xero.com

Checked 22 October 2026, 11:34 UTC · via 8.8.8.8
!Passed with warnings
26 passed 2 warnings 0 failed 3 info

Registration

info

.com generic · CSC Corporate Domains, Inc. · expires 2035-06-02

Found

TLD
.com (generic)
ICANN policies apply
yes
Registrar
CSC Corporate Domains, Inc.
Registered
3 June 1997
Last changed
25 June 2025
Expires
2 June 2035
Status
client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Registry nameservers
ns-1391.awsdns-45.org, ns-1911.awsdns-46.co.uk, ns-90.awsdns-11.com, ns-983.awsdns-58.net
RDAP server
https://rdap.verisign.com/com/v1/

Checks

  • i
    .com is a generic TLD (gTLD)
    Generic TLD under an ICANN registry agreement: ICANN-accredited registrars, UDRP and RDAP apply.
    #1
  • ✓ TLD delegated and signed #2
    .com is delegated in the root zone and DNSSEC-signed.
  • ✓ Expires on 2035-06-02 #3
    The registration is valid until 2035-06-02 (3144 days).
  • ✓ Transfer locked #4
    Registry status: client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited.
  • ✓ Registry and delegation match #5
    The nameservers registered at the registry are the ones published in DNS.

Delegation

info

ns-1391.awsdns-45.org, ns-1911.awsdns-46.co.uk, ns-90.awsdns-11.com, ns-983.awsdns-58.net

Found

Parent zone
com
Delegation from
a.gtld-servers.net (192.5.6.30)
NS at the parent
ns-1391.awsdns-45.org, ns-1911.awsdns-46.co.uk, ns-90.awsdns-11.com, ns-983.awsdns-58.net
NS in the zone
ns-1391.awsdns-45.org, ns-1911.awsdns-46.co.uk, ns-90.awsdns-11.com, ns-983.awsdns-58.net
NameserverAddressesNetwork (AS)Glue
ns-1391.awsdns-45.org205.251.197.111 2600:9000:5305:6f00::1AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US-
ns-1911.awsdns-46.co.uk205.251.199.119 2600:9000:5307:7700::1AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US-
ns-90.awsdns-11.com205.251.192.90 2600:9000:5300:5a00::1AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US205.251.192.90 2600:9000:5300:5a00::1
ns-983.awsdns-58.net205.251.195.215 2600:9000:5303:d700::1AS16509 AMAZON-02 - Amazon.com, Inc., US AS16509 AMAZON-02 - Amazon.com, Inc., US-

Checks

  • ✓ 4 nameservers #6
    Delegated to ns-1391.awsdns-45.org, ns-1911.awsdns-46.co.uk, ns-90.awsdns-11.com, ns-983.awsdns-58.net.
  • ✓ Parent and zone agree #7
    The parent delegation and the zone's NS records list the same nameservers.
  • ✓ No glue needed #8
    All nameservers are outside the zone, so no glue records are needed.
  • ✓ All names resolve #9
    Every nameserver name has an address and is not an alias.
  • ✓ Nameservers in different networks #10
    The nameservers are spread over 4 IPv4 /24s and 4 IPv6 /48s.
  • i
    All nameservers in one AS
    All nameserver addresses are announced by one network operator (AS16509 (AMAZON-02 - Amazon.com, Inc., US): 8 addresses). An outage or attack on that network affects all nameservers; large anycast providers mitigate this, but a secondary DNS provider adds independence.
    #11
  • ✓ Nameserver names under 4 TLDs #12
    Nameserver names use the TLDs .com, .net, .org, .uk.
  • ✓ All reachable over IPv6 #13
    Every nameserver has an IPv6 address.

