DNSSEC Debugger

Domain Name:

Time: 2026-01-18 19:44:03 UTC

Analyzing DNSSEC problems for 7.zip

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to i.root-servers.net for ./DNSKEY
	Received 1141 bytes from 192.36.148.17
	;; Response received from [192.36.148.17] 1141 octets ;; HEADER SECTION ;; id = 61869 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN DNSKEY ( 256 3 8 AwEAAbNTVC2+pry4pc37pZI9Oj6b8FHxT3VGrvSPKLE1Tjyfe2kUZUtVX5xrv6AV4BVO+ygrYjGZ MNgEnbLU4zknnlnhI2e0g6iTza1aZh0dRZXGH16C1NUNq1CxBkUhIYQhQDeIOtLacx+RmFTc+hSH JJ2MJ79IS00kA7eKi6mofQ7SPJmdJVjI+JAx791y0f5QaB+iHGANU53FwiYXNUQjfAzCrtOaSevG sx8SO8BTaXLAjFq5eewOtwScVwfVDhEXlvpE6e+mIncwhNKaMRD9IPuHENqCNPI5MjxfAMVS6cEY 8eEozIkv/vHc+0Auu3n+Fcx6F2Js4KPXaHEShAXugfU= ) ; keytag 21831 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20260201000000 20260111000000 20326 . o5fb3sEBXqMp65iz/RYeHunfketTsbyKhRLUWAiB6chftQ2eNH4VI00qEw67TN2CdVW/V5TCrYSg aGS0iGFHQO230lhtKq11eAD2LYTkDLvVDVejbxNz9maZy98L2xhLvkE2L2Aaz+GgqjHy9VEb6nc+ mtfCNpr2H0/Yet6Mgie6pTOCXE++1tf4g8NWsEx0nE41pwURB7UbC9ssYdsgnYqaTzUwRVxbij99 BCxIDKoEnwNCQBJFqSkr7AKzEtuu8F1ktgFIMcgkWnRAnNFLtLrG8gOoJw8PfpDoFI/Qc0RJddKB /s4akfSood+kpPKR4HNossFw5UTQuDuarMGxuA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbNTVC2+pry4pc37pZI9Oj6b8FHxT3VGrvSPKLE1Tjyfe2kUZUtVX5xrv6AV4BVO+ygrYjGZ MNgEnbLU4zknnlnhI2e0g6iTza1aZh0dRZXGH16C1NUNq1CxBkUhIYQhQDeIOtLacx+RmFTc+hSH JJ2MJ79IS00kA7eKi6mofQ7SPJmdJVjI+JAx791y0f5QaB+iHGANU53FwiYXNUQjfAzCrtOaSevG sx8SO8BTaXLAjFq5eewOtwScVwfVDhEXlvpE6e+mIncwhNKaMRD9IPuHENqCNPI5MjxfAMVS6cEY 8eEozIkv/vHc+0Auu3n+Fcx6F2Js4KPXaHEShAXugfU= ) ; keytag 21831`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20260201000000 20260111000000 20326 . o5fb3sEBXqMp65iz/RYeHunfketTsbyKhRLUWAiB6chftQ2eNH4VI00qEw67TN2CdVW/V5TCrYSg aGS0iGFHQO230lhtKq11eAD2LYTkDLvVDVejbxNz9maZy98L2xhLvkE2L2Aaz+GgqjHy9VEb6nc+ mtfCNpr2H0/Yet6Mgie6pTOCXE++1tf4g8NWsEx0nE41pwURB7UbC9ssYdsgnYqaTzUwRVxbij99 BCxIDKoEnwNCQBJFqSkr7AKzEtuu8F1ktgFIMcgkWnRAnNFLtLrG8gOoJw8PfpDoFI/Qc0RJddKB /s4akfSood+kpPKR4HNossFw5UTQuDuarMGxuA== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=38696/SEP is now in the chain-of-trust
	DNSKEY=21831 is now in the chain-of-trust
	Query to j.root-servers.net for 7.zip/A
	Received 725 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 725 octets ;; HEADER SECTION ;; id = 32168 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 11 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; 7.zip. