Zone (*) | DNSSEC - Informations |
---|
|
|
Zone: (root)
|
|
(root)
| 1 DS RR published
|
|
|
|
|
| DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest 4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=
|
|
|
|
|
| • Status: Valid because published
|
|
|
|
|
| 2 DNSKEY RR found
|
|
|
|
|
| Public Key with Algorithm 8, KeyTag 5613, Flags 256
|
|
|
|
|
| Public Key with Algorithm 8, KeyTag 20326, Flags 257 (SEP = Secure Entry Point)
|
|
|
|
|
| 1 RRSIG RR to validate DNSKEY RR found
|
|
|
|
|
| RRSIG-Owner (root), Algorithm: 8, 0 Labels, original TTL: 172800 sec, Signature-expiration: 21.06.2024, 00:00:00 +, Signature-Inception: 31.05.2024, 00:00:00 +, KeyTag 20326, Signer-Name: (root)
|
|
|
|
|
| • Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20326 used to validate the DNSKEY RRSet
|
|
|
|
|
| • Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest "4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone
|
|
|
Zone: nl
|
|
nl
| 1 DS RR in the parent zone found
|
|
|
|
|
| DS with Algorithm 13, KeyTag 17153, DigestType 2 and Digest xd/dyR51MlYqNfPCzTCCOJS+CPIBAfGr9FyKuXOfP0k=
|
|
|
|
|
| 1 RRSIG RR to validate DS RR found
|
|
|
|
|
| RRSIG-Owner nl., Algorithm: 8, 1 Labels, original TTL: 86400 sec, Signature-expiration: 21.06.2024, 05:00:00 +, Signature-Inception: 08.06.2024, 04:00:00 +, KeyTag 5613, Signer-Name: (root)
|
|
|
|
|
| • Status: Good - Algorithmus 8 and DNSKEY with KeyTag 5613 used to validate the DS RRSet in the parent zone
|
|
|
|
|
| 2 DNSKEY RR found
|
|
|
|
|
| Public Key with Algorithm 13, KeyTag 17153, Flags 257 (SEP = Secure Entry Point)
|
|
|
|
|
| Public Key with Algorithm 13, KeyTag 63436, Flags 256
|
|
|
|
|
| 1 RRSIG RR to validate DNSKEY RR found
|
|
|
|
|
| RRSIG-Owner nl., Algorithm: 13, 1 Labels, original TTL: 3600 sec, Signature-expiration: 21.06.2024, 21:35:04 +, Signature-Inception: 07.06.2024, 09:37:25 +, KeyTag 17153, Signer-Name: nl
|
|
|
|
|
| • Status: Good - Algorithmus 13 and DNSKEY with KeyTag 17153 used to validate the DNSKEY RRSet
|
|
|
|
|
| • Status: Valid Chain of trust. Parent-DS with Algorithm 13, KeyTag 17153, DigestType 2 and Digest "xd/dyR51MlYqNfPCzTCCOJS+CPIBAfGr9FyKuXOfP0k=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone
|
|
|
Zone: amysparaplu.nl
|
|
amysparaplu.nl
| 0 DS RR in the parent zone found
|
|
|
|
|
| DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "vvdq0pr4lf35bgv6dmpu6pvkajs76sr1" between the hashed NSEC3-owner "vvdq0pr4lf35bgv6dmpu6pvkajs76sr1" and the hashed NextOwner "vvdq5hvq2469p4ia34cj1tdcur350slu". So the parent zone confirmes the not-existence of a DS RR.
