DNSSEC Analyzer

Domain Name:

Time: 2019-09-19 16:36:15 UTC, NTP stratum 4

Analyzing DNSSEC problems for aa.am

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to d.root-servers.net for ./DNSKEY
	Received 1139 bytes from 199.7.91.13
	;; Answer received from 199.7.91.13 (1139 bytes) ;; HEADER SECTION ;; id = 62431 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1450 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAbPwrxwtOMENWvblQbUFwBllR7ZtXsu9rg/LdyklKs9gU2GQTeOc59XjhuAPZ4WrT09z6YPL +vzIIJqnG3Hiru7hFUQ4pH0qsLNxrsuZrZYmXAKoVa9SXL1Ap0LygwrIugEk1G4v7Rk/Alt1jLUI E+ZymGtSEhIuGQdXrEmj3ffzXY13H42X4Ja3vJTn/WIQOXY7vwHXGDypSh9j0Tt0hknF1yVJCrIp fkhFWihMKNdMzMprD4bV+PDLRA5YSn3OPIeUnRn9qBUCN11LXQKb+W3Jg+m/5xQRQJzJ/qXgDh1+ aN+Mc9AstP29Y/ZLFmF6cKtL2zoUMN5I5QymeSkJJzc= ) ; Key ID = 22545 . 172800 IN DNSKEY ( 256 3 8 AwEAAcTQyaIe6nt3xSPOG2L/YfwBkOVTJN6mlnZ249O5Rtt3ZSRQHxQSW61AODYw6bvgxrrGq8ee OuenFjcSYgNAMcBYoEYYmKDW6e9EryW4ZaT/MCq+8Am06oR40xAA3fClOM6QjRcT85tP41Go946A icBGP8XOP/Aj1aI/oPRGzRnboUPUok/AzTNnW5npBU69+BuiIwYE7mQOiNBFePyvjQBdoiuYbmuD 3Py0IyjlBxzZUXbqLsRL9gYFkCqeTY29Ik7usuzMTa+JRSLz6KGS5RSJ7CTSMjZg8aNaUbN2dvGh akJPh92HnLvMA3TefFgbKJphFNPA3BWSKLZ02cRWXqM= ) ; Key ID = 59944 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20191010000000 20190919000000 20326 . OcVKz5iMycVJP8n4f3IAAYG3AZFS3nh4t6nxMC2Jxg5uk2MyAlFUvAdvclTs15S2D9FP7aL+uQ9J aPSAaMv7opp8tOo5X5qEJjpaHTwXWjSgFeUMGhp2rtdCR1aTeIKlLd6g3JthDpEWV0ip6VQKqLNO Yx7gnaQc3j4SzK1q1YyjX/caO7m5We14vJNx0bmp4K/+U6SyKYuIu38IsHPUMbBO624MpRqW0etq cT3WiYCgGgFUTfYbr6aD4YSQPDAjII4N0yPJrBdDvbo2a3Nzvn2edq2zxRinnwWcqAqoymhZzr+h g7CTaLftqq2vTEXAtHSFk8JhLSlmciNm1S1xiA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1450 ;; option:
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbPwrxwtOMENWvblQbUFwBllR7ZtXsu9rg/LdyklKs9gU2GQTeOc59XjhuAPZ4WrT09z6YPL +vzIIJqnG3Hiru7hFUQ4pH0qsLNxrsuZrZYmXAKoVa9SXL1Ap0LygwrIugEk1G4v7Rk/Alt1jLUI E+ZymGtSEhIuGQdXrEmj3ffzXY13H42X4Ja3vJTn/WIQOXY7vwHXGDypSh9j0Tt0hknF1yVJCrIp fkhFWihMKNdMzMprD4bV+PDLRA5YSn3OPIeUnRn9qBUCN11LXQKb+W3Jg+m/5xQRQJzJ/qXgDh1+ aN+Mc9AstP29Y/ZLFmF6cKtL2zoUMN5I5QymeSkJJzc= ) ; Key ID = 22545`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAcTQyaIe6nt3xSPOG2L/YfwBkOVTJN6mlnZ249O5Rtt3ZSRQHxQSW61AODYw6bvgxrrGq8ee