Zone (*) DNSSEC - Informations Zone : (root)(root) 1 DS RR published DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest 4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=
• Status: Valid because published2 DNSKEY RR found Public Key with Algorithm 8, KeyTag 20326, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 26838, Flags 256
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner (root), Algorithm: 8, 0 Labels, original TTL: 172800 sec, Signature-expiration: 31.08.2021, 00:00:00 +, Signature-Inception: 10.08.2021, 00:00:00 +, KeyTag 20326, Signer-Name: (root)
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20326 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest "4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : dede 1 DS RR in the parent zone found DS with Algorithm 8, KeyTag 26755, DigestType 2 and Digest 80E1eAmllUMRzLgq3hFMbB1ySnXAOVE3qjl4A1Ql540=
1 RRSIG RR to validate DS RR found RRSIG-Owner de., Algorithm: 8, 1 Labels, original TTL: 86400 sec, Signature-expiration: 26.08.2021, 20:00:00 +, Signature-Inception: 13.08.2021, 19:00:00 +, KeyTag 26838, Signer-Name: (root)
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 26838 used to validate the DS RRSet in the parent zone3 DNSKEY RR found Public Key with Algorithm 8, KeyTag 1083, Flags 256
Public Key with Algorithm 8, KeyTag 26755, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 56844, Flags 256
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner de., Algorithm: 8, 1 Labels, original TTL: 300 sec, Signature-expiration: 24.08.2021, 17:00:40 +, Signature-Inception: 10.08.2021, 15:30:40 +, KeyTag 26755, Signer-Name: de
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 26755 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 26755, DigestType 2 and Digest "80E1eAmllUMRzLgq3hFMbB1ySnXAOVE3qjl4A1Ql540=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : server-daten.deserver-daten.de 1 DS RR in the parent zone found DS with Algorithm 8, KeyTag 20737, DigestType 2 and Digest atjk9MBB7MV0rR6m/vjNsoAib1yqTP4vnN1Whf4ZtEE=
1 RRSIG RR to validate DS RR found RRSIG-Owner server-daten.de., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 26.08.2021, 03:36:03 +, Signature-Inception: 12.08.2021, 02:06:03 +, KeyTag 56844, Signer-Name: de
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 56844 used to validate the DS RRSet in the parent zone2 DNSKEY RR found Public Key with Algorithm 8, KeyTag 20737, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 39483, Flags 256
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner server-daten.de., Algorithm: 8, 2 Labels, original TTL: 3600 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 20737, Signer-Name: server-daten.de
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20737 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 20737, DigestType 2 and Digest "atjk9MBB7MV0rR6m/vjNsoAib1yqTP4vnN1Whf4ZtEE=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneRRSIG Type 1 validates the A - Result: 85.215.2.226 Validated: RRSIG-Owner server-daten.de., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
RRSIG Type 16 validates the TXT - Result: v=spf1 a mx ?all
This is a small txt test entry Validated: RRSIG-Owner server-daten.de., Algorithm: 8, 2 Labels, original TTL: 3600 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
RRSIG Type 28 validates the AAAA - Result: 2A01:0238:301B:0000:0000:0000:0000:1226 Validated: RRSIG-Owner server-daten.de., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
RRSIG Type 257 validates the CAA - Result: 5|iodefmailto:info@sql-und-xml.de
5|issueletsencrypt.org; accounturi=https://acme-staging-v02.api.letsencrypt.org/acme/acct/5532373
5|issueletsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/35657966 Validated: RRSIG-Owner server-daten.de., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
CNAME-Query sends a valid NSEC3 RR as result with the hashed query name "ktm4bjk7n632qei038n1pbarck8vid7p" equal the hashed NSEC3-owner "ktm4bjk7n632qei038n1pbarck8vid7p" and the hashed NextOwner "l322s7ojkd227t5h0qjbfkun29h4ua65". So the zone confirmes the not-existence of that CNAME RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, NS, SOA, MX, TXT, AAAA, RRSIG, DNSKEY, NSEC3PARAM, CDS, CDNSKEY, CAA Validated: RRSIG-Owner ktm4bjk7n632qei038n1pbarck8vid7p.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NoData-Proof required and found. TLSA-Query (_443._tcp.server-daten.de) sends a valid NSEC3 RR as result with the hashed owner name "ktm4bjk7n632qei038n1pbarck8vid7p" (unhashed: server-daten.de). So that's the Closest Encloser of the query name. Bitmap: A, NS, SOA, MX, TXT, AAAA, RRSIG, DNSKEY, NSEC3PARAM, CDS, CDNSKEY, CAA Validated: RRSIG-Owner ktm4bjk7n632qei038n1pbarck8vid7p.