Zone (*) DNSSEC - Informations Zone : (root)(root) 1 DS RR published DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest 4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=
• Status: Valid because published2 DNSKEY RR found Public Key with Algorithm 8, KeyTag 20326, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 42351, Flags 256
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner (root), Algorithm: 8, 0 Labels, original TTL: 172800 sec, Signature-expiration: 13.03.2021, 00:00:00 +, Signature-Inception: 20.02.2021, 00:00:00 +, KeyTag 20326, Signer-Name: (root)
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20326 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest "4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : orgorg 1 DS RR in the parent zone found DS with Algorithm 8, KeyTag 26974, DigestType 2 and Digest T+3ilMU/Q4oVjEHTlInNeKhr6w2KCur/FHRcDRbh3jI=
1 RRSIG RR to validate DS RR found RRSIG-Owner org., Algorithm: 8, 1 Labels, original TTL: 86400 sec, Signature-expiration: 08.03.2021, 05:00:00 +, Signature-Inception: 23.02.2021, 04:00:00 +, KeyTag 42351, Signer-Name: (root)
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 42351 used to validate the DS RRSet in the parent zone3 DNSKEY RR found Public Key with Algorithm 8, KeyTag 26974, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 27558, Flags 256
Public Key with Algorithm 8, KeyTag 34266, Flags 256
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner org., Algorithm: 8, 1 Labels, original TTL: 900 sec, Signature-expiration: 10.03.2021, 15:29:59 +, Signature-Inception: 17.02.2021, 14:29:59 +, KeyTag 26974, Signer-Name: org
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 26974 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 26974, DigestType 2 and Digest "T+3ilMU/Q4oVjEHTlInNeKhr6w2KCur/FHRcDRbh3jI=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : peterjin.orgpeterjin.org 1 DS RR in the parent zone found DS with Algorithm 13, KeyTag 2371, DigestType 2 and Digest JIAHV5JAdr7zgSaVkTI4yum3z3Wom19acBm48bDIjTo=
1 RRSIG RR to validate DS RR found RRSIG-Owner peterjin.org., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 10.03.2021, 15:29:59 +, Signature-Inception: 17.02.2021, 14:29:59 +, KeyTag 34266, Signer-Name: org
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 34266 used to validate the DS RRSet in the parent zone2 DNSKEY RR found Public Key with Algorithm 13, KeyTag 2371, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 13, KeyTag 34505, Flags 256
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner peterjin.org., Algorithm: 13, 2 Labels, original TTL: 3600 sec, Signature-expiration: 25.03.2021, 04:27:53 +, Signature-Inception: 24.01.2021, 04:27:53 +, KeyTag 2371, Signer-Name: peterjin.org
• Status: Good - Algorithmus 13 and DNSKEY with KeyTag 2371 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 13, KeyTag 2371, DigestType 2 and Digest "JIAHV5JAdr7zgSaVkTI4yum3z3Wom19acBm48bDIjTo=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : rdns.peterjin.orgrdns.peterjin.org 1 DS RR in the parent zone found DS with Algorithm 13, KeyTag 50950, DigestType 2 and Digest T6T1NCXtFwGgcEKNGb9DSFatCsn5/k+CuCs8uUQ5IxU=
1 RRSIG RR to validate DS RR found RRSIG-Owner rdns.peterjin.org., Algorithm: 13, 3 Labels, original TTL: 300 sec, Signature-expiration: 24.02.2021, 08:14:52 +, Signature-Inception: 22.02.2021, 06:14:52 +, KeyTag 34505, Signer-Name: peterjin.org
• Status: Good - Algorithmus 13 and DNSKEY with KeyTag 34505 used to validate the DS RRSet in the parent zone3 DNSKEY RR found Public Key with Algorithm 13, KeyTag 50950, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 13, KeyTag 51572, Flags 256
Public Key with Algorithm 13, KeyTag 58690, Flags 256