Bitmap: No Bitmap? Validated: RRSIG-Owner vvdq0pr4lf35bgv6dmpu6pvkajs76sr1.nl., Algorithm: 13, 2 Labels, original TTL: 600 sec, Signature-expiration: 19.06.2024, 11:59:09 +, Signature-Inception: 05.06.2024, 09:37:25 +, KeyTag 63436, Signer-Name: nl
|
|
|
|
|
| 1 DNSKEY RR found
|
|
|
|
|
| Public Key with Algorithm 13, KeyTag 18719, Flags 257 (SEP = Secure Entry Point)
|
|
|
|
|
| 1 RRSIG RR to validate DNSKEY RR found
|
|
|
|
|
| RRSIG-Owner amysparaplu.nl., Algorithm: 13, 2 Labels, original TTL: 40000 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| • Status: Good - Algorithmus 13 and DNSKEY with KeyTag 18719 used to validate the DNSKEY RRSet
|
|
|
|
|
| Error: DNSKEY 18719 signs DNSKEY RRset, but no confirming DS RR in the parent zone found. No chain of trust created.
|
|
|
|
|
| RRSIG Type 1 validates the A - Result: 89.107.56.97
Validated: RRSIG-Owner amysparaplu.nl., Algorithm: 13, 2 Labels, original TTL: 60 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| CNAME-Query sends a valid NSEC3 RR as result with the hashed query name "l4014k64mr80t1k15t5rqg3k6rjnktui" equal the hashed NSEC3-owner "l4014k64mr80t1k15t5rqg3k6rjnktui" and the hashed NextOwner "cpqaspea52afej4hkus7fujjsbd0qbfv". So the zone confirmes the not-existence of that CNAME RR, but the existence of that query name (minimal one RR with that name exists).
Bitmap: A, NS, SOA, RRSIG, DNSKEY, NSEC3PARAM Validated: RRSIG-Owner l4014k64mr80t1k15t5rqg3k6rjnktui.amysparaplu.nl., Algorithm: 13, 3 Labels, original TTL: 3600 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| Status: Good. NoData-Proof required and found.
|
|
|
|
|
| TXT-Query sends a valid NSEC3 RR as result with the hashed query name "l4014k64mr80t1k15t5rqg3k6rjnktui" equal the hashed NSEC3-owner "l4014k64mr80t1k15t5rqg3k6rjnktui" and the hashed NextOwner "cpqaspea52afej4hkus7fujjsbd0qbfv". So the zone confirmes the not-existence of that TXT RR, but the existence of that query name (minimal one RR with that name exists).
Bitmap: A, NS, SOA, RRSIG, DNSKEY, NSEC3PARAM Validated: RRSIG-Owner l4014k64mr80t1k15t5rqg3k6rjnktui.amysparaplu.nl., Algorithm: 13, 3 Labels, original TTL: 3600 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| Status: Good. NoData-Proof required and found.
|
|
|
|
|
| AAAA-Query sends a valid NSEC3 RR as result with the hashed query name "l4014k64mr80t1k15t5rqg3k6rjnktui" equal the hashed NSEC3-owner "l4014k64mr80t1k15t5rqg3k6rjnktui" and the hashed NextOwner "cpqaspea52afej4hkus7fujjsbd0qbfv". So the zone confirmes the not-existence of that AAAA RR, but the existence of that query name (minimal one RR with that name exists).
Bitmap: A, NS, SOA, RRSIG, DNSKEY, NSEC3PARAM Validated: RRSIG-Owner l4014k64mr80t1k15t5rqg3k6rjnktui.amysparaplu.nl., Algorithm: 13, 3 Labels, original TTL: 3600 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| Status: Good. NoData-Proof required and found.
|
|
|
|
|
| TLSA-Query (_443._tcp.amysparaplu.nl) sends a valid NSEC3 RR as result with the hashed owner name "l4014k64mr80t1k15t5rqg3k6rjnktui" (unhashed: amysparaplu.nl). So that's the Closest Encloser of the query name. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Next Closer Name "8nbo5u7q456mmq16abker6shreh3mnli" (unhashed: _tcp.amysparaplu.nl) with the owner "l4014k64mr80t1k15t5rqg3k6rjnktui" and the NextOwner "cpqaspea52afej4hkus7fujjsbd0qbfv". So that NSEC3 confirms the not-existence of the Next Closer Name. TLSA-Query (_443._tcp.amysparaplu.nl) sends a valid NSEC3 RR as result with the owner name "l4014k64mr80t1k15t5rqg3k6rjnktui" greater the NextOwner-Name "cpqaspea52afej4hkus7fujjsbd0qbfv", so the NSEC3 covers the end of the zone. The hashed query name "7u42c23fl0qs3mmehrs5s7cq9eans8qd" comes before the hashed NextOwner, so the zone confirmes the not-existence of that TLSA RR.
Bitmap: A, NS, SOA, RRSIG, DNSKEY, NSEC3PARAM Validated: RRSIG-Owner l4014k64mr80t1k15t5rqg3k6rjnktui.amysparaplu.nl., Algorithm: 13, 3 Labels, original TTL: 3600 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| Status: Good. NXDomain-Proof required and found.
|
|
|
|
|
| TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Wildcard expansion of the ClosestEncloser "h1eg84uh7kjskoe6b2ptav3jbpd2u13u" (unhashed: *.amysparaplu.nl) with the owner "cpqaspea52afej4hkus7fujjsbd0qbfv" and the NextOwner "l4014k64mr80t1k15t5rqg3k6rjnktui". So that NSEC3 confirms the not-existence of the Wildcard expansion.
Bitmap: A, RRSIG Validated: RRSIG-Owner cpqaspea52afej4hkus7fujjsbd0qbfv.amysparaplu.nl., Algorithm: 13, 3 Labels, original TTL: 3600 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| Status: Good. NXDomain-Proof required and found.
|
|
|
|
|
| CAA-Query sends a valid NSEC3 RR as result with the hashed query name "l4014k64mr80t1k15t5rqg3k6rjnktui" equal the hashed NSEC3-owner "l4014k64mr80t1k15t5rqg3k6rjnktui" and the hashed NextOwner "cpqaspea52afej4hkus7fujjsbd0qbfv". So the zone confirmes the not-existence of that CAA RR, but the existence of that query name (minimal one RR with that name exists).
Bitmap: A, NS, SOA, RRSIG, DNSKEY, NSEC3PARAM Validated: RRSIG-Owner l4014k64mr80t1k15t5rqg3k6rjnktui.amysparaplu.nl., Algorithm: 13, 3 Labels, original TTL: 3600 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| Status: Good. NoData-Proof required and found.
|
|
|
Zone: www.amysparaplu.nl
|
|
www.amysparaplu.nl
| 0 DS RR in the parent zone found
|
|
|
|
|
| DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "cpqaspea52afej4hkus7fujjsbd0qbfv" between the hashed NSEC3-owner "cpqaspea52afej4hkus7fujjsbd0qbfv" and the hashed NextOwner "l4014k64mr80t1k15t5rqg3k6rjnktui". So the parent zone confirmes the not-existence of a DS RR.
Bitmap: A, RRSIG Validated: RRSIG-Owner cpqaspea52afej4hkus7fujjsbd0qbfv.amysparaplu.nl., Algorithm: 13, 3 Labels, original TTL: 3600 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| RRSIG Type 1 validates the A - Result: 89.107.56.97
Validated: RRSIG-Owner www.amysparaplu.nl., Algorithm: 13, 3 Labels, original TTL: 60 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| CNAME-Query sends a valid NSEC3 RR as result with the hashed query name "cpqaspea52afej4hkus7fujjsbd0qbfv" equal the hashed NSEC3-owner "cpqaspea52afej4hkus7fujjsbd0qbfv" and the hashed NextOwner "l4014k64mr80t1k15t5rqg3k6rjnktui". So the zone confirmes the not-existence of that CNAME RR, but the existence of that query name (minimal one RR with that name exists).
Bitmap: A, RRSIG Validated: RRSIG-Owner cpqaspea52afej4hkus7fujjsbd0qbfv.amysparaplu.nl., Algorithm: 13, 3 Labels, original TTL: 3600 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| Status: Good. NoData-Proof required and found.
|
|
|
|
|
| TXT-Query sends a valid NSEC3 RR as result with the hashed query name "cpqaspea52afej4hkus7fujjsbd0qbfv" equal the hashed NSEC3-owner "cpqaspea52afej4hkus7fujjsbd0qbfv" and the hashed NextOwner "l4014k64mr80t1k15t5rqg3k6rjnktui". So the zone confirmes the not-existence of that TXT RR, but the existence of that query name (minimal one RR with that name exists).
