⚠️ Caution: This is an early demo of our test updates for NCSC's 2025 TLS guidelines, to allow you to test against the new guidelines.

Some explanation text is still missing, out of date, or in rough draft state. Test evaluations may still change.
This URL is an active development environment and has limited availability - it may be down for hours or days.

Tests from this instance originate from different IPs than those used in production. If you use allowlisting on our production IPs, results may vary, particularly for email TLS. To include this instance, allowlist 62.204.66.0/26 and 2a00:d00:ff:162::/64.

Domeinnaamhandtekening (DNSSEC)

Waarom

Hieronder vindt je enkele links naar beschrijvingen van enkele bekende incidenten die DNSSEC waarschijnlijk had kunnen voorkomen.

Hieronder volgt een citaat uit de laatstgenoemde onderzoekspublicatie:

Mail security, like that of many other protocols, is intrinsically tangled with the security of DNS resolution. Rather than target the SMTP protocol, an active network attacker can spoof the DNS records of a destination mail server to redirect SMTP connections to a server under the attacker’s control. [...] We find evidence that 178,439 out of 8,860,639(2.01%) publicly accessible DNS servers provided invalid IPs or MX records for one or more of these domains.

Gebruiksstatistieken

Achtergrondinformatie

Specificaties