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) zip. 172800 IN NS ns-tld1.charlestonroadregistry.com. zip. 172800 IN NS ns-tld2.charlestonroadregistry.com. zip. 172800 IN NS ns-tld3.charlestonroadregistry.com. zip. 172800 IN NS ns-tld4.charlestonroadregistry.com. zip. 172800 IN NS ns-tld5.charlestonroadregistry.com. zip. 86400 IN DS ( 37525 8 2 32eb9249d844b8593cf81fa5e2cec76cfcc536c249e116ea9b49269ac8f239ce ) zip. 86400 IN RRSIG ( DS 8 1 86400 20260131170000 20260118160000 21831 . hwiTveXvhu2ixsWtm7ZHh16DBuZ0AbCwoQuc9MPFpD3r6zvVb1e4RfM3tYBH1x6sFtQLepyca3xc J0QRqD8ZQlUT1NRo8S7ZyXWmcsHiRik312mkpltRAUDOFvcucC5Z+KWE7oBIKlHwcV3hRdAMjcOF VuNLh7gvscPQWW67QnAwWjDdGyLxrBcs692Mp+Vj8doVaM0JwLQYwBGcQYJa+oDDn/or4YY74e7y hTjdqryTCPEOmHmjIq61oL5xYBj/SzEMRaxJZX0TAX7cdzTk02l4NOXWVV2HPvp3uoYX2LFWKb4y fEOGRGq+SpV8Vnuwmjn7Z/MkkYyJtUOFdK5NcQ== ) ;; ADDITIONAL SECTION (11 records) ns-tld1.charlestonroadregistry.com. 172800 IN A 216.239.32.105 ns-tld2.charlestonroadregistry.com. 172800 IN A 216.239.34.105 ns-tld3.charlestonroadregistry.com. 172800 IN A 216.239.36.105 ns-tld4.charlestonroadregistry.com. 172800 IN A 216.239.38.105 ns-tld5.charlestonroadregistry.com. 172800 IN A 216.239.60.105 ns-tld1.charlestonroadregistry.com. 172800 IN AAAA 2001:4860:4802:32::69 ns-tld2.charlestonroadregistry.com. 172800 IN AAAA 2001:4860:4802:34::69 ns-tld3.charlestonroadregistry.com. 172800 IN AAAA 2001:4860:4802:36::69 ns-tld4.charlestonroadregistry.com. 172800 IN AAAA 2001:4860:4802:38::69 ns-tld5.charlestonroadregistry.com. 172800 IN AAAA 2001:4860:4805::69 ;; { "EDNS-VERSION": 0 }
	Query to d.root-servers.net for zip/DNSKEY
	Received 723 bytes from 199.7.91.13
	;; Response received from [199.7.91.13] 723 octets ;; HEADER SECTION ;; id = 48952 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 11 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1450, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; zip. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) zip. 172800 IN NS ns-tld1.charlestonroadregistry.com. zip. 172800 IN NS ns-tld2.charlestonroadregistry.com. zip. 172800 IN NS ns-tld3.charlestonroadregistry.com. zip. 172800 IN NS ns-tld4.charlestonroadregistry.com. zip. 172800 IN NS ns-tld5.charlestonroadregistry.com. zip. 86400 IN DS ( 37525 8 2 32eb9249d844b8593cf81fa5e2cec76cfcc536c249e116ea9b49269ac8f239ce ) zip. 86400 IN RRSIG ( DS 8 1 86400 20260131170000 20260118160000 21831 . hwiTveXvhu2ixsWtm7ZHh16DBuZ0AbCwoQuc9MPFpD3r6zvVb1e4RfM3tYBH1x6sFtQLepyca3xc J0QRqD8ZQlUT1NRo8S7ZyXWmcsHiRik312mkpltRAUDOFvcucC5Z+KWE7oBIKlHwcV3hRdAMjcOF VuNLh7gvscPQWW67QnAwWjDdGyLxrBcs692Mp+Vj8doVaM0JwLQYwBGcQYJa+oDDn/or4YY74e7y hTjdqryTCPEOmHmjIq61oL5xYBj/SzEMRaxJZX0TAX7cdzTk02l4NOXWVV2HPvp3uoYX2LFWKb4y fEOGRGq+SpV8Vnuwmjn7Z/MkkYyJtUOFdK5NcQ== ) ;; ADDITIONAL SECTION (11 