Zone (*) DNSSEC - Informations Zone : (root)(root) 1 DS RR published DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest 4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=
• Status: Valid because published2 DNSKEY RR found Public Key with Algorithm 8, KeyTag 14748, Flags 256
Public Key with Algorithm 8, KeyTag 20326, Flags 257 (SEP = Secure Entry Point)
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner (root), Algorithm: 8, 0 Labels, original TTL: 172800 sec, Signature-expiration: 01.12.2021, 00:00:00 +, Signature-Inception: 10.11.2021, 00:00:00 +, KeyTag 20326, Signer-Name: (root)
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20326 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest "4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : orgorg 1 DS RR in the parent zone found DS with Algorithm 8, KeyTag 26974, DigestType 2 and Digest T+3ilMU/Q4oVjEHTlInNeKhr6w2KCur/FHRcDRbh3jI=
2 RRSIG RR to validate DS RR found RRSIG-Owner org., Algorithm: 8, 1 Labels, original TTL: 86400 sec, Signature-expiration: 27.11.2021, 17:00:00 +, Signature-Inception: 14.11.2021, 16:00:00 +, KeyTag 14748, Signer-Name: (root)
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 14748 used to validate the DS RRSet in the parent zone3 DNSKEY RR found Public Key with Algorithm 8, KeyTag 26974, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 63858, Flags 256
Public Key with Algorithm 8, KeyTag 63966, Flags 256
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner org., Algorithm: 8, 1 Labels, original TTL: 900 sec, Signature-expiration: 05.12.2021, 10:20:16 +, Signature-Inception: 14.11.2021, 09:20:16 +, KeyTag 26974, Signer-Name: org
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 26974 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 26974, DigestType 2 and Digest "T+3ilMU/Q4oVjEHTlInNeKhr6w2KCur/FHRcDRbh3jI=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : iana.orgiana.org 6 DS RR in the parent zone found DS with Algorithm 8, KeyTag 6730, DigestType 1 and Digest FaHucJ5RwGUnmdnNNko3rLjmcoU=
DS with Algorithm 8, KeyTag 6730, DigestType 2 and Digest /KA3dvozq1c2mq6LCJk49AAeIICUNic0JCp+vk3bV1U=
DS with Algorithm 8, KeyTag 14351, DigestType 1 and Digest TAjAV1Tdp8z2K0GsRQhz0nEiHMM=
DS with Algorithm 8, KeyTag 14351, DigestType 2 and Digest 4aDJLAZjICJA/DSB90fQCQHNFOJouIShFC16R12xqBA=
DS with Algorithm 8, KeyTag 39817, DigestType 1 and Digest SyY09p7djQdB2oYp4gZLBegTjlE=
DS with Algorithm 8, KeyTag 39817, DigestType 2 and Digest X7cq6Ew1o13ff6JOp5HNl2PENgl5wMu2/yxAevmuWAI=
1 RRSIG RR to validate DS RR found RRSIG-Owner iana.org., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 05.12.2021, 10:20:16 +, Signature-Inception: 14.11.2021, 09:20:16 +, KeyTag 63966, Signer-Name: org
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 63966 used to validate the DS RRSet in the parent zone3 DNSKEY RR found Public Key with Algorithm 8, KeyTag 3795, Flags 256
Public Key with Algorithm 8, KeyTag 21911, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 39817, Flags 257 (SEP = Secure Entry Point)
2 RRSIG RR to validate DNSKEY RR found RRSIG-Owner iana.org., Algorithm: 8, 2 Labels, original TTL: 3600 sec, Signature-expiration: 30.11.2021, 04:44:07 +, Signature-Inception: 08.11.2021, 19:48:24 +, KeyTag 21911, Signer-Name: iana.org
RRSIG-Owner iana.org., Algorithm: 8, 2 Labels, original TTL: 3600 sec, Signature-expiration: 30.11.2021, 04:44:07 +, Signature-Inception: 08.11.2021, 19:48:24 +, KeyTag 39817, Signer-Name: iana.org
