| Zone (*) | DNSSEC - Informations |
|---|
|
|
Zone: (root)
|
|
(root)
| 1 DS RR published
|
|
|
|
|
| DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest 4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=
|
|
|
|
|
| • Status: Valid because published
|
|
|
|
|
| 3 DNSKEY RR found
|
|
|
|
|
| Public Key with Algorithm 8, KeyTag 20326, Flags 257 (SEP = Secure Entry Point)
|
|
|
|
|
| Public Key with Algorithm 8, KeyTag 38696, Flags 257 (SEP = Secure Entry Point)
|
|
|
|
|
| Public Key with Algorithm 8, KeyTag 57780, Flags 256
|
|
|
|
|
| 1 RRSIG RR to validate DNSKEY RR found
|
|
|
|
|
| RRSIG-Owner (root), Algorithm: 8, 0 Labels, original TTL: 172800 sec, Signature-expiration: 20.09.2026, 00:00:00 +, Signature-Inception: 30.08.2026, 00:00:00 +, KeyTag 20326, Signer-Name: (root)
|
|
|
|
|
| • Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20326 used to validate the DNSKEY RRSet
|
|
|
|
|
| • Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest "4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone
|
|
|
Zone: be
|
|
be
| 1 DS RR in the parent zone found
|
|
|
|
|
| DS with Algorithm 13, KeyTag 45588, DigestType 2 and Digest aHV1w/D6RXC+OsI69A/6/F4oqN5p3oVaLbH7m00ncxk=
|
|
|
|
|
| 2 RRSIG RR to validate DS RR found
|
|
|
|
|
| RRSIG-Owner be., Algorithm: 8, 1 Labels, original TTL: 86400 sec, Signature-expiration: 14.09.2026, 20:00:00 +, Signature-Inception: 01.09.2026, 19:00:00 +, KeyTag 57780, Signer-Name: (root)
|
|
|
|
|
| • Status: Good - Algorithmus 8 and DNSKEY with KeyTag 57780 used to validate the DS RRSet in the parent zone
|
|
|
|
|
| 4 DNSKEY RR found
|
|
|
|
|
| Public Key with Algorithm 13, KeyTag 19214, Flags 256
|
|
|
|
|
| Public Key with Algorithm 13, KeyTag 44058, Flags 256
|
|
|
|
|
| Public Key with Algorithm 13, KeyTag 45588, Flags 257 (SEP = Secure Entry Point)
|
|
|
|
|
| Public Key with Algorithm 13, KeyTag 47679, Flags 256
|
|
|
|
|
| 1 RRSIG RR to validate DNSKEY RR found
|
|
|
|
|
| RRSIG-Owner be., Algorithm: 13, 1 Labels, original TTL: 86400 sec, Signature-expiration: 04.10.2026, 00:28:38 +, Signature-Inception: 18.06.2026, 07:23:32 +, KeyTag 45588, Signer-Name: be
|
|
|
|
|
| • Status: Good - Algorithmus 13 and DNSKEY with KeyTag 45588 used to validate the DNSKEY RRSet
|
|
|
|
|
| • Status: Valid Chain of trust. Parent-DS with Algorithm 13, KeyTag 45588, DigestType 2 and Digest "aHV1w/D6RXC+OsI69A/6/F4oqN5p3oVaLbH7m00ncxk=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone
|
|
|
Zone: belnet.be
|
|
belnet.be
| 1 DS RR in the parent zone found
|
|
|
|
|
| DS with Algorithm 8, KeyTag 1417, DigestType 2 and Digest vQ7KKXarvn+PDLRAbvI8iUaiuXaOzxCdwwh0MIgFhSA=
|
|
|
|
|
| 2 RRSIG RR to validate DS RR found
|
|
|
|
|
| RRSIG-Owner belnet.be., Algorithm: 13, 2 Labels, original TTL: 86400 sec, Signature-expiration: 16.09.2026, 05:45:30 +, Signature-Inception: 26.08.2026, 22:34:27 +, KeyTag 47679, Signer-Name: be