records) ns-tld1.charlestonroadregistry.com. 172800 IN A 216.239.32.105 ns-tld2.charlestonroadregistry.com. 172800 IN A 216.239.34.105 ns-tld3.charlestonroadregistry.com. 172800 IN A 216.239.36.105 ns-tld4.charlestonroadregistry.com. 172800 IN A 216.239.38.105 ns-tld5.charlestonroadregistry.com. 172800 IN A 216.239.60.105 ns-tld1.charlestonroadregistry.com. 172800 IN AAAA 2001:4860:4802:32::69 ns-tld2.charlestonroadregistry.com. 172800 IN AAAA 2001:4860:4802:34::69 ns-tld3.charlestonroadregistry.com. 172800 IN AAAA 2001:4860:4802:36::69 ns-tld4.charlestonroadregistry.com. 172800 IN AAAA 2001:4860:4802:38::69 ns-tld5.charlestonroadregistry.com. 172800 IN AAAA 2001:4860:4805::69 ;; { "EDNS-VERSION": 0 }
	Found child zone zip

zip

	Checking DS between . and zip
	Query to f.root-servers.net for zip/DS
	Received 367 bytes from 192.5.5.241
	;; Response received from [192.5.5.241] 367 octets ;; HEADER SECTION ;; id = 9669 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; zip. IN DS ;; ANSWER SECTION (2 records) zip. 86400 IN DS ( 37525 8 2 32eb9249d844b8593cf81fa5e2cec76cfcc536c249e116ea9b49269ac8f239ce ) zip. 86400 IN RRSIG ( DS 8 1 86400 20260131170000 20260118160000 21831 . hwiTveXvhu2ixsWtm7ZHh16DBuZ0AbCwoQuc9MPFpD3r6zvVb1e4RfM3tYBH1x6sFtQLepyca3xc J0QRqD8ZQlUT1NRo8S7ZyXWmcsHiRik312mkpltRAUDOFvcucC5Z+KWE7oBIKlHwcV3hRdAMjcOF VuNLh7gvscPQWW67QnAwWjDdGyLxrBcs692Mp+Vj8doVaM0JwLQYwBGcQYJa+oDDn/or4YY74e7y hTjdqryTCPEOmHmjIq61oL5xYBj/SzEMRaxJZX0TAX7cdzTk02l4NOXWVV2HPvp3uoYX2LFWKb4y fEOGRGq+SpV8Vnuwmjn7Z/MkkYyJtUOFdK5NcQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for zip in the . zone
	DS=37525/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`zip. 86400 IN RRSIG ( DS 8 1 86400 20260131170000 20260118160000 21831 . hwiTveXvhu2ixsWtm7ZHh16DBuZ0AbCwoQuc9MPFpD3r6zvVb1e4RfM3tYBH1x6sFtQLepyca3xc J0QRqD8ZQlUT1NRo8S7ZyXWmcsHiRik312mkpltRAUDOFvcucC5Z+KWE7oBIKlHwcV3hRdAMjcOF VuNLh7gvscPQWW67QnAwWjDdGyLxrBcs692Mp+Vj8doVaM0JwLQYwBGcQYJa+oDDn/or4YY74e7y hTjdqryTCPEOmHmjIq61oL5xYBj/SzEMRaxJZX0TAX7cdzTk02l4NOXWVV2HPvp3uoYX2LFWKb4y fEOGRGq+SpV8Vnuwmjn7Z/MkkYyJtUOFdK5NcQ== )`
	RRSIG=21831 and DNSKEY=21831 verifies the DS RRset
	DS=37525/SHA-256 is now in the chain-of-trust
	`zip. 86400 IN DS ( 37525 8 2 32eb9249d844b8593cf81fa5e2cec76cfcc536c249e116ea9b49269ac8f239ce )`
	Query to ns-tld1.charlestonroadregistry.com for zip/DNSKEY
	Received 747 bytes from 216.239.32.105