OuenFjcSYgNAMcBYoEYYmKDW6e9EryW4ZaT/MCq+8Am06oR40xAA3fClOM6QjRcT85tP41Go946A icBGP8XOP/Aj1aI/oPRGzRnboUPUok/AzTNnW5npBU69+BuiIwYE7mQOiNBFePyvjQBdoiuYbmuD 3Py0IyjlBxzZUXbqLsRL9gYFkCqeTY29Ik7usuzMTa+JRSLz6KGS5RSJ7CTSMjZg8aNaUbN2dvGh akJPh92HnLvMA3TefFgbKJphFNPA3BWSKLZ02cRWXqM= ) ; Key ID = 59944`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20191010000000 20190919000000 20326 . OcVKz5iMycVJP8n4f3IAAYG3AZFS3nh4t6nxMC2Jxg5uk2MyAlFUvAdvclTs15S2D9FP7aL+uQ9J aPSAaMv7opp8tOo5X5qEJjpaHTwXWjSgFeUMGhp2rtdCR1aTeIKlLd6g3JthDpEWV0ip6VQKqLNO Yx7gnaQc3j4SzK1q1YyjX/caO7m5We14vJNx0bmp4K/+U6SyKYuIu38IsHPUMbBO624MpRqW0etq cT3WiYCgGgFUTfYbr6aD4YSQPDAjII4N0yPJrBdDvbo2a3Nzvn2edq2zxRinnwWcqAqoymhZzr+h g7CTaLftqq2vTEXAtHSFk8JhLSlmciNm1S1xiA== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=22545 is now in the chain-of-trust
	DNSKEY=59944 is now in the chain-of-trust
	Query to f.root-servers.net for aa.am/A
	Error querying f.root-servers.net/2001:500:2f:0:0:0:0:f for aa.am/A: 'IPv6 transport disabled'
	Received 724 bytes from 192.5.5.241
	;; Answer received from 192.5.5.241 (724 bytes) ;; HEADER SECTION ;; id = 12183 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 7 arcount = 11 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option: ;; QUESTION SECTION (1 record) ;; aa.am. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) am. 172800 IN NS fork.sth.dnsnode.net. am. 172800 IN NS ns-cdn.amnic.net. am. 172800 IN NS ns-pch.amnic.net. am. 172800 IN NS ns-pri.nic.am. am. 172800 IN NS sns-pb.isc.org. am. 86400 IN DS ( 9804 7 2 cb6cf75eea3140049d3317b47ab16c9e166f8639d54d4daae7eac9eba07879a2 ) am. 86400 IN RRSIG ( DS 8 1 86400 20191002150000 20190919140000 59944 . p23wBH7SUrAsDN7Zgwq5ZzFAxwC6juj8IXufZQluH5hlF+OBGXlm7I9V9QRbkMGA/ZWLciKJuCmo EXKbhRlIPHuwuF8zY6qYfPNm6rJX2V7Rkbc+gW0F5To4ZTl2zb04yvSR/edweEiSqu6Edc+/Bhlw NeRFT1IIW3eIw93XllWM+8+LhmeLFCX3SVoBzy2C0tfxSDVGCLV3foYycTaV9LhfqayR26Ud5KST sPYXAk/x1hM3E8lZuOVMCLHWw33MVnenUPWVFCTaG2SvXkZ7CluHiiZYaosSxL8/HAAmFAiwucLU iDsl/SnzagP+0EYHTlE+OmP+HctYDWUFXPfs6Q== ) ;; ADDITIONAL SECTION (11 records) fork.sth.dnsnode.net. 172800 IN A 77.72.229.254 fork.sth.dnsnode.net. 172800 IN AAAA 2a01:3f0:0:306::53 ns-cdn.amnic.net. 172800 IN A 194.0.1.26 ns-cdn.amnic.net. 172800 IN AAAA 2001:678:4::1a ns-pch.amnic.net. 172800 IN A 204.61.216.96 ns-pch.amnic.net. 172800 IN AAAA 2001:500:14:6096:ad::1 ns-pri.nic.am. 172800 IN A 195.43.75.53 ns-pri.nic.am. 172800 IN AAAA 2001:7f9:8:53::1 sns-pb.isc.org. 172800 IN A 192.5.4.1 sns-pb.isc.org. 172800 IN AAAA 2001:500:2e::1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option:
