lner.co.uk

HTML metadata

Title: Cheap Train Tickets in Britain | No Booking Fees | LNER
Description: Need cheap train tickets? LNER’s website and app offer zero booking fees for all train journeys, and you can also save 47% with LNER Advance tickets.
Language: en
Canonical: https://www.lner.co.uk/

Open Graph

url: https://www.lner.co.uk/
title: Cheap Train Tickets in Britain | No Booking Fees
site name: LNER
description: Need cheap train tickets? LNER’s website and app offer zero booking fees for all train journeys, and you can also save 47% with LNER Advance tickets.

Technology

CDN: Vercel
CMS: Next.js

Analytics

Google Tag Manager

Ads

Meta Pixel

Cookie consent

OneTrust

Third-party hosts loaded (8)

www.googletagmanager.com×3
cdn-ukwest.onetrust.com×2
d21y75miwcfqoq.cloudfront.net×2
connect.facebook.net×1
lner.enterprisebot.co×1
maps.googleapis.com×1
maps.gstatic.com×1
www.usabilla.com×1

Social

Contact

Email

customers@lner.co.uk

Phone

03457 225 333

Address

LNER, West Offices, Station Rise, YO1 6GA, York, GB

Registration

Registrar

GoDaddy.com, LLC.

Created

2010-09-26

Expires

2029-09-26 1225 days left

Updated

2024-07-06

Name servers

pdns09.domaincontrol.com.
pdns10.domaincontrol.com.

DNS records live

NS

pdns09.domaincontrol.com
pdns10.domaincontrol.com

MX

0 mxa-004c0102.gslb.pphosted.com
0 mxb-004c0102.gslb.pphosted.com

TXT

Show 7 TXT records

559K5lU+CwPSQj9sJKrJxkWBPB4A6XIULGTUYxtQf3g7ti7Dne71dJB4sOlngJH0yXH2SHuzc/RQPqncbZl5xg==
nitro-verification-code=czc2YTg4YTA0OTJkYzBmMTk=
7d7392a9-8928-4550-a145-b7b8a355df8c
_h50R9r1I-7yEezd017XfMrY_r0afvvs9u5udlsF8k
remarkable-domain-verification=23262a91-c6c3-4d77-ab39-4b5f14c332b0
atlassian-sending-domain-verification=c284c97b-660a-4994-89e5-62e702b07778
vmware-cloud-verification-e0ff7266-50b4-4642-81c7-e1e0ce22a241

Verified for

Apple
Atlassian
Brevo
DocuSign
Google
Google Workspace
Microsoft 365
Miro
OneTrust

Email authentication strong

SPF

v=spf1 include:spf.mailjet.com include:spf_c.oraclecloud.com include:spf.protection.outlook.com include:spf.brevo.com mx ip4:148.139.2.8/29 ip4:148.139.3.8/29 ip4:5.61.115.80/28 ip4:5.61.115.96/28 ip4:5.61.115.112/28 ip4:88.131.62.56 ip4:88.151.159.53 ip4:216.119.217.33 ip4:216.119.209.33 ip4:185.224.57.177 ip4:185.183.28.8 ip4:185.132.181.144 ip4:205.220.189.169 ip4:205.220.188.142 ip4:205.220.189.159 ip4:143.55.146.173 ip4:143.55.149.80 -all

strict (-all)

DMARC

v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com

policy: reject (enforced)

DKIM

mail: k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDeMVIzrCa3T14JsNY0IRv5/2V1/v2itlviLQBwXsa7shBD6TrBkswsFUToPyMRWC9tbR/5ey0nRBH0ZVxp+lsmTxid2Y2z…

selectors probed

Certificate (current)

R12

from 2026-03-24 to 2026-06-22

Expires in 33 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 85/100 Checked live page: https://www.lner.co.uk/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options

findings

CSP uses wildcard sources
missing Referrer Policy
missing Permissions Policy

Header values

x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
content-security-policy: img-src 'self' https: blob: data:; font-src 'self' https://vercel.live https://va.vercel-scripts.com https://vercel.com https://assets.vercel.com https://safespaces.azurewebsites.net https://fonts.googleapis.com https://fonts.gstatic.com https://lner.enterprisebot.co https://beta-lner.enterprisebot.co https://applepay.cdn-apple.com https://firstclassupgrades.seatfrog.com https://d6tizftlrpuof.cloudfront.net data:; object-src 'none'; base-uri 'self' https://d21y75miwcfqoq.cloudfront.net https://firstclassupgrades.seatfrog.com https://d6tizftlrpuof.cloudfront.net https://lner-api.exponea.com https://*.exponea.com https://br.analytics.lner.co.uk; form-action 'self' https://lner.formstack.com https://*.formstack.com https://www.facebook.com; upgrade-insecure-requests; frame-src 'self' https://www.google.com https://www.gstatic.com https://ssl.gstatic.com https://apis.google.com https://*.googletagmanager.com https://tagmanager.google.com https://pay.google.com https://google.com/pay https:
strict-transport-security: max-age=31536000; includeSubDomains; preload