Nameservers

pass

8 of 8 addresses answer authoritatively

Found

NameserverAnswerRecursionTCP / EDNSAXFRVersion
ns-1391.awsdns-45.org 205.251.197.111NOERROR, 3 ms, authoritativenoyes / yesrefused-
ns-1391.awsdns-45.org 2600:9000:5305:6f00::1NOERROR, 8 ms, authoritativenoyes / yesrefused-
ns-1911.awsdns-46.co.uk 205.251.199.119NOERROR, 9 ms, authoritativenoyes / yesrefused-
ns-1911.awsdns-46.co.uk 2600:9000:5307:7700::1NOERROR, 9 ms, authoritativenoyes / yesrefused-
ns-90.awsdns-11.com 205.251.192.90NOERROR, 9 ms, authoritativenoyes / yesrefused-
ns-90.awsdns-11.com 2600:9000:5300:5a00::1NOERROR, 9 ms, authoritativenoyes / yesrefused-
ns-983.awsdns-58.net 205.251.195.215NOERROR, 3 ms, authoritativenoyes / yesrefused-
ns-983.awsdns-58.net 2600:9000:5303:d700::1NOERROR, 4 ms, authoritativenoyes / yesrefused-

Checks

  • ✓ All respond #14
    All 8 nameserver addresses answered.
  • ✓ All authoritative #15
    Every responding nameserver answers authoritatively for the zone.
  • ✓ No recursion #16
    The nameservers do not answer recursive queries for other domains.
  • ✓ No version disclosed #17
    The nameservers don't reveal their software version.
  • ✓ Zone transfers refused #18
    No nameserver allows a zone transfer to the public.
  • ✓ TCP supported #19
    All nameservers answer over TCP.
  • ✓ EDNS supported #20
    All nameservers support EDNS(0).
  • ✓ Public addresses #21
    All nameserver addresses are publicly routable.

SOA

pass

serial 1 · primary ns-90.awsdns-11.com

Found

Primary (MNAME)
ns-90.awsdns-11.com
Contact (RNAME)
awsdns-hostmaster.amazon.com
Serial
1
Refresh / retry
7200 s / 900 s
Expire
1209600 s
Negative TTL
86400 s

Serial per nameserver

NameserverSerial
ns-1391.awsdns-45.org (205.251.197.111)1
ns-1391.awsdns-45.org (2600:9000:5305:6f00::1)1
ns-1911.awsdns-46.co.uk (205.251.199.119)1
ns-1911.awsdns-46.co.uk (2600:9000:5307:7700::1)1
ns-90.awsdns-11.com (205.251.192.90)1
ns-90.awsdns-11.com (2600:9000:5300:5a00::1)1
ns-983.awsdns-58.net (205.251.195.215)1
ns-983.awsdns-58.net (2600:9000:5303:d700::1)1

Checks

  • ✓ Serial 1 everywhere #22
    All nameservers serve the same version of the zone.
  • ✓ Timers within recommendations #23
    SOA refresh 2h, retry 15m, expire 14d, negative TTL 1d.
  • ✓ Primary is a public nameserver #24
    The primary nameserver ns-90.awsdns-11.com is one of the listed nameservers.
  • ✓ Contact awsdns-hostmaster@amazon.com #25
    The SOA RNAME awsdns-hostmaster.amazon.com means awsdns-hostmaster@amazon.com.
  • ✓ Counter serial #26
    The serial 1 is a plain counter.

DNSSEC

warn

Not signed

Found

Validated by resolver
no

Checks

  • !
    Not signed
    The zone is not signed with DNSSEC, so answers can be spoofed. Enable DNSSEC at your DNS provider and publish the DS record at your registrar.
    #27