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NXDomain-Proof required and found. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Next Closer Name "imd2a9lh0i79vj8dsbitel3q98ufhgum" (unhashed: _tcp.server-daten.de) with the owner "ial5l4mknvr56630ocsv07v20dppq7mg" and the NextOwner "juf2lc2harvkr5rkhcj3aded1euuj5nd". So that NSEC3 confirms the not-existence of the Next Closer Name. Bitmap: A, RRSIG Validated: RRSIG-Owner ial5l4mknvr56630ocsv07v20dppq7mg.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NXDomain-Proof required and found. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Wildcard expansion of the ClosestEncloser "q3mjoo5cngmmlbli5f4t04frtjci6d5c" (unhashed: *.server-daten.de) with the owner "pnik51j6lu1poret6ta39opaq22jko5c" and the NextOwner "q5ndfqi3ablq2203mk0b7gj39skc61bj". So that NSEC3 confirms the not-existence of the Wildcard expansion. Bitmap: CNAME, RRSIG Validated: RRSIG-Owner pnik51j6lu1poret6ta39opaq22jko5c.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NXDomain-Proof required and found. Zone : www.server-daten.dewww.server-daten.de 0 DS RR in the parent zone found DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "lfooko88r4f0grdpic6hco5pino2iua4" between the hashed NSEC3-owner "lfooko88r4f0grdpic6hco5pino2iua4" and the hashed NextOwner "lgs91jcvibca3f0kv4spv4kalvjhb6cl". So the parent zone confirmes the not-existence of a DS RR.Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner lfooko88r4f0grdpic6hco5pino2iua4.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
RRSIG Type 1 validates the A - Result: 85.215.2.226 Validated: RRSIG-Owner www.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 86400 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
RRSIG Type 28 validates the AAAA - Result: 2A01:0238:301B:0000:0000:0000:0000:1226 Validated: RRSIG-Owner www.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 86400 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
CNAME-Query sends a valid NSEC3 RR as result with the hashed query name "lfooko88r4f0grdpic6hco5pino2iua4" equal the hashed NSEC3-owner "lfooko88r4f0grdpic6hco5pino2iua4" and the hashed NextOwner "lgs91jcvibca3f0kv4spv4kalvjhb6cl". So the zone confirmes the not-existence of that CNAME RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner lfooko88r4f0grdpic6hco5pino2iua4.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NoData-Proof required and found. TXT-Query sends a valid NSEC3 RR as result with the hashed query name "lfooko88r4f0grdpic6hco5pino2iua4" equal the hashed NSEC3-owner "lfooko88r4f0grdpic6hco5pino2iua4" and the hashed NextOwner "lgs91jcvibca3f0kv4spv4kalvjhb6cl". So the zone confirmes the not-existence of that TXT RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner lfooko88r4f0grdpic6hco5pino2iua4.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NoData-Proof required and found. TLSA-Query (_443._tcp.www.server-daten.de) sends a valid NSEC3 RR as result with the hashed owner name "lfooko88r4f0grdpic6hco5pino2iua4" (unhashed: www.server-daten.de). So that's the Closest Encloser of the query name. Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner lfooko88r4f0grdpic6hco5pino2iua4.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NXDomain-Proof required and found. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Next Closer Name "6b4dno0m07hg9bk4r8se5jertff6ua0s" (unhashed: _tcp.www.server-daten.de) with the owner "5unldc3lblj9c3kh9o7bsgocj5gpkhmt" and the NextOwner "6pqnpltan0366rjkhvs61nnq5tese0kb". So that NSEC3 confirms the not-existence of the Next Closer Name. Bitmap: CNAME, RRSIG Validated: RRSIG-Owner 5unldc3lblj9c3kh9o7bsgocj5gpkhmt.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NXDomain-Proof required and found. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Wildcard expansion of the ClosestEncloser "re3n020mlpqihvisf4h372pc83evlfm3" (unhashed: *.www.server-daten.de) with the owner "q5ndfqi3ablq2203mk0b7gj39skc61bj" and the NextOwner "ri4r1tmutuvlqitq97h0maec5ud3u5q6". So that NSEC3 confirms the not-existence of the Wildcard expansion. Bitmap: CNAME, RRSIG Validated: RRSIG-Owner q5ndfqi3ablq2203mk0b7gj39skc61bj.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NXDomain-Proof required and found. CAA-Query sends a valid NSEC3 RR as result with the hashed query name "lfooko88r4f0grdpic6hco5pino2iua4" equal the hashed NSEC3-owner "lfooko88r4f0grdpic6hco5pino2iua4" and the hashed NextOwner "lgs91jcvibca3f0kv4spv4kalvjhb6cl". So the zone confirmes the not-existence of that CAA RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner lfooko88r4f0grdpic6hco5pino2iua4.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 26.08.2021, 00:00:00 +, Signature-Inception: 05.08.2021, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NoData-Proof required and found.