Zone (*) DNSSEC - Informations Zone : (root)(root) 1 DS RR published DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest 4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=
• Status: Valid because published2 DNSKEY RR found Public Key with Algorithm 8, KeyTag 20326, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 26116, Flags 256
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner (root), Algorithm: 8, 0 Labels, original TTL: 172800 sec, Signature-expiration: 21.12.2020, 00:00:00 +, Signature-Inception: 30.11.2020, 00:00:00 +, KeyTag 20326, Signer-Name: (root)
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20326 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 20326, DigestType 2 and Digest "4G1EuAuPHTmpXAsNfGXQhFjogECbvGg0VxBCN8f47I0=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : dede 1 DS RR in the parent zone found DS with Algorithm 8, KeyTag 45580, DigestType 2 and Digest kYwy4vEiEXZr5iJmdPRHRY8iWbmg2HtE0p1Vr+ymsuE=
1 RRSIG RR to validate DS RR found RRSIG-Owner de., Algorithm: 8, 1 Labels, original TTL: 86400 sec, Signature-expiration: 16.12.2020, 17:00:00 +, Signature-Inception: 03.12.2020, 16:00:00 +, KeyTag 26116, Signer-Name: (root)
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 26116 used to validate the DS RRSet in the parent zone2 DNSKEY RR found Public Key with Algorithm 8, KeyTag 45580, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 60906, Flags 256
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner de., Algorithm: 8, 1 Labels, original TTL: 300 sec, Signature-expiration: 17.12.2020, 09:44:07 +, Signature-Inception: 03.12.2020, 08:14:07 +, KeyTag 45580, Signer-Name: de
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 45580 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 45580, DigestType 2 and Digest "kYwy4vEiEXZr5iJmdPRHRY8iWbmg2HtE0p1Vr+ymsuE=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneZone : server-daten.deserver-daten.de 1 DS RR in the parent zone found DS with Algorithm 8, KeyTag 20737, DigestType 2 and Digest atjk9MBB7MV0rR6m/vjNsoAib1yqTP4vnN1Whf4ZtEE=
1 RRSIG RR to validate DS RR found RRSIG-Owner server-daten.de., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 17.12.2020, 10:43:38 +, Signature-Inception: 03.12.2020, 09:13:38 +, KeyTag 60906, Signer-Name: de
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 60906 used to validate the DS RRSet in the parent zone2 DNSKEY RR found Public Key with Algorithm 8, KeyTag 20737, Flags 257 (SEP = Secure Entry Point)
Public Key with Algorithm 8, KeyTag 39483, Flags 256
1 RRSIG RR to validate DNSKEY RR found RRSIG-Owner server-daten.de., Algorithm: 8, 2 Labels, original TTL: 3600 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 20737, Signer-Name: server-daten.de
• Status: Good - Algorithmus 8 and DNSKEY with KeyTag 20737 used to validate the DNSKEY RRSet• Status: Valid Chain of trust. Parent-DS with Algorithm 8, KeyTag 20737, DigestType 2 and Digest "atjk9MBB7MV0rR6m/vjNsoAib1yqTP4vnN1Whf4ZtEE=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zoneRRSIG Type 1 validates the A - Result: 85.215.2.226 Validated: RRSIG-Owner server-daten.de., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
RRSIG Type 16 validates the TXT - Result: v=spf1 a mx ?all
This is a small txt test entry Validated: RRSIG-Owner server-daten.de., Algorithm: 8, 2 Labels, original TTL: 3600 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
RRSIG Type 28 validates the AAAA - Result: 2A01:0238:301B:0000:0000:0000:0000:1226 Validated: RRSIG-Owner server-daten.de., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
RRSIG Type 257 validates the CAA - Result: 5|iodefmailto:info@sql-und-xml.de
5|issueletsencrypt.org; accounturi=https://acme-staging-v02.api.letsencrypt.org/acme/acct/5532373
5|issueletsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/35657966 Validated: RRSIG-Owner server-daten.de., Algorithm: 8, 2 Labels, original TTL: 86400 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
CNAME-Query sends a valid NSEC3 RR as result with the hashed query name "ktm4bjk7n632qei038n1pbarck8vid7p" equal the hashed NSEC3-owner "ktm4bjk7n632qei038n1pbarck8vid7p" and the hashed NextOwner "l322s7ojkd227t5h0qjbfkun29h4ua65". So the zone confirmes the not-existence of that CNAME RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, NS, SOA, MX, TXT, AAAA, RRSIG, DNSKEY, NSEC3PARAM, CAA Validated: RRSIG-Owner ktm4bjk7n632qei038n1pbarck8vid7p.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NoData-Proof required and found. TLSA-Query (_443._tcp.server-daten.de) sends a valid NSEC3 RR as result with the hashed owner name "ktm4bjk7n632qei038n1pbarck8vid7p" (unhashed: server-daten.de). So that's the Closest Encloser of the query name. Bitmap: A, NS, SOA, MX, TXT, AAAA, RRSIG, DNSKEY, NSEC3PARAM, CAA Validated: RRSIG-Owner ktm4bjk7n632qei038n1pbarck8vid7p.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NXDomain-Proof required and found. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Next Closer Name "imd2a9lh0i79vj8dsbitel3q98ufhgum" (unhashed: _tcp.server-daten.de) with the owner "ial5l4mknvr56630ocsv07v20dppq7mg" and the NextOwner "juf2lc2harvkr5rkhcj3aded1euuj5nd". So that NSEC3 confirms the not-existence of the Next Closer Name. Bitmap: A, RRSIG Validated: RRSIG-Owner ial5l4mknvr56630ocsv07v20dppq7mg.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NXDomain-Proof required and found. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Wildcard expansion of the ClosestEncloser "q3mjoo5cngmmlbli5f4t04frtjci6d5c" (unhashed: *.server-daten.de) with the owner "pnik51j6lu1poret6ta39opaq22jko5c" and the NextOwner "q5ndfqi3ablq2203mk0b7gj39skc61bj". So that NSEC3 confirms the not-existence of the Wildcard expansion. Bitmap: CNAME, RRSIG Validated: RRSIG-Owner pnik51j6lu1poret6ta39opaq22jko5c.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NXDomain-Proof required and found. Zone : www.server-daten.dewww.server-daten.de 0 DS RR in the parent zone found DS-Query in the parent zone has a valid NSEC3 RR as result with the hashed query name "lfooko88r4f0grdpic6hco5pino2iua4" between the hashed NSEC3-owner "lfooko88r4f0grdpic6hco5pino2iua4" and the hashed NextOwner "lgs91jcvibca3f0kv4spv4kalvjhb6cl". So the parent zone confirmes the not-existence of a DS RR.Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner lfooko88r4f0grdpic6hco5pino2iua4.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
RRSIG Type 1 validates the A - Result: 85.215.2.226 Validated: RRSIG-Owner www.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 86400 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
RRSIG Type 28 validates the AAAA - Result: 2A01:0238:301B:0000:0000:0000:0000:1226 Validated: RRSIG-Owner www.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 86400 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
CNAME-Query sends a valid NSEC3 RR as result with the hashed query name "lfooko88r4f0grdpic6hco5pino2iua4" equal the hashed NSEC3-owner "lfooko88r4f0grdpic6hco5pino2iua4" and the hashed NextOwner "lgs91jcvibca3f0kv4spv4kalvjhb6cl". So the zone confirmes the not-existence of that CNAME RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner lfooko88r4f0grdpic6hco5pino2iua4.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NoData-Proof required and found. TXT-Query sends a valid NSEC3 RR as result with the hashed query name "lfooko88r4f0grdpic6hco5pino2iua4" equal the hashed NSEC3-owner "lfooko88r4f0grdpic6hco5pino2iua4" and the hashed NextOwner "lgs91jcvibca3f0kv4spv4kalvjhb6cl". So the zone confirmes the not-existence of that TXT RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner lfooko88r4f0grdpic6hco5pino2iua4.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NoData-Proof required and found. TLSA-Query (_443._tcp.www.server-daten.de) sends a valid NSEC3 RR as result with the hashed owner name "lfooko88r4f0grdpic6hco5pino2iua4" (unhashed: www.server-daten.de). So that's the Closest Encloser of the query name. Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner lfooko88r4f0grdpic6hco5pino2iua4.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NXDomain-Proof required and found. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Next Closer Name "6b4dno0m07hg9bk4r8se5jertff6ua0s" (unhashed: _tcp.www.server-daten.de) with the owner "5unldc3lblj9c3kh9o7bsgocj5gpkhmt" and the NextOwner "6pqnpltan0366rjkhvs61nnq5tese0kb". So that NSEC3 confirms the not-existence of the Next Closer Name. Bitmap: CNAME, RRSIG Validated: RRSIG-Owner 5unldc3lblj9c3kh9o7bsgocj5gpkhmt.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NXDomain-Proof required and found. TLSA-Query sends a valid NSEC3 RR as result and covers the hashed Wildcard expansion of the ClosestEncloser "re3n020mlpqihvisf4h372pc83evlfm3" (unhashed: *.www.server-daten.de) with the owner "q5ndfqi3ablq2203mk0b7gj39skc61bj" and the NextOwner "ri4r1tmutuvlqitq97h0maec5ud3u5q6". So that NSEC3 confirms the not-existence of the Wildcard expansion. Bitmap: CNAME, RRSIG Validated: RRSIG-Owner q5ndfqi3ablq2203mk0b7gj39skc61bj.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NXDomain-Proof required and found. CAA-Query sends a valid NSEC3 RR as result with the hashed query name "lfooko88r4f0grdpic6hco5pino2iua4" equal the hashed NSEC3-owner "lfooko88r4f0grdpic6hco5pino2iua4" and the hashed NextOwner "lgs91jcvibca3f0kv4spv4kalvjhb6cl". So the zone confirmes the not-existence of that CAA RR, but the existence of that query name (minimal one RR with that name exists).Bitmap: A, AAAA, RRSIG Validated: RRSIG-Owner lfooko88r4f0grdpic6hco5pino2iua4.server-daten.de., Algorithm: 8, 3 Labels, original TTL: 3600 sec, Signature-expiration: 17.12.2020, 00:00:00 +, Signature-Inception: 26.11.2020, 00:00:00 +, KeyTag 39483, Signer-Name: server-daten.de
Status: Good. NoData-Proof required and found.