	Query to i.root-servers.net for am/DNSKEY
	Received 721 bytes from 192.36.148.17
	;; Answer received from 192.36.148.17 (721 bytes) ;; HEADER SECTION ;; id = 41078 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 7 arcount = 11 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; am. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) am. 172800 IN NS ns-cdn.amnic.net. am. 172800 IN NS sns-pb.isc.org. am. 172800 IN NS fork.sth.dnsnode.net. am. 172800 IN NS ns-pri.nic.am. am. 172800 IN NS ns-pch.amnic.net. am. 86400 IN DS ( 9804 7 2 cb6cf75eea3140049d3317b47ab16c9e166f8639d54d4daae7eac9eba07879a2 ) am. 86400 IN RRSIG ( DS 8 1 86400 20191002150000 20190919140000 59944 . p23wBH7SUrAsDN7Zgwq5ZzFAxwC6juj8IXufZQluH5hlF+OBGXlm7I9V9QRbkMGA/ZWLciKJuCmo EXKbhRlIPHuwuF8zY6qYfPNm6rJX2V7Rkbc+gW0F5To4ZTl2zb04yvSR/edweEiSqu6Edc+/Bhlw NeRFT1IIW3eIw93XllWM+8+LhmeLFCX3SVoBzy2C0tfxSDVGCLV3foYycTaV9LhfqayR26Ud5KST sPYXAk/x1hM3E8lZuOVMCLHWw33MVnenUPWVFCTaG2SvXkZ7CluHiiZYaosSxL8/HAAmFAiwucLU iDsl/SnzagP+0EYHTlE+OmP+HctYDWUFXPfs6Q== ) ;; ADDITIONAL SECTION (11 records) fork.sth.dnsnode.net. 172800 IN A 77.72.229.254 fork.sth.dnsnode.net. 172800 IN AAAA 2a01:3f0:0:306::53 ns-cdn.amnic.net. 172800 IN A 194.0.1.26 ns-cdn.amnic.net. 172800 IN AAAA 2001:678:4::1a ns-pch.amnic.net. 172800 IN A 204.61.216.96 ns-pch.amnic.net. 172800 IN AAAA 2001:500:14:6096:ad::1 ns-pri.nic.am. 172800 IN A 195.43.75.53 ns-pri.nic.am. 172800 IN AAAA 2001:7f9:8:53::1 sns-pb.isc.org. 172800 IN A 192.5.4.1 sns-pb.isc.org. 172800 IN AAAA 2001:500:2e::1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone am

	Checking DS between . and am
	Query to e.root-servers.net for am/DS
	Received 366 bytes from 192.203.230.10