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 21911 used to validate the DNSKEY RRSet• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 39817 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 39817, DigestType 1 and Digest "SyY09p7djQdB2oYp4gZLBegTjlE=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 39817, DigestType 2 and Digest "X7cq6Ew1o13ff6JOp5HNl2PENgl5wMu2/yxAevmuWAI=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneRRSIG Type 1 validates the A - Result: 192.0.43.8 Validated: RRSIG-Owner iana.org., Algorithm: 8, 2 Labels, original TTL: 3600 sec, Signature-expiration: 29.11.2021, 19:57:51 +, Signature-Inception: 08.11.2021, 19:48:24 +, KeyTag 3795, Signer-Name: iana.org
RRSIG Type 16 validates the TXT - Result: MS=ms22660639
v=spf1 redirect=icann.org
c9e864a6c53444038d34fe3a22513b74
docusign=b2d7c7b0-4627-494b-a7aa-682ee87c265d
smartsheet-site-validation=CcnvONgQ2ibuzf2zHZxgPaWUqTwt-Sjr
google-site-verification=iIqTTcUxND4wZOeVe5Ho728rH3JOSDnssYsYJ7pUtQQ Validated: RRSIG-Owner iana.org., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 30.11.2021, 03:05:37 +, Signature-Inception: 08.11.2021, 19:48:24 +, KeyTag 3795, Signer-Name: iana.org
RRSIG Type 28 validates the AAAA - Result: 2001:0500:0088:0200:0000:0000:0000:0008 Validated: RRSIG-Owner iana.org., Algorithm: 8, 2 Labels, original TTL: 3600 sec, Signature-expiration: 29.11.2021, 22:25:42 +, Signature-Inception: 08.11.2021, 19:48:24 +, KeyTag 3795, Signer-Name: iana.org
CNAME-Query sends a valid NSEC RR as result with the query name "iana.org" equal the NSEC-owner "iana.org" and the NextOwner "api.iana.org". So the zone confirmes the not-existence of that CNAME RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, NS, SOA, MX, TXT, AAAA, RRSIG, NSEC, DNSKEY Validated: RRSIG-Owner iana.org., Algorithm: 8, 2 Labels, original TTL: 3600 sec, Signature-expiration: 29.11.2021, 23:31:44 +, Signature-Inception: 08.11.2021, 19:48:24 +, KeyTag 3795, Signer-Name: iana.org
Status: Good. NoData-Proof required and found. TLSA-Query (_443._tcp.iana.org) sends a valid NSEC RR as result with the owner name iana.org. So that's the Closest Encloser of the query name. TLSA-Query sends a valid NSEC RR as result and covers the Wildcard expansion of the ClosestEncloser with the owner "iana.org" and the NextOwner "api.iana.org". So that NSEC confirms the not-existence of the Wildcard expansion. TLSA-Query (_443._tcp.iana.org) sends a valid NSEC RR as result with the query name "_443._tcp.iana.org" between the NSEC-owner "iana.org" and the NextOwner "api.iana.org". So the zone confirmes the not-existence of that TLSA RR.TLSA-Query (_443._tcp.iana.org) sends a valid NSEC RR as result with the parent Wildcard "*._tcp.iana.org" between the NSEC-owner "iana.org" and the NextOwner "api.iana.org". So the zone confirmes the not-existence of that Wildcard-expansion.Bitmap: A, NS, SOA, MX, TXT, AAAA, RRSIG, NSEC, DNSKEY Validated: RRSIG-Owner iana.org., Algorithm: 8, 2 Labels, original TTL: 3600 sec, Signature-expiration: 29.11.2021, 23:31:44 +, Signature-Inception: 08.11.2021, 19:48:24 +, KeyTag 3795, Signer-Name: iana.org
Status: Good. NXDomain-Proof required and found. CAA-Query sends a valid NSEC RR as result with the query name "iana.org" equal the NSEC-owner "iana.org" and the NextOwner "api.iana.org". So the zone confirmes the not-existence of that CAA RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, NS, SOA, MX, TXT, AAAA, RRSIG, NSEC, DNSKEY Validated: RRSIG-Owner iana.org., Algorithm: 8, 2 Labels, original TTL: 3600 sec, Signature-expiration: 29.11.2021, 23:31:44 +, Signature-Inception: 08.11.2021, 19:48:24 +, KeyTag 3795, Signer-Name: iana.org
Status: Good. NoData-Proof required and found. Zone : www.iana.orgwww.iana.org 0 DS RR in the parent zone found RRSIG Type 5 validates the CNAME - Result: ianawww.vip.icann.org Validated: RRSIG-Owner www.iana.org., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 30.11.2021, 01:18:46 +, Signature-Inception: 08.11.2021, 19:48:24 +, KeyTag 3795, Signer-Name: iana.org
Zone : (root)(root) 1 DS RR published DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest 4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=
• Status: Valid because published2 DNSKEY RR found Public Key with Algorithm 8, KeyTag 14748, Flags 256
Public Key with Algorithm 8, KeyTag 20326, Flags 257 (SEP = Secure Entry Point)
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner (root), Algorithm: 8, 0 Labels, original TTL: 172800 sec, Signature-expiration: 01.12.2021, 00:00:00 +, Signature-Inception: 10.11.2021, 00:00:00 +, KeyTag 20326, Signer-Name: (root)
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20326 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest "4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : orgorg 1 DS RR in the parent zone found DS with Algorithm 8, KeyTag 26974, DigestType 2 and Digest T+3ilMU/Q4oVjEHTlInNeKhr6w2KCur/FHRcDRbh3jI=
2 RRSIG RR to validate DS RR found RRSIG-Owner org., Algorithm: 8, 1 Labels, original TTL: 86400 sec, Signature-expiration: 27.11.2021, 17:00:00 +, Signature-Inception: 14.11.2021, 16:00:00 +, KeyTag 14748, Signer-Name: (root)
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 14748 used to validate the DS RRSet in the parent zone3 DNSKEY RR found Public Key with Algorithm 8, KeyTag 26974, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 63858, Flags 256
Public Key with Algorithm 8, KeyTag 63966, Flags 256
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner org., Algorithm: 8, 1 Labels, original TTL: 900 sec, Signature-expiration: 05.12.2021, 10:20:16 +, Signature-Inception: 14.11.2021, 09:20:16 +, KeyTag 26974, Signer-Name: org
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 26974 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 26974, DigestType 2 and Digest "T+3ilMU/Q4oVjEHTlInNeKhr6w2KCur/FHRcDRbh3jI=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : icann.orgicann.org 3 DS RR in the parent zone found DS with Algorithm 7, KeyTag 17248, DigestType 2 and Digest iFz4ps81/Vxhnh1ItZr7IwY7up/sUv8l+ZCUy6EJEKI=
DS with Algorithm 7, KeyTag 18060, DigestType 2 and Digest a+AhgYufEO2YGgOsv3TwHjH7FcWGgK0MS6pGS/N6dSM=
DS with Algorithm 7, KeyTag 23584, DigestType 2 and Digest r1ekkmQBAoCSCaoAW5PDK3rMg3NLx4XPpQtRaIKZzWE=
1 RRSIG RR to validate DS RR found RRSIG-Owner icann.org., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 05.12.2021, 10:20:16 +, Signature-Inception: 14.11.2021, 09:20:16 +, KeyTag 63966, Signer-Name: org
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 63966 used to validate the DS RRSet in the parent zone5 DNSKEY RR found Public Key with Algorithm 7, KeyTag 18060, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 7, KeyTag 21275, Flags 256
