Infrastructure
· 9 checks — DNS, redirects, IPv6, crawlability, URL variants, and domain intelligence rolled into one auditable list.DCDN & DeliveryActionNo CDN detectedFIX
Consider using a CDN to improve global delivery speed and reduce origin load.
BURL Variantswww/non-www, trailing slash, HTTP→HTTPSREVIEW
www / non-www
Inconsistent — duplicate content risk
HTTP → HTTPS
Consistent
BTLS Certificate Expiry & Recommendations304 days until leaf cert expires — 3 issues to addressREVIEW
Certificate validity
Recommended actions
- Enable HSTS: Strict-Transport-Security: max-age=31536000; includeSubDomains
- Enable DNSSEC on your domain for DNS spoofing protection
- Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy
A+DNS Records3 A records, 84 ms lookupPASS
| A | 3.78.119.148, 3.69.239.214, 18.195.53.104 |
| AAAA | 2a05:d014:73f:ec03:beef:9e74:f63b:4dda, 2a05:d014:73f:ec05:adb:6f8:46dc:3c29, 2a05:d014:73f:ec04:c329:4c9f:a068:6709 |
| CNAME | — |
| NS | pns.dtag.de, dns2.telekom.de, ns1.telekom.net, dns1.telekom.de |
| MX | 100 mailin.ng.telekom.net |
| TXT | mongodb-site-verification=p7YrLhGyLifl1g3RFBE2JvwOuIOdHSkQ figma-domain-verification=160013d7cef1653e8d58a5908848cf939b066e8e3f0a88e17c5a9c... google-site-verification=MPZTaBCWqDmQdTohr5tSNZEo9jXQdMnX4ESkpNW_4II atlassian-domain-verification=uGLUdpD2IVY19OJG5SQbVpV497SMTPJPSKYbkZRnWtMwczrdbH... ZOOM_verify_kRWkqphTgRDVlIbvv9Kiwv webexdomainverification.BSJE=ba47630b-e4fb-43b0-9ef5-403f5d12d26a bw=wvCJUNty9K5xF1XXOg9j7Oyr4zyBzSeucLK3R9GSn3Zz google-site-verification=DJgHOPXTkscY4YdgC02U_Z17eJIqIzZo2-Z2wGkwiDM Fdo6N5s8B8hnnwXO3S5JBjz6vulda6AAiICiY7mR5vHuH3ltRiwWlgoYzeWKMt9F03nDTM+dwj/CiBb/... docusign=23f2c4c1-d834-46ae-a026-4519a62c2981 docusign=60ddff7f-bdf1-41fc-825f-47c551160b54 ciscocidomainverification=6e2aa122cdd7178b01900ed66d8b507dd30fb2597364b7380809b0... bw=NPbk0jkxzGa2yr9nGIj9Xj9KAHtJy28NdO0SL6PSKMS8 docusign=5e3aa268-29b9-4603-aa34-9d44f82c2b6c google-gws-recovery-domain-verification=43219657 adobe-idp-site-verification=22f64faf827865075c1f3f1d814848b67f1e2ebe012796f5b958... miro-verification=089da153dee3b2bdebb4e4940c914abf39a26035 atlassian-domain-verification=RYDBmArxP6DhrshwBcIZoo3ZF26BwxWI06Enb8LaC7YfF2d8cP... duo_sso_verification=1HAfacuYQfE5QbcThdGBY3Bn1hhLG0bpnuZWTja01fodDmZTCCUOHcIpHh9... google-site-verification=NH8PPq6gKjlt7EgalZIOxMTdw1FZ3aV2U56HiXUl1F8 SPF v=spf1 include:_spf.telekom.com include:_spf.salesforce.com ~all Dynatrace-site-verification=7f9c8344-163a-4ff1-912a-2d1f48454207__6bd4e4751cupff... |
| CAA | Lookup not available with standard resolver |
CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.
Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.
ARedirect Chain1 redirect(s), 526 ms totalPASS
https://telekom.com
107 ms · HTTP/1.1
https://www.telekom.com:443/
420 ms · HTTP/1.1 FINAL
| # | URL | Status | Time | Protocol | Server |
|---|---|---|---|---|---|
| 1 | https://telekom.com | 301 | 107 ms | HTTP/1.1 | awselb/2.0 |
| 2 | https://www.telekom.com:443/ | 200 | 420 ms | HTTP/1.1 | nginx |
See the visual redirect chain in the HTTP Probe tab →
A+IPv6 ReadinessIPv6 reachable (32 ms)PASS
A+Crawlabilityrobots.txt present, sitemap with 1 URLsPASS
User-agent: *
Disallow: /ui-com-16-de/
Disallow: /ajax/
Disallow: /de/glossar-details/
Disallow: /en/glossary-details/
Disallow: /dynamic/fragment/
Disallow: /*.rss$
Disallow: /*.ics$
User-agent: BLP_bbot/0.1
Disallow: /
Sitemap: https://www.telekom.com/service-sitemap-46d71a0aa936124d85407c84e988d231-sitemap_index.xml
Sitemap: https://www.telekom.com/service-sitemap-9295fd5d725dc94c19d27dd57f830e6d-sitemap_index.xml
A+Domain Intelligencetelekom.com — via Deutsche Telekom AG, 31 years, 6 months oldPASS
281 days
March 22, 2027
304 days
Issued by Deutsche Telekom Security GmbH
31 years, 6 months
Registered March 21, 1995
Not enabled
Protects against DNS spoofing
Unknown
2a05:d014:73f:ec04:c329:4c9f:a068:6709
Deutsche Telekom AG
Expiry timeline
Recommended actions
- Enable DNSSEC to protect visitors from DNS spoofing
- Enable registrar lock (clientTransferProhibited) to block unauthorized domain transfers
DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.
Without DNSSEC, an attacker who can poison your DNS can hijack your domain — and SSL certs alone don't stop them.
Learn more ▾ ▴
DNSSEC adds cryptographic signatures to DNS records, preventing forged responses from poisoning resolver caches. Without it, an attacker who controls the network path can redirect your domain to a malicious server before any HTTPS handshake happens. Most modern registrars (Cloudflare, Google Domains, Route 53) enable it with one toggle.
Source: ICANN / RFC 4033
The domain can be transferred without an unlock step. Enable registrar lock (clientTransferProhibited) in your registrar's control panel to protect against unauthorized or accidental transfers.
Without registrar lock, an attacker who phishes your registrar credentials can transfer the domain in minutes — total brand hijack.
Learn more ▾ ▴
Registrar lock (clientTransferProhibited, clientUpdateProhibited, clientDeleteProhibited) requires extra verification before any transfer/update/delete. Every major registrar offers it free. Combined with 2FA on your registrar account, it's the strongest defense against domain hijacking.
Source: ICANN / domain-security best practice