|
|
|
|
|
| • Status: Good - Algorithmus 13 and DNSKEY with KeyTag 47679 used to validate the DS RRSet in the parent zone
|
|
|
|
|
| 2 DNSKEY RR found
|
|
|
|
|
| Public Key with Algorithm 8, KeyTag 1417, Flags 257 (SEP = Secure Entry Point)
|
|
|
|
|
| Public Key with Algorithm 8, KeyTag 6088, Flags 256
|
|
|
|
|
| 1 RRSIG RR to validate DNSKEY RR found
|
|
|
|
|
| RRSIG-Owner belnet.be., Algorithm: 8, 2 Labels, original TTL: 3600 sec, Signature-expiration: 16.09.2026, 23:12:03 +, Signature-Inception: 26.08.2026, 19:50:07 +, KeyTag 1417, Signer-Name: belnet.be
|
|
|
|
|
| • Status: Good - Algorithmus 8 and DNSKEY with KeyTag 1417 used to validate the DNSKEY RRSet
|
|
|
|
|
| • Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 1417, DigestType 2 and Digest "vQ7KKXarvn+PDLRAbvI8iUaiuXaOzxCdwwh0MIgFhSA=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone
|
|
|
Zone: ftp.belnet.be
|
|
ftp.belnet.be
| 0 DS RR in the parent zone found
|
|
|
|
|
| RRSIG Type 5 validates the CNAME - Result: ftp-brudie.belnet.be
Validated: RRSIG-Owner ftp.belnet.be., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 14.09.2026, 16:51:09 +, Signature-Inception: 24.08.2026, 19:17:34 +, KeyTag 6088, Signer-Name: belnet.be
|
|
|
Zone: www.ftp.belnet.be
|
|
www.ftp.belnet.be
| 0 DS RR in the parent zone found
|
|
|
|
|
| DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "9vl0iqu1f0cj8kcpjmg406a6tl053b79" between the hashed NSEC3-owner "9uh1d4q9f005735teeum5648au7urt76" and the hashed NextOwner "a2oqrrlvl0i9f3tbbirpf04h5hspcchu". So the parent zone confirmes the not-existence of a DS RR.
Bitmap: CNAME, RRSIG Validated: RRSIG-Owner 9uh1d4q9f005735teeum5648au7urt76.belnet.be., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 11.09.2026, 19:25:04 +, Signature-Inception: 21.08.2026, 14:16:37 +, KeyTag 6088, Signer-Name: belnet.be
|
|
|
|
|
| DS-Query in the parent zone sends valid NSEC3 RR with the Hash "v91mnpcbbukvappn452i6ooj0ai6h7bj" as Owner. That's the Hash of "ftp.belnet.be" with the NextHashedOwnerName "v99ap80rl7sci69vmfi1rsruovrfj9o1". So that domain name is the Closest Encloser of "www.ftp.belnet.be". Opt-Out: False.
Bitmap: CNAME, RRSIG Validated: RRSIG-Owner v91mnpcbbukvappn452i6ooj0ai6h7bj.belnet.be., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 11.09.2026, 15:08:13 +, Signature-Inception: 21.08.2026, 14:16:37 +, KeyTag 6088, Signer-Name: belnet.be
|
|
|
|
|
| The ClosestEncloser says, that "*.ftp.belnet.be" with the Hash "ul033o8bqbdu01at7t8v00o1ulet00vt" is a possible Wildcard of the DS Query Name. But the DS-Query in the parent zone sends a valid NSEC3 RR With the owner "uhu169rcho1oq854bhq0ebbjpb5g4joh" and the Next Owner "uo0eddlesunbmsv6hhif5l751npr2r8i", so the Hash of the wildcard is between these hashes. So that NSEC3 proves the Not-existence of that wildcard expansion. Opt-Out: False.
