I've checked, it's definitely signed:
; <<>> DiG 9.11.0-P1 <<>> ed25519.nl +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 594
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 512
;; QUESTION SECTION:
;ed25519.nl. IN A
;; ANSWER SECTION:
ed25519.nl. 1341 IN RRSIG A 15 2 3600 20171012000000 20170921000000 27662 ed25519.nl. Z62ywpWQ4ahOs0DZxIs3OAY67qc226z6rs8k8q2i/hdwQAjz5EL5ZJke t25LD88wx5kGY5ru6Dvfrd7KvODCAg==
ed25519.nl. 1341 IN A 77.72.150.82
;; Query time: 55 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Wed Sep 27 20:44:46 EDT 2017The zone may be signed locally, but the DS records for ed25519.nl haven’t (when I checked myself just now) yet been exported into the TLD zone. It’s basically equivalent to a self-signed certificate. The lack of DS records in the TLD zone is the reason why WHOIS says "DNSSEC: no".
"This domainname, is DNSSEC signed with this algorithm."
Yet:
dana@araman:~$ whois ed25519.nl
Domain name: ed25519.nl
Status: active
Registrar: TransIP BV Schipholweg 9b 2316XB LEIDEN Netherlands
Abuse Contact:
DNSSEC: no
Domain nameservers: mango.plexis.eu pdns-public-ns1.powerdns.com pdns-public-ns2.powerdns.com
Record maintained by: NL Domain Registry
...
I'm inclined to believe the claims of the web site without checking. It's just interesting that:
1. The whois data for .nl is taking some interest in DNSSEC
2. That they are wrong about it being DNSSEC signed.
My (weak) guess is that whatever they are using to get the DNSSEC information doesn't understand Ed25519.