Public Key with Algorithm 7, KeyTag 23584, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 7, KeyTag 48458, Flags 256
Public Key with Algorithm 7, KeyTag 49175, Flags 256
2 RRSIG RR to validate DNSKEY RR found RRSIG-Owner icann.org., Algorithm: 7, 2 Labels, original TTL: 3600 sec, Signature-expiration: 29.11.2021, 20:14:06 +, Signature-Inception: 08.11.2021, 19:48:24 +, KeyTag 18060, Signer-Name: icann.org
RRSIG-Owner icann.org., Algorithm: 7, 2 Labels, original TTL: 3600 sec, Signature-expiration: 29.11.2021, 20:14:06 +, Signature-Inception: 08.11.2021, 19:48:24 +, KeyTag 23584, Signer-Name: icann.org
• Status: Good - Algorithmus 7 and DNSKEY with KeyTag 18060 used to validate the DNSKEY RRSet• Status: Good - Algorithmus 7 and DNSKEY with KeyTag 23584 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 7, KeyTag 18060, DigestType 2 and Digest "a+AhgYufEO2YGgOsv3TwHjH7FcWGgK0MS6pGS/N6dSM=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone• Status: Valid Chain of trust. Parent-DS with Algorithm 7, KeyTag 23584, DigestType 2 and Digest "r1ekkmQBAoCSCaoAW5PDK3rMg3NLx4XPpQtRaIKZzWE=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : vip.icann.orgvip.icann.org 1 DS RR in the parent zone found DS with Algorithm 8, KeyTag 6025, DigestType 2 and Digest Tar9xiUozvyMj1K1DXDYIhFb2cD2ZiplBWA+8YQB/kk=
1 RRSIG RR to validate DS RR found RRSIG-Owner vip.icann.org., Algorithm: 7, 3 Labels, original TTL: 3600 sec, Signature-expiration: 29.11.2021, 14:45:36 +, Signature-Inception: 08.11.2021, 19:48:24 +, KeyTag 49175, Signer-Name: icann.org
• Status: Good - Algorithmus 7 and DNSKEY with KeyTag 49175 used to validate the DS RRSet in the parent zone3 DNSKEY RR found Public Key with Algorithm 8, KeyTag 6025, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 20940, Flags 256
Public Key with Algorithm 8, KeyTag 45318, Flags 256
3 RRSIG RR to validate DNSKEY RR found RRSIG-Owner vip.icann.org., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 18.11.2021, 00:11:31 +, Signature-Inception: 10.11.2021, 23:11:31 +, KeyTag 6025, Signer-Name: vip.icann.org
RRSIG-Owner vip.icann.org., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 18.11.2021, 00:11:31 +, Signature-Inception: 10.11.2021, 23:11:31 +, KeyTag 20940, Signer-Name: vip.icann.org
RRSIG-Owner vip.icann.org., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 18.11.2021, 00:11:31 +, Signature-Inception: 10.11.2021, 23:11:31 +, KeyTag 45318, Signer-Name: vip.icann.org
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 6025 used to validate the DNSKEY RRSet• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20940 used to validate the DNSKEY RRSet• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 45318 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 6025, DigestType 2 and Digest "Tar9xiUozvyMj1K1DXDYIhFb2cD2ZiplBWA+8YQB/kk=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : ianawww.vip.icann.orgianawww.vip.icann.org 0 DS RR in the parent zone found DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "1b27o4h5mfjsssjjcsc50ivbok7cd0d7" between the hashed NSEC3-owner "1b27o4h5mfjsssjjcsc50ivbok7cd0d7" and the hashed NextOwner "1b27o4h5mfjsssjjcsc50ivbok7cd0d8". So the parent zone confirmes the not-existence of a DS RR.Bitmap: NS, RRSIG Validated: RRSIG-Owner 1b27o4h5mfjsssjjcsc50ivbok7cd0d7.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 60 sec, Signature-expiration: 21.11.2021, 23:10:42 +, Signature-Inception: 14.11.2021, 22:10:42 +, KeyTag 20940, Signer-Name: vip.icann.org
DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "1b27o4h5mfjsssjjcsc50ivbok7cd0d7" between the hashed NSEC3-owner "1b27o4h5mfjsssjjcsc50ivbok7cd0d7" and the hashed NextOwner "1b27o4h5mfjsssjjcsc50ivbok7cd0d8". So the parent zone confirmes the not-existence of a DS RR.Bitmap: NS, RRSIG Validated: RRSIG-Owner 1b27o4h5mfjsssjjcsc50ivbok7cd0d7.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 60 sec, Signature-expiration: 21.11.2021, 23:10:42 +, Signature-Inception: 14.11.2021, 22:10:42 +, KeyTag 45318, Signer-Name: vip.icann.org
0 DNSKEY RR found RRSIG Type 1 validates the A - Result: 192.0.46.8 Validated: RRSIG-Owner ianawww.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 30 sec, Signature-expiration: 18.11.2021, 00:11:31 +, Signature-Inception: 10.11.2021, 23:11:31 +, KeyTag 20940, Signer-Name: vip.icann.org
RRSIG Type 1 validates the A - Result: 192.0.46.8 Validated: RRSIG-Owner ianawww.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 30 sec, Signature-expiration: 18.11.2021, 00:11:31 +, Signature-Inception: 10.11.2021, 23:11:31 +, KeyTag 20940, Signer-Name: vip.icann.org
RRSIG Type 28 validates the AAAA - Result: 2620:0000:2830:0200:0000:0000:000B:0008 Validated: RRSIG-Owner ianawww.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 30 sec, Signature-expiration: 18.11.2021, 00:11:31 +, Signature-Inception: 10.11.2021, 23:11:31 +, KeyTag 20940, Signer-Name: vip.icann.org
RRSIG Type 28 validates the AAAA - Result: 2620:0000:2830:0200:0000:0000:000B:0008 Validated: RRSIG-Owner ianawww.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 30 sec, Signature-expiration: 18.11.2021, 00:11:31 +, Signature-Inception: 10.11.2021, 23:11:31 +, KeyTag 20940, Signer-Name: vip.icann.org
RRSIG Type 1 validates the A - Result: 192.0.46.8 Validated: RRSIG-Owner ianawww.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 30 sec, Signature-expiration: 21.11.2021, 16:22:39 +, Signature-Inception: 14.11.2021, 15:22:39 +, KeyTag 45318, Signer-Name: vip.icann.org
RRSIG Type 1 validates the A - Result: 192.0.46.8 Validated: RRSIG-Owner ianawww.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 30 sec, Signature-expiration: 21.11.2021, 16:22:39 +, Signature-Inception: 14.11.2021, 15:22:39 +, KeyTag 45318, Signer-Name: vip.icann.org
RRSIG Type 28 validates the AAAA - Result: 2620:0000:2830:0200:0000:0000:000B:0008 Validated: RRSIG-Owner ianawww.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 30 sec, Signature-expiration: 21.11.2021, 16:22:41 +, Signature-Inception: 14.11.2021, 15:22:41 +, KeyTag 45318, Signer-Name: vip.icann.org
RRSIG Type 28 validates the AAAA - Result: 2620:0000:2830:0200:0000:0000:000B:0008 Validated: RRSIG-Owner ianawww.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 30 sec, Signature-expiration: 21.11.2021, 16:22:41 +, Signature-Inception: 14.11.2021, 15:22:41 +, KeyTag 45318, Signer-Name: vip.icann.org
CNAME-Query sends a valid NSEC3 RR as result with the hashed query name "vjulchnveikf61flqkirgh8q57vpj470" equal the hashed NSEC3-owner "vjulchnveikf61flqkirgh8q57vpj470" and the hashed NextOwner "vjulchnveikf61flqkirgh8q57vpj471". So the zone confirmes the not-existence of that CNAME RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: MX, TXT, RRSIG Validated: RRSIG-Owner vjulchnveikf61flqkirgh8q57vpj470.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 60 sec, Signature-expiration: 21.11.2021, 17:42:38 +, Signature-Inception: 14.11.2021, 16:42:38 +, KeyTag 45318, Signer-Name: vip.icann.org