Bitmap: CNAME, RRSIG Validated: RRSIG-Owner uhu169rcho1oq854bhq0ebbjpb5g4joh.belnet.be., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 11.09.2026, 15:03:33 +, Signature-Inception: 21.08.2026, 14:16:37 +, KeyTag 6088, Signer-Name: belnet.be
|
|
|
Zone: (root)
|
|
(root)
| 1 DS RR published
|
|
|
|
|
| DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest 4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=
|
|
|
|
|
| • Status: Valid because published
|
|
|
|
|
| 3 DNSKEY RR found
|
|
|
|
|
| Public Key with Algorithm 8, KeyTag 20326, Flags 257 (SEP = Secure Entry Point)
|
|
|
|
|
| Public Key with Algorithm 8, KeyTag 38696, Flags 257 (SEP = Secure Entry Point)
|
|
|
|
|
| Public Key with Algorithm 8, KeyTag 57780, Flags 256
|
|
|
|
|
| 1 RRSIG RR to validate DNSKEY RR found
|
|
|
|
|
| RRSIG-Owner (root), Algorithm: 8, 0 Labels, original TTL: 172800 sec, Signature-expiration: 20.09.2026, 00:00:00 +, Signature-Inception: 30.08.2026, 00:00:00 +, KeyTag 20326, Signer-Name: (root)
|
|
|
|
|
| • Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20326 used to validate the DNSKEY RRSet
|
|
|
|
|
| • Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest "4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone
|
|
|
Zone: be
|
|
be
| 1 DS RR in the parent zone found
|
|
|
|
|
| DS with Algorithm 13, KeyTag 45588, DigestType 2 and Digest aHV1w/D6RXC+OsI69A/6/F4oqN5p3oVaLbH7m00ncxk=
|
|
|
|
|
| 2 RRSIG RR to validate DS RR found
|
|
|
|
|
| RRSIG-Owner be., Algorithm: 8, 1 Labels, original TTL: 86400 sec, Signature-expiration: 14.09.2026, 20:00:00 +, Signature-Inception: 01.09.2026, 19:00:00 +, KeyTag 57780, Signer-Name: (root)
|
|
|
|
|
| • Status: Good - Algorithmus 8 and DNSKEY with KeyTag 57780 used to validate the DS RRSet in the parent zone
|
|
|
|
|
| 4 DNSKEY RR found
|
|
|
|
|
| Public Key with Algorithm 13, KeyTag 19214, Flags 256
|
|
|
|
|
| Public Key with Algorithm 13, KeyTag 44058, Flags 256
|
|
|
|
|
| Public Key with Algorithm 13, KeyTag 45588, Flags 257 (SEP = Secure Entry Point)
|
|
|
|
|
| Public Key with Algorithm 13, KeyTag 47679, Flags 256
|
|
|
|
|
| 1 RRSIG RR to validate DNSKEY RR found
|
|
|
|
|
| RRSIG-Owner be., Algorithm: 13, 1 Labels, original TTL: 86400 sec, Signature-expiration: 04.10.2026, 00:28:38 +, Signature-Inception: 18.06.2026, 07:23:32 +, KeyTag 45588, Signer-Name: be
|
|
|
|
|
| • Status: Good - Algorithmus 13 and DNSKEY with KeyTag 45588 used to validate the DNSKEY RRSet
|
|
|
|
|
| • Status: Valid Chain of trust. Parent-DS with Algorithm 13, KeyTag 45588, DigestType 2 and Digest "aHV1w/D6RXC+OsI69A/6/F4oqN5p3oVaLbH7m00ncxk=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone
|
|
|
Zone: belnet.be
|
|
belnet.be
| 1 DS RR in the parent zone found
|
|
|
|
|