Records

warn

100 records at the apex

Found

Read from
205.251.197.111:53
TypeValueTTL
SOAns-90.awsdns-11.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400900
NSns-1391.awsdns-45.org.60
NSns-1911.awsdns-46.co.uk.60
NSns-90.awsdns-11.com.60
NSns-983.awsdns-58.net.60
A3.174.46.6060
A3.174.46.7860
A3.174.46.10460
A3.174.46.8560
MX10 aspmx.l.google.com.3600
MX20 alt1.aspmx.l.google.com.3600
MX30 alt2.aspmx.l.google.com.3600
MX40 aspmx2.googlemail.com.3600
MX50 aspmx3.googlemail.com.3600
TXT"28c02c20c897216d1fff4090dd495159d53d0d21c05091ae705955dcf1f4912e"86400
TXT"4eb86427-211e-4be6-b736-e5ba370214a6"86400
TXT"MS=ms88298519"86400
TXT"QzSiPOVU/XDWSgopZU8LDkz4dDxQhvNZvTp/VGcAew0="86400
TXT"_kmo55xcla6hse5bme2si0hoqzcp2slx"86400
TXT"adobe-idp-site-verification=6f8fdf1a-fcdb-453b-9a01-62e4186d2dbe"86400
TXT"anthropic-domain-verification-f4nfmy=5x1aEKj30SC159PjNT9WMOPwA"86400
TXT"apple-domain-verification=ICzVp76nweD0DT7w"86400
TXT"atlassian-domain-verification=4Lha4JpE5bnhxI2bDRY9Ju9jYadbwT57ItPkeM4k5DRthRKKLkAMTMKY1BoYX63X"86400
TXT"c031479a3b187f4d2abf6a033d40f09618c955d0c9ec3ad326731d0c56138706"86400
TXT"canva-site-verification=ItFzzP0M9Ch8BwC71duQ-Q"86400
TXT"citrix-verification-code=69c95163-4d13-4e6b-bde4-d9e70181f4bf"86400
TXT"cursor-domain-verification-11tqcn=dmt8IVopYZIpva042MUkTTrPA"86400
TXT"docker-verification=ca04c949-db52-44f9-9751-75fc46cadec4"86400
TXT"elevenlabs=_oJDQH3f_H5Caifx0NTmltKnVUA2kfYjXpgztR5xSmc"86400
TXT"f4925be543e8efb2ef4379d301390c052211f95978a58c176c5dfeb95d704e7c"86400
TXT"facebook-domain-verification=mffj3ih2aqbcysyyop4fw6tos8pj20"86400
TXT"gem-domain-verification=vgM4AWL4bRsddWazCcsW"86400
TXT"google-site-verification=2edb04a9-a261-43b4-b42b-498ec997840d"86400
TXT"google-site-verification=FtLtlV5fplXZ5uqCfhUX6GQdqCNJSTbNytaohC-R9L8"86400
TXT"google-site-verification=MgfXLJG0kkVCsmGmxiK1ceXBbCh8UeW6fe5x-b3zLnM"86400
TXT"google-site-verification=RzWbd5uc8trLTNUb2YkaJVpT0hgBpi4SvpIk7jP4gkU"86400
TXT"hero-by-hsf-kramer-domain-verification-06aq20=sTRyMWPlkjvGXWhsIT8TpyxMB"86400
TXT"jamf-site-verification=IdrrpuJyY7yS8vI_MYLtsQ"86400
TXT"lt#Zs9eAVjPx@wN6!OWSgjaXkf&mF8x2nkV%D9M9ACWy2!p*@3VAsajH*zN@KSH7MUFww@x8ICaxCjOEkNDZpE7ej0KZCH7DCCQ"86400
TXT"mentimeter-0c29be16-abc3-4aca-a6fd-16a034ef4338"86400
TXT"mgverify=02a39c93ae469e6bbe47bb09953153d8a6a3209939d6157046857345bbf6f10d"86400
TXT"mgverify=09aeab82e44ae4c8231c2581c1126e59fd9d7e5bcb96c394471a1a297df96cea"86400
TXT"mgverify=0dd24d884370ef716d351b30c7bb71f07946480081b1773ad354e022c49f8c58"86400
TXT"mgverify=13be3e762634f9ae6e4b1ea00ed4d56de0e86e7bba68f1c92d5aa8981aa76557"86400
TXT"mgverify=2ef3bd595340cef82aa23b01d62c32f68ffea7ea7aee22dfad9f33b084313cb6"86400
TXT"mgverify=3b05b9ae73e0baa4a7cff3fb9f10f6faf99fc09c96c10942984edcb83aecd8b6"86400
TXT"mgverify=4a1d61062823247984f3aa4d116c2e63bb97e2439c11510650375eb8ef46f7ad"86400
TXT"mgverify=59679530a5461d3e7ff9ae798f1db79307106cb8134748f2fffbacec0914bdaa"86400
TXT"mgverify=7989e180241080823fa79afa79df4f25f38b6ec978c4b002b2fc26bc9668d582"86400
TXT"mgverify=7ddedb86bef6fb24727ebec4b2c53f93408ec3dbeea8d5c2871f9813cff42e34"86400
TXT"mgverify=9f89bdc2e4fd73814c113046ff138dc0982404758ff1c907becac3340c35cfbb"86400
TXT"mgverify=ac8955ae6ff2e0beaa191e036d912d928ae39b0d043fb3fe7a85713f6fa6ba8d"86400
TXT"mgverify=da527a5cd29b52ec36f95af04a3d26afdd8948330ca0ff59eed3459179ccd598"86400
TXT"mgverify=ed199d15149e00d959b5b974516a352918c1bdaae839a9e32c4efcb0fe94730b"86400
TXT"mgverify=ef5e552c135fc240de2c2c6e0336b7dbea76de546cd81a201fd96878327c59a3"86400
TXT"mgverify=ffc728e4a96e121faedbb32d12ba89dde2b12ee654b24582bf3485fd9bac9f4a"86400
TXT"miro-verification=bb49f8d5cc111cc9ea88086eb455e318a6ee2da4"86400
TXT"mixpanel-domain-verify=0e81fc43-9076-4bdd-933f-6441db37c0b3"86400
TXT"notion-domain-verification=LEnjDYzEG1VYr7lsxzaLQbCHtlOl8AzaKRsKicgjxnE"86400
TXT"onetrust-domain-verification=7c928f0e377441028b0744ff402f5854"86400
TXT"onetrust-domain-verification=80511e0e29c7489abb235ea4f7d70df3"86400
TXT"openai-domain-verification=dv-FQE6XCjB90TsT7OHqrKpmzUc"86400
TXT"openai-domain-verification=dv-oWg63kjwoBRdHBofyNxvJs3c"86400
TXT"parallels-domain-verification=fc29e492a87940ca92a4e7cb55bdc3c09caaaae0bda4420dbac49745b233c038"86400
TXT"parkable-domain-verification=w5yjuJvdTEPBe27Zzo0PRQ6J6IpsObx7TLgeVcmXHkE="86400
TXT"pendo-domain-verification=tGvxZVVbPEMYEDIR520E9ZRV7pI"86400
TXT"postman-domain-verification=8800f5dc7bb42a00d24a2c7d0dec1d8d182ec0288392c777bf31bea06609c68ad532b02b251fcaf582d337b1c14d8f5fdde444b24f189b2e6d5f82437dcca818"86400
TXT"ps-cd-verification=c7ebfd81-4b8d-4021-a756-62ffce40812a"86400
TXT"pstk-verification-df95a8ab4c5b2ab250eabf48140ff67f"86400
TXT"qogk6TmVn0Fu1yWC2Cs4bw"86400
TXT"safetyculture-domain-verification=ad350189-df69-4b28-8fcb-27b69c9a30d2"86400
TXT"segment-site-verification=RPcyLQUfmqj5IThHqExpEuJjeNaVB8RO"86400
TXT"sinch-domain-verification=1970a75f-d22b-4e38-af90-b777402fda86"86400
TXT"sinch-domain-verification=aac14b92-f5c8-492f-82ca-fc1257c3f6ba"86400
TXT"status-page-domain-verification=jskgpps0rcs3"86400
TXT"stripe-verification=0b7bb90b16b01ab2151786820ef571c07b0401b2e25e686a44db3ce1211aaf35"86400
TXT"stripe-verification=1f0a1916d0e18dc85bcc3aca0f808d17d1c3aaf3e70cec2fc21886429e7e28e9"86400
