View on GitHub

DNSViz: A DNS visualization tool

gov.ie

DNSSEC options (hide)
  1. |?|
  2. |?|
  3. |?|
  4. |?|
  5. |?|
  6. |?|
  7. |?|
  8. |?|
  9. |?|
  10. |?|
Notices
DNSSEC Authentication Chain

RRset statusRRset status

Insecure (6)
  • gov.ie/A
  • gov.ie/AAAA
  • gov.ie/MX
  • gov.ie/NS
  • gov.ie/SOA
  • gov.ie/TXT
Secure (1)
  • ie/SOA

DNSKEY/DS/NSEC statusDNSKEY/DS/NSEC status

Secure (7)
  • ./DNSKEY (alg 8, id 20326)
  • ./DNSKEY (alg 8, id 26116)
  • NSEC3 proving non-existence of gov.ie/DS
  • ie/DNSKEY (alg 13, id 10580)
  • ie/DNSKEY (alg 13, id 15040)
  • ie/DS (alg 13, id 15040)
  • ie/DS (alg 8, id 16976)
Non_existent (1)
  • ie/DNSKEY (alg 8, id 16976)

Delegation statusDelegation status

Insecure (1)
  • ie to gov.ie
Secure (1)
  • . to ie

NoticesNotices

Errors (12)
  • . to ie: The DS RRset for the zone included algorithm 8 (RSASHA256), but no DS RR matched a DNSKEY with algorithm 8 that signs the zone's DNSKEY RRset. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (77.72.72.34, 77.72.229.245, 192.93.0.4, 192.111.39.100, 194.0.25.35, 194.146.106.98, 2001:660:3005:1::1:2, 2001:678:20::35, 2001:67c:1010:25::53, 2001:7c8:2:a::64, 2a01:3f0:0:309::53, 2a01:4b0::2, UDP_-_EDNS0_4096_D_K, UDP_-_EDNS0_512_D_K)
  • NSEC3 proving non-existence of gov.ie/DS: An iterations count of 0 must be used in NSEC3 records to alleviate computational burdens. See RFC 9276, Sec. 3.1.
  • NSEC3 proving non-existence of gov.ie/DS: An iterations count of 0 must be used in NSEC3 records to alleviate computational burdens. See RFC 9276, Sec. 3.1.
  • NSEC3 proving non-existence of gov.ie/DS: The DS RRset for the zone included algorithm 8 (RSASHA256), but no RRSIG with algorithm 8 covering the RRset was returned in the response. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (77.72.72.34, 77.72.229.245, 192.93.0.4, 192.111.39.100, 194.0.25.35, 194.146.106.98, 2001:660:3005:1::1:2, 2001:678:20::35, 2001:67c:1010:25::53, 2001:7c8:2:a::64, 2a01:3f0:0:309::53, 2a01:4b0::2, UDP_-_EDNS0_4096_D_K)
  • NSEC3 proving non-existence of gov.ie/DS: The DS RRset for the zone included algorithm 8 (RSASHA256), but no RRSIG with algorithm 8 covering the RRset was returned in the response. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (77.72.72.34, 77.72.229.245, 192.93.0.4, 192.111.39.100, 194.0.25.35, 194.146.106.98, 2001:660:3005:1::1:2, 2001:678:20::35, 2001:67c:1010:25::53, 2001:7c8:2:a::64, 2a01:3f0:0:309::53, 2a01:4b0::2, UDP_-_EDNS0_4096_D_K)
  • gov.ie zone: The server(s) were not responsive to queries over UDP. See RFC 1035, Sec. 4.2. (2a01:88:8fff:ffed::140, 2a01:88:8fff:ffee::10)
  • gov.ie/A: No response was received from the server over UDP (tried 12 times). See RFC 1035, Sec. 4.2. (2a01:88:8fff:ffed::140, 2a01:88:8fff:ffee::10, UDP_-_NOEDNS_)
  • gov.ie/NS: No response was received from the server over UDP (tried 12 times). See RFC 1035, Sec. 4.2. (2a01:88:8fff:ffed::140, 2a01:88:8fff:ffee::10, UDP_-_NOEDNS_)
  • ie/DNSKEY (alg 13, id 10580): The DS RRset for the zone included algorithm 8 (RSASHA256), but no RRSIG with algorithm 8 covering the RRset was returned in the response. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (77.72.72.34, 77.72.229.245, 192.93.0.4, 192.111.39.100, 194.0.25.35, 194.146.106.98, 2001:660:3005:1::1:2, 2001:678:20::35, 2001:67c:1010:25::53, 2001:7c8:2:a::64, 2a01:3f0:0:309::53, 2a01:4b0::2, UDP_-_EDNS0_4096_D_K, UDP_-_EDNS0_512_D_K)
  • ie/DNSKEY (alg 13, id 15040): The DS RRset for the zone included algorithm 8 (RSASHA256), but no RRSIG with algorithm 8 covering the RRset was returned in the response. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (77.72.72.34, 77.72.229.245, 192.93.0.4, 192.111.39.100, 194.0.25.35, 194.146.106.98, 2001:660:3005:1::1:2, 2001:678:20::35, 2001:67c:1010:25::53, 2001:7c8:2:a::64, 2a01:3f0:0:309::53, 2a01:4b0::2, UDP_-_EDNS0_4096_D_K, UDP_-_EDNS0_512_D_K)
  • ie/SOA: The DS RRset for the zone included algorithm 8 (RSASHA256), but no RRSIG with algorithm 8 covering the RRset was returned in the response. See RFC 4035, Sec. 2.2, RFC 6840, Sec. 5.11. (77.72.72.34, 77.72.229.245, 192.93.0.4, 192.111.39.100, 194.0.25.35, 194.146.106.98, 2001:660:3005:1::1:2, 2001:678:20::35, 2001:67c:1010:25::53, 2001:7c8:2:a::64, 2a01:3f0:0:309::53, 2a01:4b0::2, UDP_-_EDNS0_4096_D_K)
  • gov.ie/DS has errors; select the "Denial of existence" DNSSEC option to see them.
Warnings (6)
  • NSEC3 proving non-existence of gov.ie/DS: The salt value for an NSEC3 record should be empty. See RFC 9276, Sec. 3.1.
  • NSEC3 proving non-existence of gov.ie/DS: The salt value for an NSEC3 record should be empty. See RFC 9276, Sec. 3.1.
  • ie to gov.ie: Authoritative AAAA records exist for cwext.gn.gov.ie, but there are no corresponding AAAA glue records. See RFC 1034, Sec. 4.2.2.
  • ie to gov.ie: Authoritative AAAA records exist for ext3.gn.gov.ie, but there are no corresponding AAAA glue records. See RFC 1034, Sec. 4.2.2.
  • ie to gov.ie: Authoritative AAAA records exist for gbext.gn.gov.ie, but there are no corresponding AAAA glue records. See RFC 1034, Sec. 4.2.2.
  • gov.ie/DS has warnings; select the "Denial of existence" DNSSEC option to see them.

DNSKEY legend

Full legend
SEP bit setSEP bit set
Revoke bit setRevoke bit set
Trust anchorTrust anchor
Download: png | svg
Warning JavaScript is required to make the graph below interactive.
DNSSEC authentication graph