xiamen, CN AS140227 HKCICL-AS-AP - Hong Kong Communications International Co., Limited, HK-
ns2.22.cn211.99.99.61 183.253.57.207 1.193.216.203 240e:97d:10:1402:0:1:0:1002AS134763 CT-DongGuan-IDC - CHINANET Guangdong province network, CN AS9808 CHINAMOBILE-CN - China Mobile Communications Group Co., Ltd., CN AS4134 CHINANET-BACKBONE - No.31,Jin-rong Street, CN AS134763 CT-DongGuan-IDC - CHINANET Guangdong province network, CN-

Checks

  • i
    2 nameservers
    Two nameservers meet the minimum; RFC 2182 recommends three or more for important zones: ns1.22.cn, ns2.22.cn.
    #6
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 5 IPv4 /24s and 2 IPv6 /48s.
  • ✓ 6 autonomous systems #11
    The nameservers are spread over: AS133775 (CHINATELECOM-Fujian-Xiamen-IDC1 - Xiamen, CN): 1 address; AS134763 (CT-DongGuan-IDC - CHINANET Guangdong province network, CN): 2 addresses; AS140227 (HKCICL-AS-AP - Hong Kong Communications International Co., Limited, HK): 1 address; AS4134 (CHINANET-BACKBONE - No.31,Jin-rong Street, CN): 1 address; AS4837 (CHINA169-Backbone - CHINA UNICOM China169 Backbone, CN): 1 address; AS9808 (CHINAMOBILE-CN - China Mobile Communications Group Co., Ltd., CN): 1 address.
  • i
    All nameserver names under .cn
    All nameserver names are under one TLD, so a problem with that TLD also makes the nameservers unreachable. Some operators use names under two TLDs for extra resilience.
    #12
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

fail

6 of 7 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns1.22.cn 61.158.128.10NOERROR, 198 ms, authoritativenoyes / yesrefused-
ns1.22.cn 218.98.111.136no responsenono / no--
ns1.22.cn 2001:df2:f080:1::5NOERROR, 154 ms, authoritativenoyes / yesrefused-
ns2.22.cn 211.99.99.61NOERROR, 187 ms, authoritativenoyes / yesrefused-
ns2.22.cn 183.253.57.207NOERROR, 207 ms, authoritativenoyes / yesrefused-
ns2.22.cn 1.193.216.203NOERROR, 183 ms, authoritativenoyes / yesrefused-
ns2.22.cn 240e:97d:10:1402:0:1:0:1002NOERROR, 195 ms, authoritativenoyes / yesrefused-

Checks

  • ✗
    Nameservers not responding
    These addresses did not answer, so resolvers waste time on timeouts: ns1.22.cn (218.98.111.136): read udp 46.225.38.91:45805->218.98.111.136:53: i/o timeout.
    #14
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • ✓ No version disclosed #17
    The nameservers don't reveal their software version.
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 1751342694 · primary ns1.22.cn

Found

Primary (MNAME)
ns1.22.cn
Contact (RNAME)
dnsadmin.22.cn
Serial
1751342694
Refresh / retry
3600 s / 300 s
Expire
1209600 s
Negative TTL
1800 s

Serial per nameserver

NameserverSerial
ns1.22.cn (61.158.128.10)1751342694
ns1.22.cn (2001:df2:f080:1::5)1751342694
ns2.22.cn (211.99.99.61)1751342694
ns2.22.cn (183.253.57.207)1751342694
ns2.22.cn (1.193.216.203)1751342694
ns2.22.cn (240e:97d:10:1402:0:1:0:1002)1751342694

Checks

  • ✓ Serial 1751342694 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 1h, retry 5m, expire 14d, negative TTL 30m.
  • ✓ Primary is a public nameserver #24
    The primary nameserver ns1.22.cn is one of the listed nameservers.
  • ✓ Contact dnsadmin@22.cn #25
    The SOA RNAME dnsadmin.22.cn means dnsadmin@22.cn.
  • ✓ Timestamp serial #26
    The serial 1751342694 is a Unix timestamp (2025-07-01 04:04 UTC).

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

info

4 records at the apex

Found

Read from
61.158.128.10:53
TypeValueTTL
SOAns1.22.cn. dnsadmin.22.cn. 1751342694 3600 300 1209600 1800600
NSns1.22.cn.86400
NSns2.22.cn.86400
A120.76.173.197600

Checks

  • ✓ TTLs within range #32
    TTLs: A 10m, NS 1d. The NS TTL at the parent is 2d and in the zone 1d; resolvers may use either.
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35