View on GitHub

DNSViz: A DNS visualization tool

wiki.mozilla.org

« Previous analysis | Next analysis »
DNSSEC options (hide)
  1. |?|
  2. |?|
  3. |?|
  4. |?|
  5. |?|
  6. |?|
  7. |?|
  8. |?|
  9. |?|
  10. |?|
Notices
DNSSEC Authentication Chain

RRset statusRRset status

Insecure (2)
  • amazonaws.com/SOA
  • wiki-prod-1394614349.us-west-2.elb.amazonaws.com/A
Secure (3)
  • com/SOA
  • com/SOA
  • wiki.mozilla.org/CNAME

DNSKEY/DS/NSEC statusDNSKEY/DS/NSEC status

Secure (16)
  • ./DNSKEY (alg 8, id 20326)
  • ./DNSKEY (alg 8, id 48903)
  • NSEC3 proving non-existence of amazonaws.com/DS
  • com/DNSKEY (alg 8, id 30909)
  • com/DNSKEY (alg 8, id 39844)
  • com/DS (alg 8, id 30909)
  • mozilla.org/DNSKEY (alg 7, id 12389)
  • mozilla.org/DNSKEY (alg 7, id 44421)
  • mozilla.org/DNSKEY (alg 7, id 48359)
  • mozilla.org/DNSKEY (alg 7, id 65337)
  • mozilla.org/DS (alg 7, id 44421)
  • org/DNSKEY (alg 7, id 17883)
  • org/DNSKEY (alg 7, id 27353)
  • org/DNSKEY (alg 7, id 62165)
  • org/DS (alg 7, id 17883)
  • org/DS (alg 7, id 17883)

Delegation statusDelegation status

Insecure (2)
  • amazonaws.com to us-west-2.elb.amazonaws.com
  • com to amazonaws.com
Secure (3)
  • . to com
  • . to org
  • org to mozilla.org

NoticesNotices

Errors (1)
  • mozilla.org/CNAME has errors; select the "Denial of existence" DNSSEC option to see them.
Warnings (25)
  • RRSIG mozilla.org/DNSKEY alg 7, id 44421: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG mozilla.org/DNSKEY alg 7, id 44421: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG mozilla.org/DNSKEY alg 7, id 44421: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG mozilla.org/DNSKEY alg 7, id 44421: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG mozilla.org/DNSKEY alg 7, id 65337: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG mozilla.org/DNSKEY alg 7, id 65337: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG mozilla.org/DNSKEY alg 7, id 65337: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG mozilla.org/DNSKEY alg 7, id 65337: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG mozilla.org/DS alg 7, id 62165: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG org/DNSKEY alg 7, id 17883: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG org/DNSKEY alg 7, id 17883: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG org/DNSKEY alg 7, id 17883: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG org/DNSKEY alg 7, id 62165: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG org/DNSKEY alg 7, id 62165: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG org/DNSKEY alg 7, id 62165: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • RRSIG wiki.mozilla.org/CNAME alg 7, id 48359: DNSSEC implementers are recommended against implementing signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1). See RFC 8624, Sec. 3.1.
  • amazonaws.com to us-west-2.elb.amazonaws.com: The server(s) for the parent zone (amazonaws.com) responded with a referral instead of answering authoritatively for the DS RR type. See RFC 4034, Sec. 5. (205.251.192.27, 205.251.195.199, 2600:9000:5300:1b00::1, 2600:9000:5303:c700::1, UDP_-_EDNS0_4096_D_K)
  • mozilla.org/DS (alg 7, id 44421): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
  • mozilla.org/DS (alg 7, id 44421): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
  • org/DS (alg 7, id 17883): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
  • org/DS (alg 7, id 17883): DNSSEC implementers are prohibited from implementing signing with DS algorithm 1 (SHA-1). See RFC 8624, Sec. 3.2.
  • org/DS (alg 7, id 17883): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset. See RFC 4509, Sec. 3.
  • org/DS (alg 7, id 17883): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset. See RFC 4509, Sec. 3.
  • wiki.mozilla.org/AAAA has warnings; select the "Denial of existence" DNSSEC option to see them.
  • mozilla.org/CNAME has warnings; select the "Denial of existence" DNSSEC option to see them.

DNSKEY legend

Full legend
SEP bit setSEP bit set
Revoke bit setRevoke bit set
Trust anchorTrust anchor
Download: png | svg
Warning JavaScript is required to make the graph below interactive.
DNSSEC authentication graph