	;; Response received from [216.239.32.105] 747 octets ;; HEADER SECTION ;; id = 34804 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 0, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; zip. IN DNSKEY ;; ANSWER SECTION (3 records) zip. 300 IN DNSKEY ( 256 3 8 AwEAAZ2JZtZmtMXjV7VqV99moRsQN2Cz1ZZ77wDp7JGhLvFG7YoHLDD+2hb/N+T9+P5AEC5lfHD3 v3tIhF1dEwvKBxy+/vgBnNSqH/Xg9bS/H+ntYL+QKcE95CpDERsFSJioaBy+w2AqxGJy6fzymdK7 Va10M1EoHAsw93AvoKEiHo4f ) ; keytag 43516 zip. 300 IN DNSKEY ( 257 3 8 AwEAAazZsUZ5W69ZrXtBm8SHU4mLfYE0Qp0t0rnd0B5NhSzAqgIhKbKq+vSXiDjBr5is1dJpI3v/ fTKHNDgmcRFgDN9fKJhITTcsfBhqVXIu2Dd3RpNrgrc9If2GFhKK8JZ8oDQsTZMEzfBMUPer4KMS KtAKsou9Eu18yiLtI0bcWNkbaMmVQZHq1xC1EK0JEuK2rhDJ+wqyVVCsfwaCkxDXVrmBdba9sQIq QxTaStomrVyrWPq4tNH9CcNlgr3Fj7GgaYiiAA6zMwnwPrqUUCdOpixI9T9lAXuh4L1egidGKDB9 TyfBnvsHbCC8+c+EvczPWCu1N33ley+MU6mO80lIu/0= ) ; keytag 37525 zip. 300 IN RRSIG ( DNSKEY 8 1 300 20260207013624 20260116013624 37525 zip. qG6j7xcTL/qqNqsVpyNkwL9R/T70rm4pBtQ1cs1m/wBaQ+SR0O+i0gvne12oEoJ3hxBxL4NbHPzL wfgT8IUFgWfbPd14s08mzc2Hmt9H56ROJNCmROjcuVzp278xPmU/s0FlEyhWQILMA5fUhZg3AMNn qylbi9OGA31q6e9nldtmdMlmmLtOEpxup5h9diwEVZBGGulEkY2do3GRvFPB6eqGruJKx2hmnssL Au2KR8OUpvdPSI+BlWuX6YuTWxyhXbm27y36Jfr/pyZbVx90fG2zY9JDLGlepFga9qTwxC3geCWn nVx+fQBnNCrWjDUGARi4Aiq/7M8CA4DutlE8Ag== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for zip
	`zip. 300 IN DNSKEY ( 256 3 8 AwEAAZ2JZtZmtMXjV7VqV99moRsQN2Cz1ZZ77wDp7JGhLvFG7YoHLDD+2hb/N+T9+P5AEC5lfHD3 v3tIhF1dEwvKBxy+/vgBnNSqH/Xg9bS/H+ntYL+QKcE95CpDERsFSJioaBy+w2AqxGJy6fzymdK7 Va10M1EoHAsw93AvoKEiHo4f ) ; keytag 43516`
	`zip. 300 IN DNSKEY ( 257 3 8 AwEAAazZsUZ5W69ZrXtBm8SHU4mLfYE0Qp0t0rnd0B5NhSzAqgIhKbKq+vSXiDjBr5is1dJpI3v/ fTKHNDgmcRFgDN9fKJhITTcsfBhqVXIu2Dd3RpNrgrc9If2GFhKK8JZ8oDQsTZMEzfBMUPer4KMS KtAKsou9Eu18yiLtI0bcWNkbaMmVQZHq1xC1EK0JEuK2rhDJ+wqyVVCsfwaCkxDXVrmBdba9sQIq QxTaStomrVyrWPq4tNH9CcNlgr3Fj7GgaYiiAA6zMwnwPrqUUCdOpixI9T9lAXuh4L1egidGKDB9 TyfBnvsHbCC8+c+EvczPWCu1N33ley+MU6mO80lIu/0= ) ; keytag 37525`
	DNSKEY=37525/SEP is now in the chain-of-trust
	DS=37525/SHA-256 verifies DNSKEY=37525/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`zip. 300 IN RRSIG ( DNSKEY 8 1 300 20260207013624 20260116013624 37525 zip. qG6j7xcTL/qqNqsVpyNkwL9R/T70rm4pBtQ1cs1m/wBaQ+SR0O+i0gvne12oEoJ3hxBxL4NbHPzL wfgT8IUFgWfbPd14s08mzc2Hmt9H56ROJNCmROjcuVzp278xPmU/s0FlEyhWQILMA5fUhZg3AMNn qylbi9OGA31q6e9nldtmdMlmmLtOEpxup5h9diwEVZBGGulEkY2do3GRvFPB6eqGruJKx2hmnssL Au2KR8OUpvdPSI+BlWuX6YuTWxyhXbm27y36Jfr/pyZbVx90fG2zY9JDLGlepFga9qTwxC3geCWn nVx+fQBnNCrWjDUGARi4Aiq/7M8CA4DutlE8Ag== )`
	RRSIG=37525 and DNSKEY=37525/SEP verifies the DNSKEY RRset
	DNSKEY=43516 is now in the chain-of-trust
	Query to ns-tld5.charlestonroadregistry.com for 7.zip/A
	Received 306 bytes from 216.239.60.105