TXT"stripe-verification=2ab39b175718fa1b623bd99d33e7aae1f6dba851133919b4045472f194117dee"86400
TXT"stripe-verification=316ec449c3cac6f2e8b3961c18dd32cbf4e35dcf556c7cb6543a4171d8936d6d"86400
TXT"stripe-verification=62a6387e71fc0db517375c1a5acc256c6de8b1e685fc6b371e54b77cfe6e31f5"86400
TXT"stripe-verification=6fe2104b021e249e6bb50514c4b893d723187f0d8d32f6116b17afded1f4ffb7"86400
TXT"stripe-verification=7f200490c09edeed7a59b02f453a259ee7fd3b001fb75a8f7a28285ef2dbca03"86400
TXT"stripe-verification=b8d035562176c5575f2d4928592fd5901d8c075f711680e5659ad76cbb41ae6d"86400
TXT"stripe-verification=ed56fe182fa41ec474e2959f83df624a036228f0aecee6a7cf32d837ea74c95a"86400
TXT"stripeverification=4c7324ad85cdba6f1afa8d47fe01943b9137b3ee9d7474a92567a24178b0bc9c"86400
TXT"teamviewer-sso-verification=9f794dfc86724ffaaca9591c9dce13a1"86400
TXT"twilio-domain-verification=13e13aee9a5cc7b078cc197743c2b21e"86400
TXT"uber-domain-verification=0a13cbbf-69d4-4a66-b61e-14289f81dc8d"86400
TXT"uber-domain-verification=124ae75a-c9a6-4bee-b574-619e901c58d1"86400
TXT"uber-domain-verification=1af2a4b5-a8ec-400b-b8c7-329d2b030045"86400
TXT"uber-domain-verification=3045b114-257e-40f0-a7eb-75e4ad485301"86400
TXT"uber-domain-verification=43c8c170-5a04-46a4-80a1-b599180bbcc4"86400
TXT"uber-domain-verification=4ade773a-ecde-41c4-bb1a-35ba649c6137"86400
TXT"uber-domain-verification=52fce169-70e5-4f52-acf7-a74ae208810b"86400
TXT"uber-domain-verification=6f3398ec-189d-4bff-a8fa-c1b61ac6f50c"86400
TXT"uber-domain-verification=7bf68f90-47ba-49f9-81a2-7514f4500f23"86400
TXT"uber-domain-verification=917940e2-ac28-47f7-8db9-c17b53798aa5"86400
TXT"uber-domain-verification=a5f7707b-496f-4eae-99fa-85c7a6e33ded"86400
TXT"v=spf1 include:_spf.google.com include:stspg-customer.com include:eskerondemand.com include:hubspot.spf-records.xero.com include:_spf.qemailserver.com ip4:52.48.54.246 ip4:52.64.111.139 ip4:34.168.197.200 ip4:34.83.143.116 ~all"86400
TXT"workplace-domain-verification=mhrEkvgrUU9QqWgiZP9JAWGMM0u6ah"86400

Checks

  • !
    Very low TTLs
    These records have a TTL below 5m, causing extra queries and slower lookups: A (1m), NS (1m). Low TTLs are useful just before a planned change. The NS TTL at the parent is 2d and in the zone 1m; resolvers may use either.
    #32
  • ✓ No CNAME at the apex #33
    The zone apex has no CNAME record.
  • ✓ No wildcard #34
    Names that don't exist return NXDOMAIN.
  • i
    No CAA records
    Without CAA records any certificate authority may issue certificates for this domain. A CAA record limits issuance to the CAs you use.
    #35