Bitmap: A, RRSIG Validated: RRSIG-Owner cpqaspea52afej4hkus7fujjsbd0qbfv.amysparaplu.nl., Algorithm: 13, 3 Labels, original TTL: 3600 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| Status: Good. NoData-Proof required and found.
|
|
|
|
|
| AAAA-Query sends a valid NSEC3 RR as result with the hashed query name "cpqaspea52afej4hkus7fujjsbd0qbfv" equal the hashed NSEC3-owner "cpqaspea52afej4hkus7fujjsbd0qbfv" and the hashed NextOwner "l4014k64mr80t1k15t5rqg3k6rjnktui". So the zone confirmes the not-existence of that AAAA RR, but the existence of that query name (minimal one RR with that name exists).
Bitmap: A, RRSIG Validated: RRSIG-Owner cpqaspea52afej4hkus7fujjsbd0qbfv.amysparaplu.nl., Algorithm: 13, 3 Labels, original TTL: 3600 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| Status: Good. NoData-Proof required and found.
|
|
|
|
|
| TLSA-Query (_443._tcp.www.amysparaplu.nl) sends a valid NSEC3 RR as result with the hashed owner name "cpqaspea52afej4hkus7fujjsbd0qbfv" (unhashed: www.amysparaplu.nl). So that's the Closest Encloser of the query name. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Next Closer Name "juf7ktdbs50ni97on69k3qgvol17v1dj" (unhashed: _tcp.www.amysparaplu.nl) with the owner "cpqaspea52afej4hkus7fujjsbd0qbfv" and the NextOwner "l4014k64mr80t1k15t5rqg3k6rjnktui". So that NSEC3 confirms the not-existence of the Next Closer Name. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Wildcard expansion of the ClosestEncloser "jritojtng6mqksa1csahlc5os11999mr" (unhashed: *.www.amysparaplu.nl) with the owner "cpqaspea52afej4hkus7fujjsbd0qbfv" and the NextOwner "l4014k64mr80t1k15t5rqg3k6rjnktui". So that NSEC3 confirms the not-existence of the Wildcard expansion. TLSA-Query (_443._tcp.www.amysparaplu.nl) sends a valid NSEC3 RR as result with the hashed query name "kis5ulh8ghk5uc176j87fp32kki5eq49" between the hashed NSEC3-owner "cpqaspea52afej4hkus7fujjsbd0qbfv" and the hashed NextOwner "l4014k64mr80t1k15t5rqg3k6rjnktui". So the zone confirmes the not-existence of that TLSA RR.
Bitmap: A, RRSIG Validated: RRSIG-Owner cpqaspea52afej4hkus7fujjsbd0qbfv.amysparaplu.nl., Algorithm: 13, 3 Labels, original TTL: 3600 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| Status: Good. NXDomain-Proof required and found.
|
|
|
|
|
| CAA-Query sends a valid NSEC3 RR as result with the hashed query name "cpqaspea52afej4hkus7fujjsbd0qbfv" equal the hashed NSEC3-owner "cpqaspea52afej4hkus7fujjsbd0qbfv" and the hashed NextOwner "l4014k64mr80t1k15t5rqg3k6rjnktui". So the zone confirmes the not-existence of that CAA RR, but the existence of that query name (minimal one RR with that name exists).
Bitmap: A, RRSIG Validated: RRSIG-Owner cpqaspea52afej4hkus7fujjsbd0qbfv.amysparaplu.nl., Algorithm: 13, 3 Labels, original TTL: 3600 sec, Signature-expiration: 20.06.2024, 00:00:00 +, Signature-Inception: 30.05.2024, 00:00:00 +, KeyTag 18719, Signer-Name: amysparaplu.nl
|
|
|
|
|
| Status: Good. NoData-Proof required and found.
|