_25._tcp.mx1.trt1.jus.br

Updated: 2021-05-02 04:45:47 UTC (1301 days ago) Update now

DNSSEC options (hide)

|?| RR types:
|?| DNSSEC algorithms:
|?| DS digest algorithms:
|?| Denial of existence:
|?| Redundant edges:
|?| Ignore RFC 8624:
|?| Ignore RFC 9276:
|?| Multi-signer:
|?| Trust anchors:
- Root zone KSK
|?| Additional trusted keys:

Notices

DNSSEC Authentication Chain

RRset status

Secure (4)

_25._tcp.mx1.trt1.jus.br/TLSA (NXDOMAIN)
_tcp.mx1.trt1.jus.br/NS (NXDOMAIN)
mx1.trt1.jus.br/A
trt1.jus.br/SOA

DNSKEY/DS/NSEC status

Secure (14)

./DNSKEY (alg 8, id 14631)
./DNSKEY (alg 8, id 20326)
NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA
NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA
NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS
NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS
br/DNSKEY (alg 13, id 2471)
br/DNSKEY (alg 13, id 429)
br/DS (alg 13, id 2471)
jus.br/DNSKEY (alg 13, id 30329)
jus.br/DS (alg 13, id 30329)
trt1.jus.br/DNSKEY (alg 7, id 16125)
trt1.jus.br/DNSKEY (alg 7, id 3248)
trt1.jus.br/DS (alg 7, id 16125)

Delegation status

Secure (3)

. to br
br to jus.br
jus.br to trt1.jus.br

Notices

Errors (11)

NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA: An iterations count of 0 must be used in NSEC3 records to alleviate computational burdens. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA: An iterations count of 0 must be used in NSEC3 records to alleviate computational burdens. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA: An iterations count of 0 must be used in NSEC3 records to alleviate computational burdens. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA: An iterations count of 0 must be used in NSEC3 records to alleviate computational burdens. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS: An iterations count of 0 must be used in NSEC3 records to alleviate computational burdens. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS: An iterations count of 0 must be used in NSEC3 records to alleviate computational burdens. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS: An iterations count of 0 must be used in NSEC3 records to alleviate computational burdens. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS: An iterations count of 0 must be used in NSEC3 records to alleviate computational burdens. See RFC 9276, Sec. 3.1.
trt1.jus.br/DNSKEY: The response (485 bytes) was malformed. (201.33.31.68, UDP_-_EDNS0_512_D_KN)
trt1.jus.br/DNSKEY: The response (512 bytes) was malformed. (177.38.99.133, UDP_-_EDNS0_512_D_KN)
trt1.jus.br/CNAME has errors; select the "Denial of existence" DNSSEC option to see them.

Warnings (42)

NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA: The salt value for an NSEC3 record should be empty. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA: The salt value for an NSEC3 record should be empty. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA: The salt value for an NSEC3 record should be empty. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA: The salt value for an NSEC3 record should be empty. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS: The salt value for an NSEC3 record should be empty. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS: The salt value for an NSEC3 record should be empty. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS: The salt value for an NSEC3 record should be empty. See RFC 9276, Sec. 3.1.
NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS: The salt value for an NSEC3 record should be empty. See RFC 9276, Sec. 3.1.
RRSIG NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA alg 7, id 3248: The value of the Signature Inception field of the RRSIG RR (2021-05-02 04:45:02+00:00) is within possible clock skew range (45 seconds) of the current time (2021-05-02 04:45:47+00:00). See RFC 4035, Sec. 5.3.1.
RRSIG NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA alg 7, id 3248: The value of the Signature Inception field of the RRSIG RR (2021-05-02 04:45:02+00:00) is within possible clock skew range (45 seconds) of the current time (2021-05-02 04:45:47+00:00). See RFC 4035, Sec. 5.3.1.
RRSIG NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA alg 7, id 3248: The value of the Signature Inception field of the RRSIG RR (2021-05-02 04:45:02+00:00) is within possible clock skew range (45 seconds) of the current time (2021-05-02 04:45:47+00:00). See RFC 4035, Sec. 5.3.1.
RRSIG NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA alg 7, id 3248: The value of the Signature Inception field of the RRSIG RR (2021-05-02 04:45:02+00:00) is within possible clock skew range (45 seconds) of the current time (2021-05-02 04:45:47+00:00). See RFC 4035, Sec. 5.3.1.
RRSIG NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA alg 7, id 3248: The value of the Signature Inception field of the RRSIG RR (2021-05-02 04:45:02+00:00) is within possible clock skew range (45 seconds) of the current time (2021-05-02 04:45:47+00:00). See RFC 4035, Sec. 5.3.1.
RRSIG NSEC3 proving non-existence of _25._tcp.mx1.trt1.jus.br/TLSA alg 7, id 3248: The value of the Signature Inception field of the RRSIG RR (2021-05-02 04:45:02+00:00) is within possible clock skew range (45 seconds) of the current time (2021-05-02 04:45:47+00:00). See RFC 4035, Sec. 5.3.1.
RRSIG NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS alg 7, id 3248: The value of the Signature Inception field of the RRSIG RR (2021-05-02 04:45:01+00:00) is within possible clock skew range (46 seconds) of the current time (2021-05-02 04:45:47+00:00). See RFC 4035, Sec. 5.3.1.
RRSIG NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS alg 7, id 3248: The value of the Signature Inception field of the RRSIG RR (2021-05-02 04:45:02+00:00) is within possible clock skew range (45 seconds) of the current time (2021-05-02 04:45:47+00:00). See RFC 4035, Sec. 5.3.1.
RRSIG NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS alg 7, id 3248: The value of the Signature Inception field of the RRSIG RR (2021-05-02 04:45:02+00:00) is within possible clock skew range (45 seconds) of the current time (2021-05-02 04:45:47+00:00). See RFC 4035, Sec. 5.3.1.
RRSIG NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS alg 7, id 3248: The value of the Signature Inception field of the RRSIG RR (2021-05-02 04:45:02+00:00) is within possible clock skew range (45 seconds) of the current time (2021-05-02 04:45:47+00:00). See RFC 4035, Sec. 5.3.1.
RRSIG NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS alg 7, id 3248: The value of the Signature Inception field of the RRSIG RR (2021-05-02 04:45:02+00:00) is within possible clock skew range (45 seconds) of the current time (2021-05-02 04:45:47+00:00). See RFC 4035, Sec. 5.3.1.
RRSIG NSEC3 proving non-existence of _tcp.mx1.trt1.jus.br/NS alg 7, id 3248: The value of the Signature Inception field of the RRSIG RR (2021-05-02 04:45:02+00:00) is within possible clock skew range (45 seconds) of the current time (2021-05-02 04:45:47+00:00). See RFC 4035, Sec. 5.3.1.
RRSIG mx1.trt1.jus.br/A alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG trt1.jus.br/DNSKEY alg 7, id 16125: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG trt1.jus.br/DNSKEY alg 7, id 16125: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG trt1.jus.br/DNSKEY alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG trt1.jus.br/DNSKEY alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG trt1.jus.br/SOA alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG trt1.jus.br/SOA alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG trt1.jus.br/SOA alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG trt1.jus.br/SOA alg 7, id 3248: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
trt1.jus.br/CNAME has warnings; select the "Denial of existence" DNSSEC option to see them.