Infrastructure - https://ntnu.no BeaverCheck Audit

D

CDN & Delivery

Action

No CDN detected

FIX

No CDN detected

A CDN can significantly improve load times for users around the world by caching content at edge nodes closer to them.

No CDN detected

Consider using a CDN to improve global delivery speed and reduce origin load.

B

URL Variants

www/non-www, trailing slash, HTTP→HTTPS

REVIEW

www/non-www, trailing slash, HTTP→HTTPS

Both www and non-www versions serve content

Got: Both variants return 200 Expected: One variant 301-redirects to the other

HTTP correctly 301-redirects to HTTPS

www / non-www

200https://www.ntnu.no/

200https://ntnu.no/

Inconsistent — duplicate content risk

HTTP → HTTPS

301http://ntnu.no/ → https://www.ntnu.no/

Consistent

B

TLS Certificate Expiry & Recommendations

72 days until leaf cert expires — 3 issues to address

REVIEW

Certificate validity

72

days left

0d 30d 60d 90d+

Recommended actions

Enable HSTS: Strict-Transport-Security: max-age=31536000; includeSubDomains
Enable DNSSEC on your domain for DNS spoofing protection
Enable OCSP stapling on your TLS server to remove a CA roundtrip and protect user privacy

A

DNS Records

1 A records, 249 ms lookup

PASS

1 A records, 249 ms lookup

Resolves to 1 IPv4 address(es)

Got: 129.241.160.102

Single A record — no DNS redundancy

Multiple A records provide failover if one server goes down.

Has 1 IPv6 (AAAA) record(s)

Got: 2001:700:300:6::102

2 nameserver(s) configured

Got: ns2.ntnu.no, ns1.ntnu.no

1 mail exchanger(s) configured

CAA records not checked

CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.

SPF record present in TXT

DNS resolution is slow (249 ms)

Slow DNS adds latency to every page load. Consider a faster DNS provider.

Got: 249 ms

A	129.241.160.102
AAAA	2001:700:300:6::102
CNAME	—
NS	ns2.ntnu.no, ns1.ntnu.no
MX	10 mx.ntnu.no
TXT	DomainVerification=2I3NO4B0TQ0I8CQEI2KDVYXIGJZ10MTY27LZV5UJT7ALV76Z38L28QP1UT9JL... spf2.0/pra ?all google-site-verification=Xx5fBeGjjp3yn_p6pKsItGFlSGvSh7jzVzIS9BNF30Q atlassian-domain-verification=sT5VxuzLa7WRj7bawE2dodpOCiXlPW3VRxaESpLj0KJ/8QW6Oi... mentimeter-57eb06dd-8276-4a25-b792-e382cfa9b78c mindmanager-verification=03d32105985e3d564fd6369c20aa3906cc5db6c16f420a081b0ab77... HARICA-ZFlNOwoYihAkqPe3RpK iriGT+vOYcYYM/ek4bLBmRvsMHqP1t8qr4ExIkM9dCLaJa7ltGVSH4Xcn5VG/AoLJwuPRneYsshzmDYL... adobe-idp-site-verification=e65ce020d34cb80259f8669dbb819b08ad0b8a18c888f8d05f06... google-site-verification=RGmJUWaSQTsm399bjj0F14VisKTs8CinnYVRoR10Fe8 google-gws-recovery-domain-verification=56591251 bw=fVAzXwrNv207lnBVtXk9fHaxfqy19Ps9XkLH6WIbbPmg DomainVerification=G40FRC22TL9986UFBZRI0A29U3PZKKXKT4VQQ7JVF6FB10KLZSSC0PA10REGR... SPF v=spf1 redirect=_spf.ntnu.no miro-verification=d37a1e9c27cede04e0941fe857abb3f932c1b050 ZOOM_verify_vMwljb-bQoqcJ7Aip8L60A google-site-verification=Ve_aqImI2EFPG3Qs6q6XqdvFP8y26XOOWy-9f8C-uU8 dropbox-domain-verification=h9cmvsnr7r1t xJv/2IGDVQxv87KdlqxfsXz5XBreheS/kbCFP1Gsjd7c68yYx4inFuVxBjLCi22/Br8FKJOCYnc4xQbB...
CAA	Lookup not available with standard resolver

Resolved in 249 ms

Multiple A records provide failover if one server goes down.

Why this matters

Single A record means a single point of failure — if that IP goes down, your site is unreachable until DNS TTL expires.

Learn more ▾

Add multiple A records for round-robin failover, or use a managed DNS provider with health-checked failover (Route 53, Cloudflare, NS1). Short TTL (60-300s) lets clients recover faster on outages.

Source: SRE practice / DNS architecture

CAA record lookup requires a specialized DNS resolver. This check will be available in a future update.

Why this matters

Informational: CAA (Certification Authority Authorization) records weren't checked in this scan.

