Zone (*) DNSSEC - Informations Zone : (root)(root) 1 DS RR published DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest 4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=
• Status: Valid because published2 DNSKEY RR found Public Key with Algorithm 8, KeyTag 11019, Flags 256
Public Key with Algorithm 8, KeyTag 20326, Flags 257 (SEP = Secure Entry Point)
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner (root), Algorithm: 8, 0 Labels, original TTL: 172800 sec, Signature-expiration: 31.08.2023, 00:00:00 +, Signature-Inception: 10.08.2023, 00:00:00 +, KeyTag 20326, Signer-Name: (root)
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20326 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest "4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : mmmm 1 DS RR in the parent zone found DS with Algorithm 8, KeyTag 18589, DigestType 2 and Digest CmZAPaLOtMOWB1BzkHTVynmTNLRcheP+3Xg44BokNdg=
1 RRSIG RR to validate DS RR found RRSIG-Owner mm., Algorithm: 8, 1 Labels, original TTL: 86400 sec, Signature-expiration: 26.08.2023, 05:00:00 +, Signature-Inception: 13.08.2023, 04:00:00 +, KeyTag 11019, Signer-Name: (root)
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 11019 used to validate the DS RRSet in the parent zone2 DNSKEY RR found Public Key with Algorithm 8, KeyTag 18589, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 32298, Flags 256
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner mm., Algorithm: 8, 1 Labels, original TTL: 86400 sec, Signature-expiration: 16.08.2023, 13:28:06 +, Signature-Inception: 09.08.2023, 00:29:02 +, KeyTag 18589, Signer-Name: mm
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 18589 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 18589, DigestType 2 and Digest "CmZAPaLOtMOWB1BzkHTVynmTNLRcheP+3Xg44BokNdg=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : com.mmcom.mm 1 DS RR in the parent zone found DS with Algorithm 8, KeyTag 22462, DigestType 2 and Digest VV5RdRmEhyI5ieA6LrgueLJ8dKty2PU8u+8fT1JILF8=
1 RRSIG RR to validate DS RR found RRSIG-Owner com.mm., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 16.08.2023, 09:14:58 +, Signature-Inception: 09.08.2023, 15:03:02 +, KeyTag 32298, Signer-Name: mm
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 32298 used to validate the DS RRSet in the parent zone2 DNSKEY RR found Public Key with Algorithm 8, KeyTag 22462, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 65160, Flags 256
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner com.mm., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 16.08.2023, 23:01:31 +, Signature-Inception: 09.08.2023, 19:24:01 +, KeyTag 22462, Signer-Name: com.mm
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 22462 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 22462, DigestType 2 and Digest "VV5RdRmEhyI5ieA6LrgueLJ8dKty2PU8u+8fT1JILF8=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : ooredoo.com.mmooredoo.com.mm 0 DS RR in the parent zone found DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "97c74h8in9ri44klel3769t9p3vi8iui" between the hashed NSEC3-owner "97c74h8in9ri44klel3769t9p3vi8iui" and the hashed NextOwner "97oasjbavc8maevoomd0fdm1hh3n4uaq". So the parent zone confirmes the not-existence of a DS RR.Bitmap: No Bitmap? Validated: RRSIG-Owner 97c74h8in9ri44klel3769t9p3vi8iui.com.mm., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 19.08.2023, 01:44:39 +, Signature-Inception: 12.08.2023, 02:51:02 +, KeyTag 65160, Signer-Name: com.mm
1 DNSKEY RR found Public Key with Algorithm 13, KeyTag 19206, Flags 257 (SEP = Secure Entry Point)
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner ooredoo.com.mm., Algorithm: 13, 3 Labels, original TTL: 10800 sec, Signature-expiration: 17.08.2023, 00:00:00 +, Signature-Inception: 27.07.2023, 00:00:00 +, KeyTag 19206, Signer-Name: ooredoo.com.mm
• Status: Good - Algorithmus 13 and DNSKEY with KeyTag 19206 used to validate the DNSKEY RRSetError: DNSKEY 19206 signs DNSKEY RRset, but no confirming DS RR in the parent zone found. No chain of trust created. Zone : ecare.ooredoo.com.mmecare.ooredoo.com.mm 0 DS RR in the parent zone found DS-Query in the parent zone has a valid NSEC RR as result with the domain name between the NSEC-Owner "ecare.ooredoo.com.mm" and the NextOwner "ecareapp.ooredoo.com.mm". So the parent zone confirmes the non-existence of a DS RR.Bitmap: A, RRSIG, NSEC
