uscapitolpolice.gov | DNSViz

uscapitolpolice.gov

Updated: 2023-08-18 18:22:34 UTC (244 days ago) Update now

DNSSEC options (hide)

|?| RR types:
|?| DNSSEC algorithms:
|?| DS digest algorithms:
|?| Denial of existence:
|?| Redundant edges:
|?| Trust anchors:
- Root zone KSK
|?| Additional trusted keys:

Notices

DNSSEC Authentication Chain

RRset status

Bogus (2)

uscapitolpolice.gov/NS
uscapitolpolice.gov/SOA

DNSKEY/DS/NSEC status

Bogus (3)

uscapitolpolice.gov/DNSKEY (alg 8, id 15676)
uscapitolpolice.gov/DNSKEY (alg 8, id 44463)
uscapitolpolice.gov/DNSKEY (alg 8, id 45112)

Secure (6)

./DNSKEY (alg 8, id 11019)
./DNSKEY (alg 8, id 20326)
gov/DNSKEY (alg 8, id 40921)
gov/DNSKEY (alg 8, id 7698)
gov/DS (alg 8, id 7698)
uscapitolpolice.gov/DS (alg 8, id 16561)

Non_existent (1)

uscapitolpolice.gov/DNSKEY (alg 8, id 16561)

Delegation status

Bogus (1)

gov to uscapitolpolice.gov

Secure (1)

. to gov

Notices

Errors (2)

gov to uscapitolpolice.gov: No valid RRSIGs made by a key corresponding to a DS RR were found covering the DNSKEY RRset, resulting in no secure entry point (SEP) into the zone. (128.177.179.2, 192.42.110.2, TCP_-_EDNS0_4096_D_KN)
gov to uscapitolpolice.gov: The DS RRset for the zone included algorithm 8 (RSASHA256), but no DS RR matched a DNSKEY with algorithm 8 that signs the zone's DNSKEY RRset. (128.177.179.2, 192.42.110.2, TCP_-_EDNS0_4096_D_KN)

DNSKEY legend

Full legend

	SEP bit set
	Revoke bit set
	Trust anchor

See also

DNSSEC Debugger by Verisign Labs.

Download: png | svg

Warning

JavaScript is required to make the graph below interactive.

DNSSEC authentication graph