DNSSEC Debugger - REPLACE-WITH-YOUR-DOMAIN.tld

Back to Verisign Labs Tools

Domain Name:

Detail: more(+) / less(-)

Time: 2026-08-07 22:06:18 UTC

Analyzing DNSSEC problems for REPLACE-WITH-YOUR-DOMAIN.tld

DS=20326/SHA-256 is now in the chain-of-trust

DS=38696/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	`. IN DS ( 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 )`
	Query to g.root-servers.net for ./DNSKEY
	Received 1141 bytes from 192.112.36.4
	;; Response received from [192.112.36.4] 1141 octets ;; HEADER SECTION ;; id = 45378 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN DNSKEY ( 256 3 8 AwEAAeCYD6Z7WWKVLeuWgowKP+3g+Gs1cnLKq7a3CaQxQpv8bfuFVI0WnG33qaSH/Mw9IBgifrdz f4XY/DQLnyBJ9MfaOyAWuEaEmYJ+GQPiwVVfstGwSA1McfFJUttTgq2Huu74KARhtA8wPo/N3Xcy YQtNhz+qCM5NBb3ecx/naw6sYab9LxS6f2cU0q03++BP5Ks0Uef8WJCa/1izCYE+vMkwoltV+tEN a3hpXiZ7jle/xdgaZrPi5ZGmyLVI34g1XVYrNlsCCTmNvFQIfzW5STFQFsQpizczyFn9r3LzSxxP CNwdlCG84bER0BmdwqbF6Tanv+FxMOavrahkj4wIy5k= ) ; keytag 57780 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20260821000000 20260731000000 20326 . kKpaPEyKDhNNs9rizpyOEcK2Nwg04lOQEeUgL175fR1W7zTzCo96Lpf5xuMeN9vZKHq362Yi6pX1 1BeCL5JejRJ0q4OflNu2jkjZpqW4JWNeim0gaJxd2fg8MMh7qg9gZnMfFLzK8y2Hudve+JF3LD/M jIPpdPd/GEISqynmOLYxNmol2eKMdiDJ3RNxVTfzmEo8QqXGGDEozWf5pM9XvTa22LLJ37NHblwT 0eeHnhxKwt5q4RH7YabmC2NlUge5R/GoCQD0WJdmi139O7DyyRDa1YEHSPigdLDRjXuAmw1acBrL bmvS7F9j1Zbc2Mm1MO924z6z9L3GXPlaSV1NJw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAeCYD6Z7WWKVLeuWgowKP+3g+Gs1cnLKq7a3CaQxQpv8bfuFVI0WnG33qaSH/Mw9IBgifrdz f4XY/DQLnyBJ9MfaOyAWuEaEmYJ+GQPiwVVfstGwSA1McfFJUttTgq2Huu74KARhtA8wPo/N3Xcy YQtNhz+qCM5NBb3ecx/naw6sYab9LxS6f2cU0q03++BP5Ks0Uef8WJCa/1izCYE+vMkwoltV+tEN a3hpXiZ7jle/xdgaZrPi5ZGmyLVI34g1XVYrNlsCCTmNvFQIfzW5STFQFsQpizczyFn9r3LzSxxP CNwdlCG84bER0BmdwqbF6Tanv+FxMOavrahkj4wIy5k= ) ; keytag 57780`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	DNSKEY=38696/SEP is now in the chain-of-trust
	DS=38696/SHA-256 verifies DNSKEY=38696/SEP
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20260821000000 20260731000000 20326 . kKpaPEyKDhNNs9rizpyOEcK2Nwg04lOQEeUgL175fR1W7zTzCo96Lpf5xuMeN9vZKHq362Yi6pX1 1BeCL5JejRJ0q4OflNu2jkjZpqW4JWNeim0gaJxd2fg8MMh7qg9gZnMfFLzK8y2Hudve+JF3LD/M jIPpdPd/GEISqynmOLYxNmol2eKMdiDJ3RNxVTfzmEo8QqXGGDEozWf5pM9XvTa22LLJ37NHblwT 0eeHnhxKwt5q4RH7YabmC2NlUge5R/GoCQD0WJdmi139O7DyyRDa1YEHSPigdLDRjXuAmw1acBrL bmvS7F9j1Zbc2Mm1MO924z6z9L3GXPlaSV1NJw== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=57780 is now in the chain-of-trust
	Query to f.root-servers.net for REPLACE-WITH-YOUR-DOMAIN.tld/A