2 RRSIG RR to validate DNSKEY RR found RRSIG-Owner rdns.peterjin.org., Algorithm: 13, 3 Labels, original TTL: 1000 sec, Signature-expiration: 07.03.2021, 05:50:38 +, Signature-Inception: 05.02.2021, 05:50:38 +, KeyTag 50950, Signer-Name: rdns.peterjin.org
RRSIG-Owner rdns.peterjin.org., Algorithm: 13, 3 Labels, original TTL: 1000 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org
• Status: Good - Algorithmus 13 and DNSKEY with KeyTag 50950 used to validate the DNSKEY RRSet• Status: Good - Algorithmus 13 and DNSKEY with KeyTag 58690 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 13, KeyTag 50950, DigestType 2 and Digest "T6T1NCXtFwGgcEKNGb9DSFatCsn5/k+CuCs8uUQ5IxU=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : scp.rdns.peterjin.orgscp.rdns.peterjin.org 0 DS RR in the parent zone found DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "qatfqn5g94092qbdinbs9dc3o02mtjo0" between the hashed NSEC3-owner "qatfqn5g94092qbdinbs9dc3o02mtjo0" and the hashed NextOwner "qaucn2087qv2m0ltatitt95n789qs70c". So the parent zone confirmes the not-existence of a DS RR.Bitmap: No Bitmap? Validated: RRSIG-Owner qatfqn5g94092qbdinbs9dc3o02mtjo0.rdns.peterjin.org., Algorithm: 13, 4 Labels, original TTL: 300 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org
0 DNSKEY RR found Zone : scp-015.scp.rdns.peterjin.orgscp-015.scp.rdns.peterjin.org 0 DS RR in the parent zone found DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "lekhgo373hma2a3sqdreutkcfsjtp4bi" between the hashed NSEC3-owner "lekhgo373hma2a3sqdreutkcfsjtp4bi" and the hashed NextOwner "lem4eo8o2a8j1i3cceb1t8sngcu3pviu". So the parent zone confirmes the not-existence of a DS RR.Bitmap: AAAA, RRSIG Validated: RRSIG-Owner lekhgo373hma2a3sqdreutkcfsjtp4bi.rdns.peterjin.org., Algorithm: 13, 4 Labels, original TTL: 300 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org
0 DNSKEY RR found RRSIG Type 28 validates the AAAA - Result: 2602:0806:A003:040E:0000:0000:5C50:0015 Validated: RRSIG-Owner scp-015.scp.rdns.peterjin.org., Algorithm: 13, 5 Labels, original TTL: 600 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org
A-Query sends a valid NSEC3 RR as result with the hashed query name "lekhgo373hma2a3sqdreutkcfsjtp4bi" equal the hashed NSEC3-owner "lekhgo373hma2a3sqdreutkcfsjtp4bi" and the hashed NextOwner "lem4eo8o2a8j1i3cceb1t8sngcu3pviu". So the zone confirmes the not-existence of that A RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: AAAA, RRSIG Validated: RRSIG-Owner lekhgo373hma2a3sqdreutkcfsjtp4bi.rdns.peterjin.org., Algorithm: 13, 4 Labels, original TTL: 300 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org
Status: Good. NoData-Proof required and found. CNAME-Query sends a valid NSEC3 RR as result with the hashed query name "lekhgo373hma2a3sqdreutkcfsjtp4bi" equal the hashed NSEC3-owner "lekhgo373hma2a3sqdreutkcfsjtp4bi" and the hashed NextOwner "lem4eo8o2a8j1i3cceb1t8sngcu3pviu". So the zone confirmes the not-existence of that CNAME RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: AAAA, RRSIG Validated: RRSIG-Owner lekhgo373hma2a3sqdreutkcfsjtp4bi.rdns.peterjin.org., Algorithm: 13, 4 Labels, original TTL: 300 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org
Status: Good. NoData-Proof required and found. TXT-Query sends a valid NSEC3 RR as result with the hashed query name "lekhgo373hma2a3sqdreutkcfsjtp4bi" equal the hashed NSEC3-owner "lekhgo373hma2a3sqdreutkcfsjtp4bi" and the hashed NextOwner "lem4eo8o2a8j1i3cceb1t8sngcu3pviu". So the zone confirmes the not-existence of that TXT RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: AAAA, RRSIG Validated: RRSIG-Owner lekhgo373hma2a3sqdreutkcfsjtp4bi.rdns.peterjin.org., Algorithm: 13, 4 Labels, original TTL: 300 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org