	;; Response received from [216.239.60.105] 306 octets ;; HEADER SECTION ;; id = 1064 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 0, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; 7.zip. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) 7.zip. 10800 IN NS graham.ns.cloudflare.com. 7.zip. 10800 IN NS izabella.ns.cloudflare.com. 7.zip. 900 IN DS ( 2371 13 2 b48a58ee202b7201fd3ec54aa00994fc6888f36e9101f2507d934a6b2fbd81b8 ) 7.zip. 900 IN RRSIG ( DS 8 2 900 20260207013624 20260116013624 43516 zip. eho+VzKdZwnnUxWDtc/skn2vHHYxO5QWvRypsmQtYDOXgDFQXJO7cAtbIiUCWTHKa1XiX07uTgMS 4eXmzf1JtoEqAMUwBUFkQupwEiX3vQDypS6lxINS4FWJrzqLHwPWwsi7j+smXpSxFybwsWj6USgz lmQ7MStgEFFLSDpog/g= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns-tld2.charlestonroadregistry.com for 7.zip/DNSKEY
	Received 306 bytes from 216.239.34.105
	;; Response received from [216.239.34.105] 306 octets ;; HEADER SECTION ;; id = 19315 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 0, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; 7.zip. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) 7.zip. 10800 IN NS graham.ns.cloudflare.com. 7.zip. 10800 IN NS izabella.ns.cloudflare.com. 7.zip. 900 IN DS ( 2371 13 2 b48a58ee202b7201fd3ec54aa00994fc6888f36e9101f2507d934a6b2fbd81b8 ) 7.zip. 900 IN RRSIG ( DS 8 2 900 20260207013624 20260116013624 43516 zip. eho+VzKdZwnnUxWDtc/skn2vHHYxO5QWvRypsmQtYDOXgDFQXJO7cAtbIiUCWTHKa1XiX07uTgMS 4eXmzf1JtoEqAMUwBUFkQupwEiX3vQDypS6lxINS4FWJrzqLHwPWwsi7j+smXpSxFybwsWj6USgz lmQ7MStgEFFLSDpog/g= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone 7.zip

7.zip

	Checking DS between zip and 7.zip
	Query to ns-tld1.charlestonroadregistry.com for 7.zip/DS
	Received 245 bytes from 216.239.32.105
	;; Response received from [216.239.32.105] 245 octets ;; HEADER SECTION ;; id = 13097 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 0, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; 7.zip. IN DS ;; ANSWER SECTION (2 records) 7.zip. 900 IN DS ( 2371 13 2 b48a58ee202b7201fd3ec54aa00994fc6888f36e9101f2507d934a6b2fbd81b8 ) 7.zip. 900 IN RRSIG ( DS 8 2 900 20260207013624 20260116013624 43516 zip. eho+VzKdZwnnUxWDtc/skn2vHHYxO5QWvRypsmQtYDOXgDFQXJO7cAtbIiUCWTHKa1XiX07uTgMS 4eXmzf1JtoEqAMUwBUFkQupwEiX3vQDypS6lxINS4FWJrzqLHwPWwsi7j+smXpSxFybwsWj6USgz lmQ7MStgEFFLSDpog/g= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for 7.zip in the zip zone
	DS=2371/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`7.zip. 900 IN RRSIG ( DS 8 2 900 20260207013624 20260116013624 43516 zip. eho+VzKdZwnnUxWDtc/skn2vHHYxO5QWvRypsmQtYDOXgDFQXJO7cAtbIiUCWTHKa1XiX07uTgMS 4eXmzf1JtoEqAMUwBUFkQupwEiX3vQDypS6lxINS4FWJrzqLHwPWwsi7j+smXpSxFybwsWj6USgz lmQ7MStgEFFLSDpog/g= )`
	RRSIG=43516 and DNSKEY=43516 verifies the DS RRset
