u-centraal.nl

HTML metadata

Title: Home | U Centraal
Language: nl
Canonical: https://www.u-centraal.nl/

Open Graph

title: Home | U Centraal

Technology

Server: nginx
CMS: Next.js

Third-party hosts loaded (1)

policy.app.cookieinformation.com×1

Social

Contact

Email

wegwijzer@u-centraal.nl

Phone

030-2361770

Address

Pieterskerkhof 16, 3512 JR, Utrecht, Utrecht, NL

DNS records live

NS

ns0.transip.net
ns1.transip.nl
ns2.transip.eu

MX

10 ucentraal-nl0c.mail.protection.outlook.com

TXT

/rwnsQzYchclOAGGiMEN8cQrHCOJLmKA3h0sOZFeLLQLSuEvBrk/WLWG/6k0oG8gCgw5em4QjNzF/MCnwCRERw==
regicare._domainkey CNAME dkim.regicare.nl

Verified for

Apple
Brevo
Google
Microsoft 365

Email authentication strong

SPF

v=spf1 include:spf.protection.outlook.com include:spf.afas.online include:spf.flowmailer.net include:hosting.regicare.nl include:spf.mailjet.com include:_spf.zivver.com include:_spf.exonet.nl -all

strict (-all)

DMARC

v=DMARC1; p=reject; pct=100

policy: reject (enforced)

DKIM

Show 4 DKIM selectors

selector1: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3SKTwgGpOE9HcOuPvRd7bVJFY/zszmBS+GLyscxOMZHRMEFBCSOi7tGyzHCdB4j/uZvx0h61ke2tEh…
selector2: v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCuyFmyRyw7o6UqQQ7Jr8io51baDi+X78t15c13AbVMQEoDzK9d1oItVdtO/06Q8H4eHuAPuRBl3zt9z869/2…
s1: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwXXapEcas0nvmAeXLMZjNPHWc49Tpvohn/OJpjY7JEdOsPzBrE4ptZzW/fHXH9DY9ruPInHYlinuU5/I2T…
s2: k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbRrMX7WKMV5RnnpKI6qqJ4Nig8OMtNjmeyiRzBBtHDG5wCyvvORHGSudebdB2od8ixclHqcqIBiotTDSFhgUFMx…

selectors probed

Certificate (current)

R12

from 2026-05-24 to 2026-08-22

Expires in 78 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 85/100 Checked live page: https://www.u-centraal.nl/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options
referrer-policy
permissions-policy

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources
weak frame protection

Header values

referrer-policy: strict-origin-when-cross-origin
x-frame-options: ALLOW-FROM https://backend.stichting-pk.nl
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), fullscreen=(self), geolocation=(self), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), usb=(), web-share=(self)
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://policy.app.cookieinformation.com https://stichting-pk.piwik.pro https://stichting-pk.containers.piwik.pro https://www.youtube.com https://www.youtube-nocookie.com https://*.google.com https://cdn.userway.org https://www.gstatic.com https://*.algolia.net https://*.algolianet.com; style-src 'self' 'unsafe-inline' https://cdn.userway.org https://fonts.googleapis.com https://fonts.gstatic.com; img-src 'self' blob: data: https://maps.googleapis.com https://maps.gstatic.com https://img.youtube.com https://i.ytimg.com https://cdn.userway.org; font-src 'self' https://cdn.userway.org https://fonts.googleapis.com https://fonts.gstatic.com; connect-src 'self' https://maps.googleapis.com https://policy.app.cookieinformation.com https://stichting-pk.piwik.pro https://stichting-pk.containers.piwik.pro https://*.userway.org https://consent.app.cookieinformation.com https://*.google.com https://*.al
strict-transport-security: max-age=31536000;