Status: Good. NoData-Proof required and found. TLSA-Query (_443._tcp.scp-015.scp.rdns.peterjin.org) sends a valid NSEC3 RR as result with the hashed owner name "lekhgo373hma2a3sqdreutkcfsjtp4bi" (unhashed: scp-015.scp.rdns.peterjin.org). So that's the Closest Encloser of the query name. Bitmap: AAAA, RRSIG Validated: RRSIG-Owner lekhgo373hma2a3sqdreutkcfsjtp4bi.rdns.peterjin.org., Algorithm: 13, 4 Labels, original TTL: 300 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org
Status: Good. NXDomain-Proof required and found. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Next Closer Name "56n0f1j73jlso0ckmajnl26j9pebvujn" (unhashed: _tcp.scp-015.scp.rdns.peterjin.org) with the owner "56hvgbp2p531grnqdlcs3tmm32p52l6b" and the NextOwner "56oh8attartunrjr78okdum8tn264bhi". So that NSEC3 confirms the not-existence of the Next Closer Name. Bitmap: AAAA, RRSIG Validated: RRSIG-Owner 56hvgbp2p531grnqdlcs3tmm32p52l6b.rdns.peterjin.org., Algorithm: 13, 4 Labels, original TTL: 300 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org
Status: Good. NXDomain-Proof required and found. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Wildcard expansion of the ClosestEncloser "28if81ar5ng8mdnj6c73fauuth62d40j" (unhashed: *.scp-015.scp.rdns.peterjin.org) with the owner "28h50iqq0eu2lpiql5t3ipcoejlen2hf" and the NextOwner "28s50k3op6fae24ki9u1rrsh8nit6e18". So that NSEC3 confirms the not-existence of the Wildcard expansion. Bitmap: AAAA, RRSIG Validated: RRSIG-Owner 28h50iqq0eu2lpiql5t3ipcoejlen2hf.rdns.peterjin.org., Algorithm: 13, 4 Labels, original TTL: 300 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org
Status: Good. NXDomain-Proof required and found. CAA-Query sends a valid NSEC3 RR as result with the hashed query name "lekhgo373hma2a3sqdreutkcfsjtp4bi" equal the hashed NSEC3-owner "lekhgo373hma2a3sqdreutkcfsjtp4bi" and the hashed NextOwner "lem4eo8o2a8j1i3cceb1t8sngcu3pviu". So the zone confirmes the not-existence of that CAA RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: AAAA, RRSIG Validated: RRSIG-Owner lekhgo373hma2a3sqdreutkcfsjtp4bi.rdns.peterjin.org., Algorithm: 13, 4 Labels, original TTL: 300 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org
Status: Good. NoData-Proof required and found. Zone : www.scp-015.scp.rdns.peterjin.orgwww.scp-015.scp.rdns.peterjin.org 0 DS RR in the parent zone found DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "nsc1kids5vh9nh6q78piqgovlpqouudl" between the hashed NSEC3-owner "nsan2rgr8ndq2vbr568a54banhbm0udl" and the hashed NextOwner "nsc83eealteu11uq480gq9ma1pu2nilt". So the parent zone confirmes the not-existence of a DS RR.Bitmap: AAAA, RRSIG Validated: RRSIG-Owner nsan2rgr8ndq2vbr568a54banhbm0udl.rdns.peterjin.org., Algorithm: 13, 4 Labels, original TTL: 300 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org
DS-Query in the parent zone sends valid NSEC3 RR with the Hash "lekhgo373hma2a3sqdreutkcfsjtp4bi" as Owner. That's the Hash of "scp-015.scp.rdns.peterjin.org" with the NextHashedOwnerName "lem4eo8o2a8j1i3cceb1t8sngcu3pviu". So that domain name is the Closest Encloser of "www.scp-015.scp.rdns.peterjin.org". Opt-Out: False.Bitmap: AAAA, RRSIG Validated: RRSIG-Owner lekhgo373hma2a3sqdreutkcfsjtp4bi.rdns.peterjin.org., Algorithm: 13, 4 Labels, original TTL: 300 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org
The ClosestEncloser says, that "*.scp-015.scp.rdns.peterjin.org" with the Hash "28if81ar5ng8mdnj6c73fauuth62d40j" is a possible Wildcard of the DS Query Name. But the DS-Query in the parent zone sends a valid NSEC3 RR With the owner "28h50iqq0eu2lpiql5t3ipcoejlen2hf" and the Next Owner "28s50k3op6fae24ki9u1rrsh8nit6e18", so the Hash of the wildcard is between these hashes. So that NSEC3 proves the Not-existence of that wildcard expansion. Opt-Out: False.Bitmap: AAAA, RRSIG Validated: RRSIG-Owner 28h50iqq0eu2lpiql5t3ipcoejlen2hf.rdns.peterjin.org., Algorithm: 13, 4 Labels, original TTL: 300 sec, Signature-expiration: 18.03.2021, 16:35:10 +, Signature-Inception: 16.02.2021, 16:35:10 +, KeyTag 58690, Signer-Name: rdns.peterjin.org