	DS=2371/SHA-256 is now in the chain-of-trust
	`7.zip. 900 IN DS ( 2371 13 2 b48a58ee202b7201fd3ec54aa00994fc6888f36e9101f2507d934a6b2fbd81b8 )`
	Query to graham.ns.cloudflare.com for 7.zip/DNSKEY
	Received 295 bytes from 172.64.33.171
	;; Response received from [172.64.33.171] 295 octets ;; HEADER SECTION ;; id = 38153 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; 7.zip. IN DNSKEY ;; ANSWER SECTION (3 records) 7.zip. 3600 IN DNSKEY ( 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iU zy1L53eKGQ== ) ; keytag 2371 7.zip. 3600 IN DNSKEY ( 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x 8fGAa2XhSA== ) ; keytag 34505 7.zip. 3600 IN RRSIG ( DNSKEY 13 2 3600 20260301022239 20251230022239 2371 7.zip. 2obNNMuQ30IDOuOjAR1r9bY4zEotFZmo1JcTEqD4l5v3qdEOOaJmitXJELOKj3QmK2HBU69lI1c4 lDS59FtwMg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for 7.zip
	`7.zip. 3600 IN DNSKEY ( 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iU zy1L53eKGQ== ) ; keytag 2371`
	`7.zip. 3600 IN DNSKEY ( 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x 8fGAa2XhSA== ) ; keytag 34505`
	DNSKEY=2371/SEP is now in the chain-of-trust
	DS=2371/SHA-256 verifies DNSKEY=2371/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`7.zip. 3600 IN RRSIG ( DNSKEY 13 2 3600 20260301022239 20251230022239 2371 7.zip. 2obNNMuQ30IDOuOjAR1r9bY4zEotFZmo1JcTEqD4l5v3qdEOOaJmitXJELOKj3QmK2HBU69lI1c4 lDS59FtwMg== )`
	RRSIG=2371 and DNSKEY=2371/SEP verifies the DNSKEY RRset
	DNSKEY=34505 is now in the chain-of-trust
	Query to izabella.ns.cloudflare.com for 7.zip/A
	Received 167 bytes from 172.64.34.46
	;; Response received from [172.64.34.46] 167 octets ;; HEADER SECTION ;; id = 10203 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; 7.zip. IN A ;; ANSWER SECTION (3 records) 7.zip. 300 IN A 104.21.82.239 7.zip. 300 IN A 172.67.209.74 7.zip. 300 IN RRSIG ( A 13 2 300 20260119204404 20260117184404 34505 7.zip. s4wab9DGBtxdjBERCnjyN26PRJ7O9/sfYGeThUmCCzTo6krkyTKQfMky/o8IdUQhd6a3lxaIYzZc WOGct5jtMA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	izabella.ns.cloudflare.com is authoritative for 7.zip
	Found RRSIG signed by 7.zip zone
	Query to graham.ns.cloudflare.com for 7.zip/SOA
	Received 199 bytes from 108.162.193.171
	;; Response received from [108.162.193.171] 199 octets ;; HEADER SECTION ;; id = 64143 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; 7.zip. IN SOA ;; ANSWER SECTION (2 records) 7.zip. 1800 IN SOA ( graham.ns.cloudflare.com. dns.cloudflare.com. 2393621286 ;serial 10000 ;refresh 2400 ;retry 604800 ;expire 1800 ;minimum ) 7.zip. 1800 IN RRSIG ( SOA 13 2 1800 20260119204404 20260117184404 34505 7.zip. fytW2URNdv6d6cDWweKyHLNzf/OdNFBCHn9mFsVcz8hLYvo4DrykK+cMi57Cp6Jb3T/Ny+YjMZ++ LwvktzK+eA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to izabella.ns.cloudflare.com for 7.zip/A
