dns-oarc.org

Updated: 2022-02-17 21:35:15 UTC (3 years ago) Go to most recent »

DNSSEC options (hide)

Notices

DNSSEC Authentication Chain

./DNSKEY (alg 8, id 20326)
./DNSKEY (alg 8, id 9799)
dns-oarc.org/DNSKEY (alg 13, id 49146)
dns-oarc.org/DNSKEY (alg 13, id 63976)
dns-oarc.org/DS (alg 13, id 49146)
dns-oarc.org/DS (alg 8, id 15559)
org/DNSKEY (alg 8, id 26974)
org/DNSKEY (alg 8, id 30573)
org/DNSKEY (alg 8, id 7986)
org/DS (alg 8, id 26974)

dns-oarc.org/DNSKEY (alg 13, id 49146): The DS RRset for the zone included algorithm 8 (RSASHA256), but no RRSIG with algorithm 8 covering the RRset was returned in the response. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (64.191.0.65, 77.72.225.243, 192.211.126.46, 204.69.234.1, 204.74.101.1, 2001:502:f3ff::d, 2604:1f80:5eb::46, 2610:a1:1014::d, 2620:ff:c000:0:1::65, 2a01:3f0:0:57::243, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)
dns-oarc.org/DNSKEY (alg 13, id 63976): The DS RRset for the zone included algorithm 8 (RSASHA256), but no RRSIG with algorithm 8 covering the RRset was returned in the response. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (64.191.0.65, 77.72.225.243, 192.211.126.46, 204.69.234.1, 204.74.101.1, 2001:502:f3ff::d, 2604:1f80:5eb::46, 2610:a1:1014::d, 2620:ff:c000:0:1::65, 2a01:3f0:0:57::243, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)
org to dns-oarc.org: The DS RRset for the zone included algorithm 8 (RSASHA256), but no DS RR matched a DNSKEY with algorithm 8 that signs the zone's DNSKEY RRset. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (64.191.0.65, 77.72.225.243, 192.211.126.46, 204.69.234.1, 204.74.101.1, 2001:502:f3ff::d, 2604:1f80:5eb::46, 2610:a1:1014::d, 2620:ff:c000:0:1::65, 2a01:3f0:0:57::243, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)
dns-oarc.org/DNSKEY has errors; select the "Denial of existence" DNSSEC option to see them.

dns-oarc.org/DS (alg 8, id 15559): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
dns-oarc.org/DS (alg 8, id 15559): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
dns-oarc.org/DS (alg 8, id 15559): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset. See RFC 4509, Sec. 3.
dns-oarc.org/DS (alg 8, id 15559): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset. See RFC 4509, Sec. 3.