0 DNSKEY RR found RRSIG Type 1 validates the A - Result: 69.160.11.24 Validated: RRSIG-Owner ecare.ooredoo.com.mm., Algorithm: 13, 4 Labels, original TTL: 3600 sec, Signature-expiration: 17.08.2023, 00:00:00 +, Signature-Inception: 27.07.2023, 00:00:00 +, KeyTag 19206, Signer-Name: ooredoo.com.mm
CNAME-Query sends a valid NSEC RR as result with the query name "ecare.ooredoo.com.mm" equal the NSEC-owner "ecare.ooredoo.com.mm" and the NextOwner "ecareapp.ooredoo.com.mm". So the zone confirmes the not-existence of that CNAME RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, RRSIG, NSEC Validated: RRSIG-Owner ecare.ooredoo.com.mm., Algorithm: 13, 4 Labels, original TTL: 10800 sec, Signature-expiration: 17.08.2023, 00:00:00 +, Signature-Inception: 27.07.2023, 00:00:00 +, KeyTag 19206, Signer-Name: ooredoo.com.mm
Status: Good. NoData-Proof required and found. TXT-Query sends a valid NSEC RR as result with the query name "ecare.ooredoo.com.mm" equal the NSEC-owner "ecare.ooredoo.com.mm" and the NextOwner "ecareapp.ooredoo.com.mm". So the zone confirmes the not-existence of that TXT RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, RRSIG, NSEC Validated: RRSIG-Owner ecare.ooredoo.com.mm., Algorithm: 13, 4 Labels, original TTL: 10800 sec, Signature-expiration: 17.08.2023, 00:00:00 +, Signature-Inception: 27.07.2023, 00:00:00 +, KeyTag 19206, Signer-Name: ooredoo.com.mm
Status: Good. NoData-Proof required and found. AAAA-Query sends a valid NSEC RR as result with the query name "ecare.ooredoo.com.mm" equal the NSEC-owner "ecare.ooredoo.com.mm" and the NextOwner "ecareapp.ooredoo.com.mm". So the zone confirmes the not-existence of that AAAA RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, RRSIG, NSEC Validated: RRSIG-Owner ecare.ooredoo.com.mm., Algorithm: 13, 4 Labels, original TTL: 10800 sec, Signature-expiration: 17.08.2023, 00:00:00 +, Signature-Inception: 27.07.2023, 00:00:00 +, KeyTag 19206, Signer-Name: ooredoo.com.mm
Status: Good. NoData-Proof required and found. TLSA-Query (_443._tcp.ecare.ooredoo.com.mm) sends a valid NSEC RR as result with the owner name ecare.ooredoo.com.mm. So that's the Closest Encloser of the query name. TLSA-Query sends a valid NSEC RR as result and covers the Wildcard expansion of the ClosestEncloser with the owner "ecare.ooredoo.com.mm" and the NextOwner "ecareapp.ooredoo.com.mm". So that NSEC confirms the not-existence of the Wildcard expansion. TLSA-Query (_443._tcp.ecare.ooredoo.com.mm) sends a valid NSEC RR as result with the query name "_443._tcp.ecare.ooredoo.com.mm" between the NSEC-owner "ecare.ooredoo.com.mm" and the NextOwner "ecareapp.ooredoo.com.mm". So the zone confirmes the not-existence of that TLSA RR.TLSA-Query (_443._tcp.ecare.ooredoo.com.mm) sends a valid NSEC RR as result with the parent Wildcard "*._tcp.ecare.ooredoo.com.mm" between the NSEC-owner "ecare.ooredoo.com.mm" and the NextOwner "ecareapp.ooredoo.com.mm". So the zone confirmes the not-existence of that Wildcard-expansion.Bitmap: A, RRSIG, NSEC Validated: RRSIG-Owner ecare.ooredoo.com.mm., Algorithm: 13, 4 Labels, original TTL: 10800 sec, Signature-expiration: 17.08.2023, 00:00:00 +, Signature-Inception: 27.07.2023, 00:00:00 +, KeyTag 19206, Signer-Name: ooredoo.com.mm
Status: Good. NXDomain-Proof required and found. CAA-Query sends a valid NSEC RR as result with the query name "ecare.ooredoo.com.mm" equal the NSEC-owner "ecare.ooredoo.com.mm" and the NextOwner "ecareapp.ooredoo.com.mm". So the zone confirmes the not-existence of that CAA RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, RRSIG, NSEC Validated: RRSIG-Owner ecare.ooredoo.com.mm., Algorithm: 13, 4 Labels, original TTL: 10800 sec, Signature-expiration: 17.08.2023, 00:00:00 +, Signature-Inception: 27.07.2023, 00:00:00 +, KeyTag 19206, Signer-Name: ooredoo.com.mm
Status: Good. NoData-Proof required and found. Zone : www.ecare.ooredoo.com.mmwww.ecare.ooredoo.com.mm 0 DS RR in the parent zone found DS-Query in the parent zone has a valid NSEC RR as result with the domain name between the NSEC-Owner "ecare.ooredoo.com.mm" and the NextOwner "ecareapp.ooredoo.com.mm". So the parent zone confirmes the non-existence of a DS RR.Bitmap: A, RRSIG, NSEC