Slow DNS adds latency to every page load. Consider a faster DNS provider.

Why this matters

DNS resolution is slow — anycast DNS providers (Cloudflare, Route 53) typically resolve <50ms globally.

Source: DNS performance benchmarks

A

Redirect Chain

1 redirect(s), 459 ms total

PASS

1 redirect(s), 459 ms total

Single redirect

Got: https://ntnu.no → https://www.ntnu.no/ (301)

WWW normalization redirect

https://ntnu.no

171 ms · HTTP/1.1

301

https://www.ntnu.no/

287 ms · HTTP/1.1 FINAL

#	URL	Status	Time	Protocol	Server
1	https://ntnu.no	301	171 ms	HTTP/1.1	Apache/2.4.52 (Ubuntu)
2	https://www.ntnu.no/	200	287 ms	HTTP/1.1	Apache/2.4.52 (Ubuntu)

See the visual redirect chain in the HTTP Probe tab →

A+

IPv6 Readiness

IPv6 reachable (56 ms)

PASS

IPv6 reachable (56 ms)

IPv6 is configured and reachable at 2001:700:300:6::102

Got: 56 ms connect

IPv6 Ready

AAAA Records 2001:700:300:6::102 Connection Reachable (56 ms)

A+

Crawlability

robots.txt present, sitemap with 69 URLs

PASS

robots.txt present, sitemap with 69 URLs

robots.txt is present

Got: 3760 bytes

sitemap.xml is present

sitemap.xml is valid XML

sitemap.xml contains 69 entries

Sitemap index with 69 child sitemaps

robots.txt references sitemap

robots.txt 200 OK

Size 3760 B Sitemaps referenced 1 User-agents * Blocking No — crawling allowed

# Generelle robot-regler

User-Agent: *

# Liferay o.l.
Disallow: /c/portal/
Disallow: /en/
Disallow: /lib
Disallow: /nb/
Disallow: /search
Disallow: /sok
Disallow: /tmp
Disallow: /web
Disallow: /ansatte/-/
Disallow: /employees/-/
Disallow: /combo/
Disallow: /combo?
Disallow: /combo
Disallow: /tobjoto

# Ekstraregler for Liferay
Disallow: /*p_p_state*
Disallow: /*p_p_id*
Disallow: /*p_p_lifecycle*
Disallow: /*p_p_mode*
Disallow: /*contentId*
Disallow: /*thisId*
Disallow: /*contextId*
Disallow: /*p_p_auth*
Disallow: /*redirect*
Disallow: /*_49_groupId*
Disallow: /*_49_privateLayout*
Disallow: /*_49_struts_action*
Disallow: /*p_p_col_id*
Disallow: /*p_p_col_count*
Disallow: /*p_p_cacheability*
Disallow: /*p_p_resource_id*
Disallow: /*SiteId*
Disallow: /*_caleventview_WAR_caleventportlet_eventId*
Disallow: /*p_p_col_pos*
Disallow: /*ContentParents*
Disallow: /*f%5B0%5D*
Disallow: /*LastModified_fra*
Disallow: /*LastModified_til*
Disallow: /*DocumentTypeId*


# Confluence/wikihotell
Disallow: /wiki/label/
Disallow: /wiki/download/
Disallow: /wiki/rest/
Crawl-delay: 10

# NTNUs nettbutikk
Disallow: /nettbutikk/

# Machform-basert skjema, ekstern
Disallow: /machform/

# Begrenser topp-blogger, men åpner for alle andre ntnu-blogger
# Bruk av Allow er lov i hht RFC9309
Disallow /blogger/
Allow /blogger/guide/
Allow /blogger/ub-adbbm/
Allow /blogger/ub-arkeologi/
Allow /blogger/ub-lokalhistorie/
Allow /blogger/ub-realfag/
Allow /blogger/ub-teknologi/
Allow /blogger/ub-okonomi/
Allow /blogger/ub-samfunn/
Allow /blogger/ub-musikk/
Allow /blogger/ub-filosofi/
Allow /blogger/ub-kunstogmedier/
Allow /blogger/ub-litteratur/
Allow /blogger/ub-mh/
Allow /blogger/ls/
Allow /blogger/elsa/
Allow /blogger/medialab/
Allow /blogger/andersarvesen/
Allow /blogger/reset/
Allow /blogger/ub-spesialsamlinger/
Allow /blogger/healthpromotion/
Allow /blogger/ub-ark4/
Allow /blogger/forsklab-universell-utforming/
Allow /blogger/ub-bibliometri/
Allow /blogger/lor-ved-ntnu/
Allow /blogger/the-materialities-of-the-modern-breakthrough/
Allow /blogger/monica-rolfsen/
Allow /blogger/ole-bjorn-roste/
Allow /blogger/hunt/
Allow /blogger/teamntnu/
Allow /blogger/sekom/
Allow /blogger/allmennmedisin/
Allow /blogger/norpart/
Allow /blogger/fysikkforfakirer/
Allow /blogger/cpslab/
Allow /blogger/link/
Allow /blogger/humsam/
Allow /blogger/came/
Allow /blogger/nakensnegler/
Allow /blogger/realsocialmedia/
Allow /blogger/folkehelsebloggen/
Allow /blogger/teknat/
Allow /blogger/menneskets-tidsalder/
Allow /blogger/ingrid-schjolberg-ie/
Allow /blogger/richard-hann/
Allow /blogger/konpas/
Allow /blogger/consense/
Allow /blogger/afino/
Allow /blogger/lkb/
Allow /blogger/helse/
Allow /blogger/realfag/
Allow /blogger/uavicing/
Allow /blogger/ihb/
Allow /blogger/most/
Allow /blogger/iik-edu/
Allow /blogger/cius/
Allow /blogger/literaturogsamfunn/
Allow /blogger/arkitektur5/
Allow /blogger/omsorgsforskning/
Allow /blogger/iap/
Allow /blogger/fagkomblogg/
Allow /blogger/sprakstotte/
Allow /blogger/eladda/
Allow /blogger/unikup/
Allow /blogger/lotteryfantasy/
Allow /blogger/talkinnovation/



# Historisk, som kan slettes eller begrenses på annet vis?
Disallow: /adm/it/dokumenter
Disallow: /api/
Disallow: /arch
Disallow: /bridge/
Disallow: /c14
Disallow: /captain
Disallow: /diskusjon
Disallow: /gemini
Disallow: /group/
Disallow: /ime/_detail
Disallow: /ime/_export
Disallow: /ime/_media
Disallow: /ime/lib
Disallow: /ime/statistikk
Disallow: /info/old/
Disallow: /iteamax
Disallow: /mailinglists
Disallow: /ntnu-bil
Disallow: /offjour
Disallow: /okonomi
Disallow: /pics
Disallow: /proxy.pac
Disallow: /statistikk
Disallow: /studieavd
Disallow: /studieavd/dok
Disallow: /studieavd/timeplan/
Disallow: /www-admin


Sitemap: https://www.ntnu.no/sitemap.xml

sitemap.xml 200 OK

Type Sitemap Index URLs 69 entries Valid XML Yes

Child Sitemaps:

A+

Domain Intelligence

ntnu.no — via SIKT - KUNNSKAPSSEKTORENS TJENESTELEVERANDØR, 26 years, 9 months old

PASS

ntnu.no — via SIKT - KUNNSKAPSSEKTORENS TJENESTELEVERANDØR, 26 years, 9 months old

DNSSEC is not enabled

DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.

Registrar: SIKT - KUNNSKAPSSEKTORENS TJENESTELEVERANDØR

Domain expiry

Unknown

SSL certificate

72 days

Issued by Hellenic Academic and Research Institutions CA

Domain age

26 years, 9 months

Registered November 14, 1999

DNSSEC

Not enabled

Protects against DNS spoofing

Hosting

Unknown

2001:700:300:6::102

Registrar

SIKT - KUNNSKAPSSEKTORENS TJENESTELEVERANDØR

Lock status unknown 2 NS records

Expiry timeline

Today

+1 year

SSL expiry Danger zone (≤30 days)

Recommended actions

Enable DNSSEC to protect visitors from DNS spoofing

Registrar SIKT - KUNNSKAPSSEKTORENS TJENESTELEVERANDØR

Created November 14, 1999 (26 years, 9 months ago)

Last Updated November 15, 2025

Name Servers ns1.ntnu.no, ns2.ntnu.no

DNSSEC Not enabled

Hosting

IP Address 2001:700:300:6::102

Data source: rdap (0.3s)

DNSSEC protects against DNS spoofing attacks. While not required, enabling DNSSEC adds an additional layer of security. Contact your DNS provider to enable it.

Why this matters

Without DNSSEC, an attacker who can poison your DNS can hijack your domain — and SSL certs alone don't stop them.

Learn more ▾

DNSSEC adds cryptographic signatures to DNS records, preventing forged responses from poisoning resolver caches. Without it, an attacker who controls the network path can redirect your domain to a malicious server before any HTTPS handshake happens. Most modern registrars (Cloudflare, Google Domains, Route 53) enable it with one toggle.

Source: ICANN / RFC 4033

A+

HTTP Probe Timing

Total 229 ms — DNS, TCP, TLS, TTFB, content transfer breakdown

PASS

DNS Lookup

57 ms

TCP Connect

55 ms

TLS Handshake

63 ms

Time to First Byte

230 ms

Total Time

230 ms

Connection waterfall

DNS Lookup 57 ms TCP Connect 55 ms TLS Handshake 63 ms Server Processing 55 ms Content Transfer 0 ms