| DS with Algorithm 8, KeyTag 1417, DigestType 2 and Digest vQ7KKXarvn+PDLRAbvI8iUaiuXaOzxCdwwh0MIgFhSA=
|
|
|
|
|
| 2 RRSIG RR to validate DS RR found
|
|
|
|
|
| RRSIG-Owner belnet.be., Algorithm: 13, 2 Labels, original TTL: 86400 sec, Signature-expiration: 16.09.2026, 05:45:30 +, Signature-Inception: 26.08.2026, 22:34:27 +, KeyTag 47679, Signer-Name: be
|
|
|
|
|
| • Status: Good - Algorithmus 13 and DNSKEY with KeyTag 47679 used to validate the DS RRSet in the parent zone
|
|
|
|
|
| 2 DNSKEY RR found
|
|
|
|
|
| Public Key with Algorithm 8, KeyTag 1417, Flags 257 (SEP = Secure Entry Point)
|
|
|
|
|
| Public Key with Algorithm 8, KeyTag 6088, Flags 256
|
|
|
|
|
| 1 RRSIG RR to validate DNSKEY RR found
|
|
|
|
|
| RRSIG-Owner belnet.be., Algorithm: 8, 2 Labels, original TTL: 3600 sec, Signature-expiration: 16.09.2026, 23:12:03 +, Signature-Inception: 26.08.2026, 19:50:07 +, KeyTag 1417, Signer-Name: belnet.be
|
|
|
|
|
| • Status: Good - Algorithmus 8 and DNSKEY with KeyTag 1417 used to validate the DNSKEY RRSet
|
|
|
|
|
| • Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 1417, DigestType 2 and Digest "vQ7KKXarvn+PDLRAbvI8iUaiuXaOzxCdwwh0MIgFhSA=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone
|
|
|
Zone: ftp-brudie.belnet.be
|
|
ftp-brudie.belnet.be
| 0 DS RR in the parent zone found
|
|
|
|
|
| DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "brfaaocdrvtsii27jbjgi89g4qckbv1g" between the hashed NSEC3-owner "brfaaocdrvtsii27jbjgi89g4qckbv1g" and the hashed NextOwner "brq6saqmrjp63q8hb4mv4vcml1i98781". So the parent zone confirmes the not-existence of a DS RR.
Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner brfaaocdrvtsii27jbjgi89g4qckbv1g.belnet.be., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 11.09.2026, 11:17:23 +, Signature-Inception: 21.08.2026, 14:16:37 +, KeyTag 6088, Signer-Name: belnet.be
|
|
|
|
|
| 0 DNSKEY RR found
|
|
|
|
|
|
|
|
|
|
|
| RRSIG Type 1 validates the A - Result: 193.190.198.27
Validated: RRSIG-Owner ftp-brudie.belnet.be., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 12.09.2026, 02:19:54 +, Signature-Inception: 22.08.2026, 01:17:34 +, KeyTag 6088, Signer-Name: belnet.be
|
|
|
|
|
| RRSIG Type 28 validates the AAAA - Result: 2001:06A8:3C80:0000:0000:0000:0000:0027
Validated: RRSIG-Owner ftp-brudie.belnet.be., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 18.09.2026, 08:04:54 +, Signature-Inception: 28.08.2026, 05:52:03 +, KeyTag 6088, Signer-Name: belnet.be
|
|
|
|
|
| CNAME-Query sends a valid NSEC3 RR as result with the hashed query name "brfaaocdrvtsii27jbjgi89g4qckbv1g" equal the hashed NSEC3-owner "brfaaocdrvtsii27jbjgi89g4qckbv1g" and the hashed NextOwner "brq6saqmrjp63q8hb4mv4vcml1i98781". So the zone confirmes the not-existence of that CNAME RR, but the existence of that query name (minimal one RR with that name exists).
Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner brfaaocdrvtsii27jbjgi89g4qckbv1g.belnet.be., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 11.09.2026, 11:17:23 +, Signature-Inception: 21.08.2026, 14:16:37 +, KeyTag 6088, Signer-Name: belnet.be
|
|
|
|
|
| Status: Good. NoData-Proof required and found.
|
|
|
|
|
| TXT-Query sends a valid NSEC3 RR as result with the hashed query name "brfaaocdrvtsii27jbjgi89g4qckbv1g" equal the hashed NSEC3-owner "brfaaocdrvtsii27jbjgi89g4qckbv1g" and the hashed NextOwner "brq6saqmrjp63q8hb4mv4vcml1i98781". So the zone confirmes the not-existence of that TXT RR, but the existence of that query name (minimal one RR with that name exists).
Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner brfaaocdrvtsii27jbjgi89g4qckbv1g.belnet.be., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 11.09.2026, 11:17:23 +, Signature-Inception: 21.08.2026, 14:16:37 +, KeyTag 6088, Signer-Name: belnet.be
|
|
|
|
|
| Status: Good. NoData-Proof required and found.
|
|
|
|
|
| TLSA-Query (_443._tcp.ftp-brudie.belnet.be) sends a valid NSEC3 RR as result with the hashed owner name "brfaaocdrvtsii27jbjgi89g4qckbv1g" (unhashed: ftp-brudie.belnet.be). So that's the Closest Encloser of the query name.
Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner brfaaocdrvtsii27jbjgi89g4qckbv1g.belnet.be., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 11.09.2026, 11:17:23 +, Signature-Inception: 21.08.2026, 14:16:37 +, KeyTag 6088, Signer-Name: belnet.be
|
|
|
|
|
| Status: Good. NXDomain-Proof required and found.
|
|
|
|
|
| TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Next Closer Name "d4slnoju0fj1m6cnp0dvhep15as32kv3" (unhashed: _tcp.ftp-brudie.belnet.be) with the owner "d1ck0epiilk37ef92r0v8pva230td6ld" and the NextOwner "d5fv3kak7dgj3cp0h1c66uuedqc2fmt4". So that NSEC3 confirms the not-existence of the Next Closer Name.
Bitmap: A, RRSIG Validated: RRSIG-Owner d1ck0epiilk37ef92r0v8pva230td6ld.belnet.be., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 11.09.2026, 19:24:17 +, Signature-Inception: 21.08.2026, 14:16:37 +, KeyTag 6088, Signer-Name: belnet.be
|
|
|
|
|
| Status: Good. NXDomain-Proof required and found.
|
|
|
|
|
| TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Wildcard expansion of the ClosestEncloser "91qkds4c14nd3vhdcbi6q06lo2b99ld3" (unhashed: *.ftp-brudie.belnet.be) with the owner "8t2lcdf4eq3ac2l1d4vt7hm31ojfc2tm" and the NextOwner "928elf63a2b0sfqk2pki5h9oor3bnu6r". So that NSEC3 confirms the not-existence of the Wildcard expansion.
Bitmap: A, RRSIG Validated: RRSIG-Owner 8t2lcdf4eq3ac2l1d4vt7hm31ojfc2tm.belnet.be., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 11.09.2026, 17:26:56 +, Signature-Inception: 21.08.2026, 14:16:37 +, KeyTag 6088, Signer-Name: belnet.be
|
|
|
|
|
| Status: Good. NXDomain-Proof required and found.
|
|
|
|
|
| CAA-Query sends a valid NSEC3 RR as result with the hashed query name "brfaaocdrvtsii27jbjgi89g4qckbv1g" equal the hashed NSEC3-owner "brfaaocdrvtsii27jbjgi89g4qckbv1g" and the hashed NextOwner "brq6saqmrjp63q8hb4mv4vcml1i98781". So the zone confirmes the not-existence of that CAA RR, but the existence of that query name (minimal one RR with that name exists).
Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner brfaaocdrvtsii27jbjgi89g4qckbv1g.belnet.be., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 11.09.2026, 11:17:23 +, Signature-Inception: 21.08.2026, 14:16:37 +, KeyTag 6088, Signer-Name: belnet.be
|
|
|
|
|
| Status: Good. NoData-Proof required and found.
|