Status: Good. NoData-Proof required and found. TXT-Query sends a valid NSEC3 RR as result with the hashed query name "vjulchnveikf61flqkirgh8q57vpj470" equal the hashed NSEC3-owner "vjulchnveikf61flqkirgh8q57vpj470" and the hashed NextOwner "vjulchnveikf61flqkirgh8q57vpj471". So the zone confirmes the not-existence of that TXT RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: 13, MX, RRSIG Validated: RRSIG-Owner vjulchnveikf61flqkirgh8q57vpj470.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 60 sec, Signature-expiration: 21.11.2021, 23:51:41 +, Signature-Inception: 14.11.2021, 22:51:41 +, KeyTag 45318, Signer-Name: vip.icann.org
Status: Good. NoData-Proof required and found. TLSA-Query (_443._tcp.ianawww.vip.icann.org) sends a valid NSEC3 RR as result with the hashed owner name "5ggj4qeq9f4icobn8jdgcp3p3jh87opp" (unhashed: _tcp.ianawww.vip.icann.org). So that's the Closest Encloser of the query name. Bitmap: No Bitmap? Validated: RRSIG-Owner 5ggj4qeq9f4icobn8jdgcp3p3jh87opp.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 60 sec, Signature-expiration: 21.11.2021, 23:51:41 +, Signature-Inception: 14.11.2021, 22:51:41 +, KeyTag 45318, Signer-Name: vip.icann.org
Status: Good. NXDomain-Proof required and found. TLSA-Query (_443._tcp.ianawww.vip.icann.org) sends a valid NSEC3 RR as result with the hashed query name "sag93noqgfn17rbefs1n06obj7h4rj01" between the hashed NSEC3-owner "sag93noqgfn17rbefs1n06obj7h4rj00" and the hashed NextOwner "sag93noqgfn17rbefs1n06obj7h4rj02". So the zone confirmes the not-existence of that TLSA RR.Bitmap: No Bitmap? Validated: RRSIG-Owner sag93noqgfn17rbefs1n06obj7h4rj00.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 60 sec, Signature-expiration: 21.11.2021, 23:51:41 +, Signature-Inception: 14.11.2021, 22:51:41 +, KeyTag 45318, Signer-Name: vip.icann.org
Status: Good. NXDomain-Proof required and found. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Wildcard expansion of the ClosestEncloser "1be3jgf2hd2i3jv69kmhgjqt5crp1mrk" (unhashed: *._tcp.ianawww.vip.icann.org) with the owner "1be3jgf2hd2i3jv69kmhgjqt5crp1mrj" and the NextOwner "1be3jgf2hd2i3jv69kmhgjqt5crp1mrl". So that NSEC3 confirms the not-existence of the Wildcard expansion. Bitmap: No Bitmap? Validated: RRSIG-Owner 1be3jgf2hd2i3jv69kmhgjqt5crp1mrj.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 60 sec, Signature-expiration: 21.11.2021, 23:51:41 +, Signature-Inception: 14.11.2021, 22:51:41 +, KeyTag 45318, Signer-Name: vip.icann.org
Status: Good. NXDomain-Proof required and found. CAA-Query sends a valid NSEC3 RR as result with the hashed query name "1b27o4h5mfjsssjjcsc50ivbok7cd0d7" equal the hashed NSEC3-owner "1b27o4h5mfjsssjjcsc50ivbok7cd0d7" and the hashed NextOwner "1b27o4h5mfjsssjjcsc50ivbok7cd0d8". So the zone confirmes the not-existence of that CAA RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: MX, TXT, RRSIG Validated: RRSIG-Owner 1b27o4h5mfjsssjjcsc50ivbok7cd0d7.vip.icann.org., Algorithm: 8, 4 Labels, original TTL: 60 sec, Signature-expiration: 21.11.2021, 23:10:47 +, Signature-Inception: 14.11.2021, 22:10:47 +, KeyTag 45318, Signer-Name: vip.icann.org
Status: Good. NoData-Proof required and found.