Minor findings only — largely well diversified.
Network dependency map
each block is one resolved endpoint, coloured by Autonomous System- AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation×8
- AS13335 CLOUDFLARENET - Cloudflare, Inc.×2
- AS30148 SUCURI-SEC - Sucuri×1
Findings
4All nameservers are Cloudflare, a globally anycast operator — resilient to localized failures, but still a single operator-level dependency (control plane, account, global outage).
2 endpoints
- ns10.worldnic.com → 162.159.27.124 · AS13335 Cloudflare · US
- ns9.worldnic.com → 162.159.26.110 · AS13335 Cloudflare · US
Acceptable for most; for tier-1 domains add a second anycast provider for operator independence.
No DS record at the parent: responses are not cryptographically authenticated and can be forged by an on-path attacker or a poisoned resolver.
Enable DNSSEC signing and publish a DS record at the registrar. (Automate key rollover — misconfigured DNSSEC can itself cause outages.)
The web tier resolves into a CDN/anycast network, which absorbs traffic across many PoPs and shields the origin.
1 endpoints
- berkshirehathaway.com → 192.124.249.118 · AS30148 Sucuri · US
Without a CAA record, any public CA may issue certificates for this domain, widening the mis-issuance attack surface.
Publish a CAA record naming only your intended CA(s).
DNS records
| Nameservers | ns10.worldnic.com ns9.worldnic.com |
|---|---|
| A | 192.124.249.118 |
| MX | 5 berkshirehathaway-com.mail.protection.outlook.com |
| SOA | ns9.worldnic.com. namehost.worldnic.com. 122021809 10800 3600 604800 3600 |
| CAA | none — any CA may issue |
| DNSSEC | unsigned |
| TXT | 2 record(s) |
Scan history
- A2026-08-01 03:18 UTC
- A2026-08-01 00:57 UTC
- A2026-08-01 00:57 UTC
- A2026-08-01 00:57 UTC
- A2026-08-01 00:57 UTC
- A2026-08-01 00:53 UTC
- A2026-07-30 10:50 UTC
- A2026-07-30 10:50 UTC
Machine-readable: /api/scan?domain=berkshirehathaway.com