	Received 167 bytes from 108.162.194.46
	;; Response received from [108.162.194.46] 167 octets ;; HEADER SECTION ;; id = 40879 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; 7.zip. IN A ;; ANSWER SECTION (3 records) 7.zip. 300 IN A 104.21.82.239 7.zip. 300 IN A 172.67.209.74 7.zip. 300 IN RRSIG ( A 13 2 300 20260119204404 20260117184404 34505 7.zip. eXkkCQDOmUfM1R3RvxLO00k0FM71k7sM7XUacp1tDDTuyYrxGn7VjrNoweWd+Bf1JZJeFgF2gNm+ X+fWCAo50g== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	7.zip A RR has value 104.21.82.239
	7.zip A RR has value 172.67.209.74
	Found 1 RRSIGs over A RRset
	`7.zip. 300 IN RRSIG ( A 13 2 300 20260119204404 20260117184404 34505 7.zip. eXkkCQDOmUfM1R3RvxLO00k0FM71k7sM7XUacp1tDDTuyYrxGn7VjrNoweWd+Bf1JZJeFgF2gNm+ X+fWCAo50g== )`
	RRSIG=34505 and DNSKEY=34505 verifies the A RRset

7.zip

	Query to graham.ns.cloudflare.com for 7.zip/A
	Received 167 bytes from 108.162.193.171
	;; Response received from [108.162.193.171] 167 octets ;; HEADER SECTION ;; id = 5932 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; 7.zip. IN A ;; ANSWER SECTION (3 records) 7.zip. 300 IN A 172.67.209.74 7.zip. 300 IN A 104.21.82.239 7.zip. 300 IN RRSIG ( A 13 2 300 20260119204404 20260117184404 34505 7.zip. SihP1MmON1Jod/chCYb/S/1jVSbBLHne4QewAAAaSIkRsrWVsISr6ku+Y1nLE5fsM504RE72OL+3 oBZnXD8o7g== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	graham.ns.cloudflare.com is authoritative for 7.zip
	Found RRSIG signed by 7.zip zone
	Query to graham.ns.cloudflare.com for 7.zip/A
	Received 167 bytes from 172.64.33.171
	;; Response received from [172.64.33.171] 167 octets ;; HEADER SECTION ;; id = 28719 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; 7.zip. IN A ;; ANSWER SECTION (3 records) 7.zip. 300 IN A 104.21.82.239 7.zip. 300 IN A 172.67.209.74 7.zip. 300 IN RRSIG ( A 13 2 300 20260119204404 20260117184404 34505 7.zip. qdcuwOJDAfHOFQMPCtiN5Wf3VAYdZQdwGRi3Fldvk5N3h7tL8DOnJU/giAGZyEgss3ahyXOer6tq 0ibhOLy7Bg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	7.zip A RR has value 104.21.82.239
	7.zip A RR has value 172.67.209.74
	Found 1 RRSIGs over A RRset
	`7.zip. 300 IN RRSIG ( A 13 2 300 20260119204404 20260117184404 34505 7.zip. qdcuwOJDAfHOFQMPCtiN5Wf3VAYdZQdwGRi3Fldvk5N3h7tL8DOnJU/giAGZyEgss3ahyXOer6tq 0ibhOLy7Bg== )`
	RRSIG=34505 and DNSKEY=34505 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test 7.zip at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: