pms.psc.gov

Updated: 2021-12-28 18:38:02 UTC (843 days ago) Go to most recent »

DNSSEC options (hide)

|?| RR types:
|?| DNSSEC algorithms:
|?| DS digest algorithms:
|?| Denial of existence:
|?| Redundant edges:
|?| Trust anchors:
- Root zone KSK
|?| Additional trusted keys:

Notices

DNSSEC Authentication Chain

RRset status

Secure (2)

pms.ha.psc.gov/A
pms.psc.gov/CNAME

DNSKEY/DS/NSEC status

Secure (18)

./DNSKEY (alg 8, id 14748)
./DNSKEY (alg 8, id 20326)
./DNSKEY (alg 8, id 9799)
gov/DNSKEY (alg 8, id 6229)
gov/DNSKEY (alg 8, id 7698)
gov/DS (alg 8, id 7698)
ha.psc.gov/DNSKEY (alg 7, id 19809)
ha.psc.gov/DNSKEY (alg 7, id 54488)
ha.psc.gov/DNSKEY (alg 7, id 59222)
ha.psc.gov/DS (alg 7, id 19809)
psc.gov/DNSKEY (alg 8, id 36437)
psc.gov/DNSKEY (alg 8, id 36898)
psc.gov/DNSKEY (alg 8, id 54376)
psc.gov/DNSKEY (alg 8, id 55588)
psc.gov/DS (alg 8, id 36437)
psc.gov/DS (alg 8, id 36437)
psc.gov/DS (alg 8, id 54376)
psc.gov/DS (alg 8, id 54376)

Delegation status

Secure (3)

. to gov
gov to psc.gov
psc.gov to ha.psc.gov

Notices

Errors (6)

ha.psc.gov/DNSKEY (alg 7, id 19809): The DNSKEY RR was not found in the DNSKEY RRset returned by one or more servers. (165.112.13.50, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)
ha.psc.gov/DNSKEY (alg 7, id 54488): The DNSKEY RR was not found in the DNSKEY RRset returned by one or more servers. (165.112.13.50, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)
ha.psc.gov/DNSKEY (alg 7, id 59222): The DNSKEY RR was not found in the DNSKEY RRset returned by one or more servers. (165.112.13.50, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)
pms.ha.psc.gov/A: No RRSIG covering the RRset was returned in the response. (165.112.13.50, UDP_-_EDNS0_4096_D_KN)
psc.gov to ha.psc.gov: No valid RRSIGs made by a key corresponding to a DS RR were found covering the DNSKEY RRset, resulting in no secure entry point (SEP) into the zone. (165.112.13.50, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)
psc.gov to ha.psc.gov: The DS RRset for the zone included algorithm 7 (RSASHA1NSEC3SHA1), but no DS RR matched a DNSKEY with algorithm 7 that signs the zone's DNSKEY RRset. (165.112.13.50, UDP_-_EDNS0_4096_D_KN, UDP_-_EDNS0_512_D_KN)

Warnings (22)

RRSIG ha.psc.gov/DNSKEY alg 7, id 19809: DNSSEC specification recommends not signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1).
RRSIG ha.psc.gov/DNSKEY alg 7, id 19809: DNSSEC specification recommends not signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1).
RRSIG ha.psc.gov/DNSKEY alg 7, id 19809: DNSSEC specification recommends not signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1).
RRSIG ha.psc.gov/DNSKEY alg 7, id 54488: DNSSEC specification recommends not signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1).
RRSIG ha.psc.gov/DNSKEY alg 7, id 54488: DNSSEC specification recommends not signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1).
RRSIG ha.psc.gov/DNSKEY alg 7, id 54488: DNSSEC specification recommends not signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1).
RRSIG ha.psc.gov/DNSKEY alg 7, id 59222: DNSSEC specification recommends not signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1).
RRSIG ha.psc.gov/DNSKEY alg 7, id 59222: DNSSEC specification recommends not signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1).
RRSIG ha.psc.gov/DNSKEY alg 7, id 59222: DNSSEC specification recommends not signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1).
RRSIG pms.ha.psc.gov/A alg 7, id 54488: DNSSEC specification recommends not signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1).
RRSIG pms.ha.psc.gov/A alg 7, id 59222: DNSSEC specification recommends not signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1).
ha.psc.gov/DS (alg 7, id 19809): DNSSEC specification prohibits signing with DS records that use digest algorithm 1 (SHA-1).
ha.psc.gov/DS (alg 7, id 19809): DNSSEC specification prohibits signing with DS records that use digest algorithm 1 (SHA-1).
psc.gov to ha.psc.gov: The following NS name(s) were found in the delegation NS RRset (i.e., in the psc.gov zone), but not in the authoritative NS RRset: ns2.ha.nih.gov
psc.gov/DS (alg 8, id 36437): DNSSEC specification prohibits signing with DS records that use digest algorithm 1 (SHA-1).
psc.gov/DS (alg 8, id 36437): DNSSEC specification prohibits signing with DS records that use digest algorithm 1 (SHA-1).
psc.gov/DS (alg 8, id 36437): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset.
psc.gov/DS (alg 8, id 36437): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset.
psc.gov/DS (alg 8, id 54376): DNSSEC specification prohibits signing with DS records that use digest algorithm 1 (SHA-1).
psc.gov/DS (alg 8, id 54376): DNSSEC specification prohibits signing with DS records that use digest algorithm 1 (SHA-1).
psc.gov/DS (alg 8, id 54376): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset.
psc.gov/DS (alg 8, id 54376): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset.