icann.org

Updated: 2021-03-30 21:51:23 UTC (1287 days ago) Go to most recent »

DNSSEC options (hide)

|?| RR types:
|?| DNSSEC algorithms:
|?| DS digest algorithms:
|?| Denial of existence:
|?| Redundant edges:
|?| Ignore RFC 8624:
|?| Ignore RFC 9276:
|?| Multi-signer:
|?| Trust anchors:
- Root zone KSK
|?| Additional trusted keys:

Notices

DNSSEC Authentication Chain

RRset status

Secure (6)

icann.org/A
icann.org/AAAA
icann.org/MX
icann.org/NS
icann.org/SOA
icann.org/TXT

DNSKEY/DS/NSEC status

Secure (15)

./DNSKEY (alg 8, id 14631)
./DNSKEY (alg 8, id 20326)
./DNSKEY (alg 8, id 42351)
icann.org/DNSKEY (alg 7, id 18060)
icann.org/DNSKEY (alg 7, id 23584)
icann.org/DNSKEY (alg 7, id 30720)
icann.org/DNSKEY (alg 7, id 32969)
icann.org/DNSKEY (alg 7, id 54555)
icann.org/DS (alg 7, id 17248)
icann.org/DS (alg 7, id 18060)
icann.org/DS (alg 7, id 23584)
org/DNSKEY (alg 8, id 26974)
org/DNSKEY (alg 8, id 27558)
org/DNSKEY (alg 8, id 30453)
org/DS (alg 8, id 26974)

Non_existent (1)

icann.org/DNSKEY (alg 7, id 17248)

Delegation status

Secure (2)

. to org
org to icann.org

Notices

Errors (11)

icann.org zone: The server(s) responded over TCP with a malformed response or with an invalid RCODE. See RFC 1035, Sec. 4.1.1. (199.4.138.53)
icann.org zone: The server(s) were not responsive to queries over TCP. See RFC 1035, Sec. 4.2. (2001:500:89::53)
icann.org/A: No response was received from the server over UDP (tried 12 times). See RFC 1035, Sec. 4.2. (2001:500:8d::53, UDP_-_NOEDNS_)
icann.org/DNSKEY: No response was received from the server over UDP (tried 4 times). See RFC 1035, Sec. 4.2. (2001:500:8f::53, UDP_-_EDNS0_512_D_KN)
icann.org/MX: No response was received from the server over UDP (tried 13 times). See RFC 1035, Sec. 4.2. (199.4.138.53, UDP_-_EDNS0_4096_D)
icann.org/MX: No response was received from the server over UDP (tried 4 times). See RFC 1035, Sec. 4.2. (2001:500:8f::53, UDP_-_EDNS0_512_D_KN)
icann.org/SOA: No response was received from the server over TCP (tried 3 times). See RFC 1035, Sec. 4.2. (199.4.138.53, 2001:500:89::53, TCP_-_EDNS0_4096_D_N)
icann.org/SOA: No response was received from the server over UDP (tried 12 times). See RFC 1035, Sec. 4.2. (199.43.135.53, UDP_-_NOEDNS_)
icann.org/CNAME has errors; select the "Denial of existence" DNSSEC option to see them.
icann.org/DNSKEY has errors; select the "Denial of existence" DNSSEC option to see them.
qlveubamt9.icann.org/A has errors; select the "Denial of existence" DNSSEC option to see them.

Warnings (22)

RRSIG icann.org/A alg 7, id 30720: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/AAAA alg 7, id 30720: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/DNSKEY alg 7, id 18060: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/DNSKEY alg 7, id 18060: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/DNSKEY alg 7, id 18060: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/DNSKEY alg 7, id 18060: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/DNSKEY alg 7, id 18060: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/DNSKEY alg 7, id 23584: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/DNSKEY alg 7, id 23584: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/DNSKEY alg 7, id 23584: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/DNSKEY alg 7, id 23584: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/DNSKEY alg 7, id 23584: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/MX alg 7, id 30720: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/NS alg 7, id 30720: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/SOA alg 7, id 30720: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
RRSIG icann.org/TXT alg 7, id 30720: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
icann.org/A: No response was received until the UDP payload size was decreased, indicating that the server might be attempting to send a payload that exceeds the path maximum transmission unit (PMTU) size. See RFC 6891, Sec. 6.2.6. (199.43.135.53, UDP_-_EDNS0_4096_D_KN)
icann.org/MX: No response was received from the server over UDP (tried 7 times) until the NSID EDNS option was removed (however, this server appeared to respond legitimately to other queries with the NSID EDNS option present). See RFC 6891, Sec. 6.1.2. (199.43.133.53, 199.43.135.53, UDP_-_EDNS0_4096_D_KN)
icann.org/SOA: No response was received until the UDP payload size was decreased, indicating that the server might be attempting to send a payload that exceeds the path maximum transmission unit (PMTU) size. See RFC 6891, Sec. 6.2.6. (199.43.133.53, UDP_-_EDNS0_4096_D_KN)
icann.org/CNAME has warnings; select the "Denial of existence" DNSSEC option to see them.
icann.org/DNSKEY has warnings; select the "Denial of existence" DNSSEC option to see them.
qlveubamt9.icann.org/A has warnings; select the "Denial of existence" DNSSEC option to see them.