View on GitHub

DNSViz: A DNS visualization tool

hlaor.realtor

Recursive analysis
Updated (recursive): 2025-12-03 01:21:01 UTC (8 days ago) Go to delegated analysis »
DNSSEC options (hide)
  1. |?|
  2. |?|
  3. |?|
  4. |?|
  5. |?|
  6. |?|
  7. |?|
  8. |?|
  9. |?|
  10. |?|
Notices
DNSSEC Authentication Chain

RRset statusRRset status

Insecure (5)
  • hlaor.realtor/A
  • hlaor.realtor/MX
  • hlaor.realtor/NS
  • hlaor.realtor/SOA
  • hlaor.realtor/TXT
Secure (1)
  • realtor/SOA

DNSKEY/DS/NSEC statusDNSKEY/DS/NSEC status

Secure (7)
  • ./DNSKEY (alg 8, id 20326)
  • ./DNSKEY (alg 8, id 38696)
  • ./DNSKEY (alg 8, id 61809)
  • NSEC3 proving non-existence of hlaor.realtor/DS
  • realtor/DNSKEY (alg 8, id 15827)
  • realtor/DNSKEY (alg 8, id 29275)
  • realtor/DS (alg 8, id 15827)

Delegation statusDelegation status

Insecure (1)
  • realtor to hlaor.realtor
Secure (1)
  • . to realtor

NoticesNotices

Errors (4)
  • realtor to hlaor.realtor: DNSSEC was effectively downgraded because the response had an invalid RCODE (SERVFAIL) with EDNS enabled. See RFC 6891, Sec. 7, RFC 2671, Sec. 5.3. (208.67.220.2, 208.67.222.2, 2620:0:ccc::2, 2620:0:ccd::2, UDP_+C_EDNS0_4096_D_KN)
  • realtor to hlaor.realtor: The NODATA response did not include an SOA record. See RFC 1034, Sec. 4.3.4, RFC 2308, Sec. 2.2. (208.67.220.2, 2620:0:ccc::2, 2620:0:ccd::2, UDP_+C_EDNS0_4096_D_KN)
  • realtor to hlaor.realtor: The response had an invalid RCODE (SERVFAIL) until the CD flag was set (however, this server appeared to respond legitimately to other queries with the CD flag cleared). See RFC 1035, Sec. 4.1.1. (208.67.220.2, 208.67.222.2, 2620:0:ccc::2, 2620:0:ccd::2, UDP_+_EDNS0_4096_D_KN)
  • hlaor.realtor/DS has errors; select the "Denial of existence" DNSSEC option to see them.
Warnings (10)
  • hlaor.realtor/A: The response had an invalid RCODE (SERVFAIL) until the CD flag was set. See RFC 1035, Sec. 4.1.1. (208.67.220.2, 208.67.222.2, 2620:0:ccc::2, 2620:0:ccd::2, UDP_+_EDNS0_4096_D_KN)
  • hlaor.realtor/MX: The response had an invalid RCODE (SERVFAIL) until the CD flag was set. See RFC 1035, Sec. 4.1.1. (208.67.220.2, 208.67.222.2, 2620:0:ccc::2, 2620:0:ccd::2, UDP_+_EDNS0_4096_D_KN, UDP_+_EDNS0_512_D_KN)
  • hlaor.realtor/NS: The response had an invalid RCODE (SERVFAIL) until the CD flag was set. See RFC 1035, Sec. 4.1.1. (208.67.220.2, 208.67.222.2, 2620:0:ccc::2, 2620:0:ccd::2, UDP_+_EDNS0_4096_D_KN)
  • hlaor.realtor/SOA: The response had an invalid RCODE (SERVFAIL) until the CD flag was set. See RFC 1035, Sec. 4.1.1. (208.67.220.2, 208.67.222.2, 2620:0:ccc::2, 2620:0:ccd::2, TCP_+_EDNS0_4096_D_N)
  • hlaor.realtor/SOA: The response had an invalid RCODE (SERVFAIL) until the CD flag was set. See RFC 1035, Sec. 4.1.1. (208.67.220.2, 208.67.222.2, 2620:0:ccc::2, 2620:0:ccd::2, UDP_+_EDNS0_4096_D_KN, UDP_+_EDNS0_4096_D_KN_0x20)
  • hlaor.realtor/TXT: The response had an invalid RCODE (SERVFAIL) until the CD flag was set. See RFC 1035, Sec. 4.1.1. (208.67.220.2, 208.67.222.2, 2620:0:ccc::2, 2620:0:ccd::2, UDP_+_EDNS0_4096_D_KN)
  • hlaor.realtor/AAAA has warnings; select the "Denial of existence" DNSSEC option to see them.
  • q1208.ga3mk.hlaor.realtor/A has warnings; select the "Denial of existence" DNSSEC option to see them.
  • hlaor.realtor/DNSKEY has warnings; select the "Denial of existence" DNSSEC option to see them.
  • hlaor.realtor/CNAME has warnings; select the "Denial of existence" DNSSEC option to see them.

DNSKEY legend

Full legend
SEP bit setSEP bit set
Revoke bit setRevoke bit set
Trust anchorTrust anchor
Download: png | svg
Warning JavaScript is required to make the graph below interactive.
DNSSEC authentication graph