	Received 1043 bytes from 192.5.5.241
	;; Response received from [192.5.5.241] 1043 octets ;; HEADER SECTION ;; id = 58845 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NXDOMAIN ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; REPLACE-WITH-YOUR-DOMAIN.tld. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) . 86400 IN SOA ( a.root-servers.net. nstld.verisign-grs.com. 2026080702 ;serial 1800 ;refresh 900 ;retry 604800 ;expire 86400 ;minimum ) . 86400 IN RRSIG ( SOA 8 0 86400 20260820200000 20260807190000 57780 . fwZId0zFhFB4oDayiwQvTqI+AyOe+cxmX112PaOfz25CEGSRfvpfJQl5J/5NsvOv0n75sh/zpy2H 2T8wTj9Z/8U4nF3wS4lPBoeADXp4D38HGRsRsGXRcsRFsjaHxS6WZLfxIJ0KL13oejHsnSkiTixI F9CoG84MTPWVKZkuLEL5b15ezT3f3Pr37v4yAOkPcbCdA1WIQfC77D3XRiV8JvyM38FCh47tfaZd cjQ9ckO/owsPGNA5EP5fsHmASiPZ3UWF6LIBfzt2Mf/kSHCfqVL85qtMl+h8FyLuujOmehSJi9ob Ox3d6Xb4wFfFoT7XI8aChKQXRikrVbY2dd+ZBA== ) tl. 86400 IN NSEC tm. NS DS RRSIG NSEC tl. 86400 IN RRSIG ( NSEC 8 1 86400 20260820200000 20260807190000 57780 . F5zxG+A3x2IO8tIMPivpv+SDB38i9j/co/3If/s98ZzKVKwruzkY6Uk859Xf38tY27jHK/vT/Jb2 masJkrPKYdxtpjU8zb+ymo6ckK9NwfEkg1eM9of5msYiGDKwT4wT3HLI2Sk1Tvy+/1it43M6Lc6R VR3bcWPPb0s5p7N4l4rBf4a49KrSEsMncxkrrplMzYWwjsK5EZXDrPjEQP98FZlQT3HCDXSwLpAu bw6MV9+eR9WDj4rgZ/NOveGpevTcg5XIztumuBC8fR60lO8jK6vZikOulSDlvfZy+cyqXFdaWjS5 oaqvrgfH/OtwOik7Xl/KyRtV49mo8C5ggsn6Bw== ) . 86400 IN NSEC aaa. NS SOA RRSIG NSEC DNSKEY ZONEMD . 86400 IN RRSIG ( NSEC 8 0 86400 20260820200000 20260807190000 57780 . Xu4rpmhCt43ChKV34/15modUcaoalfSwKUvL5rDKT1+OShq+4swpx0cyO4h2UnBWlcy5s2AjKy+Y G3N0W3+ALlH+yr+2gRmHc0uvC4A/bUk+LH64VfhEKTuxG/I5yjKzDCzTDEvSgCnrKLmuvsyfQ7be X7e6XOmh987XyX2L9t/Sq2fp0R/zmZ38RGQQJ6rEHppUxQjFomfXEgQJxQrQQ3zyo7mD7r+Oc3GS KhiZvhHDD9dRHoUDlvSt+0be7P0anA6MwnChA+8ZTtmAUFx5ur+Lkc7+8z2VoV24KDPeiS5D+xuQ gjY+99HmmureyTTvWfM85U4waw5yQ4Jup2kN7Q== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Zone . (192.5.5.241) returns NXDOMAIN for REPLACE-WITH-YOUR-DOMAIN.tld
	Checking NSEC records for an NXDOMAIN response
	Found 1 RRSIGs over NSEC RRset
	`tl. 86400 IN RRSIG ( NSEC 8 1 86400 20260820200000 20260807190000 57780 . F5zxG+A3x2IO8tIMPivpv+SDB38i9j/co/3If/s98ZzKVKwruzkY6Uk859Xf38tY27jHK/vT/Jb2 masJkrPKYdxtpjU8zb+ymo6ckK9NwfEkg1eM9of5msYiGDKwT4wT3HLI2Sk1Tvy+/1it43M6Lc6R VR3bcWPPb0s5p7N4l4rBf4a49KrSEsMncxkrrplMzYWwjsK5EZXDrPjEQP98FZlQT3HCDXSwLpAu bw6MV9+eR9WDj4rgZ/NOveGpevTcg5XIztumuBC8fR60lO8jK6vZikOulSDlvfZy+cyqXFdaWjS5 oaqvrgfH/OtwOik7Xl/KyRtV49mo8C5ggsn6Bw== )`
	RRSIG=57780 and DNSKEY=57780 verifies the NSEC RRset
	NSEC proves no records exist with name REPLACE-WITH-YOUR-DOMAIN.tld