holidu.com

HTML metadata

Title

Holidu - Vacation Rentals, Cabins, Condos & Apartments

Description

Huge selection of high-quality vacation rentals, vacation homes, villas ✔ Book verified accommodation at the best price with confidence ✔ Holiday accommodation with pool, sea view, child-friendly, pet-friendly ✔ Specialist for the most beautiful vacation regions in Europe ✔

Language

en-US

Canonical

https://www.holidu.com/

Translations

da-dk
de-at
de-ch
de-de
el-gr
en-au
en-ca
en-gb
en-ie
en-nz
en-us
es-es
es-mx
fr-be
fr-fr
hr-hr
it-it
nb-no
nl-nl
pl-pl
pt-br
pt-pt
sv-se

Open Graph

title: Holidu - Vacation Rentals, Cabins, Condos & Apartments
description: Huge selection of high-quality vacation rentals, vacation homes, villas ✔ Book verified accommodation at the best price with confidence ✔ Holiday accommodation with pool, sea view, child-friendly, pet-friendly ✔ Specialist for the most beautiful vacation regions in Europe ✔

Technology

CDN: Amazon CloudFront

Analytics

Google Analytics
Google Tag Manager

Ads

Meta Pixel
Taboola

Third-party hosts loaded (30)

www.googletagmanager.com×2
bat.bing.com×1
cdn.taboola.com×1
cdnjs.cloudflare.com×1
connect.facebook.net×1
retrack-kupona.kuponacdn.de×1
widget.trustpilot.com×1
www.google-analytics.com×1
www.holidu.at×1
www.holidu.be×1
www.holidu.ca×1
www.holidu.ch×1
www.holidu.co.nz×1
www.holidu.co.uk×1
www.holidu.com.au×1
www.holidu.com.br×1
www.holidu.com.mx×1
www.holidu.de×1
www.holidu.dk×1
www.holidu.es×1
www.holidu.fr×1
www.holidu.gr×1
www.holidu.hr×1
www.holidu.ie×1
www.holidu.it×1
www.holidu.nl×1
www.holidu.no×1
www.holidu.pl×1
www.holidu.pt×1
www.holidu.se×1

Contact

Address: Riesstraße 24, 80992, Munich, DE

Registration

Registrar

Amazon Registrar, Inc.

Created

2014-05-13

Expires

2027-05-13 358 days left

Updated

2026-04-08

Name servers

ns-1398.awsdns-46.org
ns-1603.awsdns-08.co.uk
ns-494.awsdns-61.com
ns-654.awsdns-17.net

DNS records live

NS

ns-1398.awsdns-46.org
ns-1603.awsdns-08.co.uk
ns-494.awsdns-61.com
ns-654.awsdns-17.net

MX

1 aspmx.l.google.com
10 aspmx2.googlemail.com
10 aspmx3.googlemail.com
5 alt1.aspmx.l.google.com
5 alt2.aspmx.l.google.com

TXT

Show 10 TXT records

apple-domain-verification=m6UyHbK64XpHNwxi
atlassian-domain-verification=itC4p5FT-aui33XO0pOhUJzOK3kCeywOeHsuAtRLSLsYS/pbqd6JDZAA/qv0mftB
google-site-verification=O-U8LK8W6Zi0MORpaEYhwY8WqpyP7t24DKO65k6jV6w
google-site-verification=XwWn5BKL5QEmcaROvrEE9QpNU7TZkJnWRm1OxcCU8vo
google-site-verification=Zv3kA2fqkoDF0V3cilAH9_f3fap5K13mvU0rTYpMJ40
google-site-verification=oMWy6fuQ3qXFpzNLgte5cqBs-ETT6EGivx53yFiKkRI
google-site-verification=zoGntPOS52Iq4S63iIigQoi2fNH5aZjmoH774CyfY1c
h1-domain-verification=sB3hukbsZxtLPeLjQcwMH48agnd75bwnG21Bxvw4S7nmR5P3
jetbrains-domain-verification=252h0y48689x4zixg7awu39rf
pinterest-site-verification=6e1f5a586c62432a3f036e60f17fd931

Email authentication strong

SPF

v=spf1 include:amazonses.com include:spf.mandrillapp.com include:_spf.google.com include:mail.zendesk.com include:spf.mailjet.com include:sendgrid.net -all

strict (-all)

DMARC

v=DMARC1; p=reject; sp=reject; pct=100; fo=1; ri=3600; rua=mailto:mailreports@holidu.com; ruf=mailto:mailreports@holidu.com

policy: reject (enforced) · sp=reject

DKIM

Show 4 DKIM selectors

google: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCIE3lCuV+NQo6jZVXnBsfKw4eqDzm4kOhc79epFRJIEx7g/+L571vuLKYvM9UVCHfPTIqlmQ/VZgLNHkIBLN…
k2: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBXR9r7OAU6U8/zn92ivImI75naUujWbItRI/QmL1jy5PWGqLwoUA…
s1: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqzDI+Fa3L8ztvlVH7jjej82dsDnLQUa42EVxL8+zoU/PZKkIynbDyYTavRul3/WoxTkxbc/qI7GwAyEGFi…
s2: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDn3LRT8oMfzHN7yIJn6D40IsE31Qjc8gG+aj/1FyDVu/FO3N3eru3xHz0LFnLWs7l3Yc0vP07nGSjREz3TpPyCB+…

selectors probed

Certificate (current)

Amazon RSA 2048 M04

from 2025-11-13 to 2026-12-13

Expires in 207 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 85/100 Checked live page: https://www.holidu.com/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
referrer-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources
missing Permissions Policy

Header values

referrer-policy: strict-origin-when-cross-origin
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
content-security-policy: default-src 'self' https:;script-src 'self' 'unsafe-inline' 'unsafe-eval' https: data:;style-src 'self' 'unsafe-inline' https:;img-src 'self' data: https: http:;font-src 'self' data: https:;connect-src 'self' https: ws: wws:;worker-src 'self' blob:;frame-ancestors 'self' https://*.holidu.com https://*.holidu.cloud https://*.holidu.io https://tsmart.tomas-travel.com
strict-transport-security: max-age=15552000

Links to (1)

trustpilot.com×1