	;; Answer received from 192.203.230.10 (366 bytes) ;; HEADER SECTION ;; id = 55218 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option: ;; QUESTION SECTION (1 record) ;; am. IN DS ;; ANSWER SECTION (2 records) am. 86400 IN DS ( 9804 7 2 cb6cf75eea3140049d3317b47ab16c9e166f8639d54d4daae7eac9eba07879a2 ) am. 86400 IN RRSIG ( DS 8 1 86400 20191002150000 20190919140000 59944 . p23wBH7SUrAsDN7Zgwq5ZzFAxwC6juj8IXufZQluH5hlF+OBGXlm7I9V9QRbkMGA/ZWLciKJuCmo EXKbhRlIPHuwuF8zY6qYfPNm6rJX2V7Rkbc+gW0F5To4ZTl2zb04yvSR/edweEiSqu6Edc+/Bhlw NeRFT1IIW3eIw93XllWM+8+LhmeLFCX3SVoBzy2C0tfxSDVGCLV3foYycTaV9LhfqayR26Ud5KST sPYXAk/x1hM3E8lZuOVMCLHWw33MVnenUPWVFCTaG2SvXkZ7CluHiiZYaosSxL8/HAAmFAiwucLU iDsl/SnzagP+0EYHTlE+OmP+HctYDWUFXPfs6Q== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option:
	Found 1 DS records for am in the . zone
	DS=9804/SHA-256 has algorithm RSASHA1-NSEC3-SHA1
	Found 1 RRSIGs over DS RRset
	`am. 86400 IN RRSIG ( DS 8 1 86400 20191002150000 20190919140000 59944 . p23wBH7SUrAsDN7Zgwq5ZzFAxwC6juj8IXufZQluH5hlF+OBGXlm7I9V9QRbkMGA/ZWLciKJuCmo EXKbhRlIPHuwuF8zY6qYfPNm6rJX2V7Rkbc+gW0F5To4ZTl2zb04yvSR/edweEiSqu6Edc+/Bhlw NeRFT1IIW3eIw93XllWM+8+LhmeLFCX3SVoBzy2C0tfxSDVGCLV3foYycTaV9LhfqayR26Ud5KST sPYXAk/x1hM3E8lZuOVMCLHWw33MVnenUPWVFCTaG2SvXkZ7CluHiiZYaosSxL8/HAAmFAiwucLU iDsl/SnzagP+0EYHTlE+OmP+HctYDWUFXPfs6Q== )`
	RRSIG=59944 and DNSKEY=59944 verifies the DS RRset
	DS=9804/SHA-256 is now in the chain-of-trust
	`am. 86400 IN DS ( 9804 7 2 cb6cf75eea3140049d3317b47ab16c9e166f8639d54d4daae7eac9eba07879a2 )`
	Query to ns-pch.amnic.net for am/DNSKEY
	Received 1479 bytes from 204.61.216.96
	;; Answer received from 204.61.216.96 (1479 bytes) ;; HEADER SECTION ;; id = 43398 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 7 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; am. IN DNSKEY ;; ANSWER SECTION (7 records) am. 43200 IN DNSKEY ( 256 3 7 AwEAAZtBhFUye5OaMl9lONkxWgrWrD6OctOSK8/fVrOyOk8ZjnP+Jv+qsrBznx+eOs82g8U8I9Tu MDThSQSVt7WeF7hFgGXaj6U1sut6OanHaZHBtmds/CS7IMa2HjBAnifZBSyTUR3RX8v/BIRSqPq4 8Q2xlG8It09gXkG32xtzMSIp ) ; Key ID = 62294 am. 43200 IN DNSKEY ( 256 3 7 AwEAAa1WeAzqfUcQCAuRN5F14WwlTsg2vccDoCww6Nku2ns3zX5DPOo7ErSE1UNrQiocXHWZWNUg a0GpfsvdE1/NHOCDnJfd2Hugm6zNIMgiQ/VEaRyx5rU592aQMMwdlKHkJMLduVNSa41j/80/Mp/b QBDazueJtA4Jke87WcEQ+UPF ) ; Key ID = 50354 am. 43200 IN DNSKEY ( 257 3 7 AwEAAbu7W3rkAxkYJOUw4ONmCcba/WaFDz3KCFmjkL1Q+t1HpheLgXfirliNipENGSnovWh9jk/e oRW/INeJQqNTjYuQuioJw4oDO5eh5UoBB26R3aK78O72l4GZ4SgVMuyXQgvPgqWCboJ/pvXkpoQ1 2NQxLaXDQJyzsBNXoPwU9kzqHOxgM/UhK1MOLAFTv+BEKTEgY9v1MnFCN0Cqx045+USAfTBkvo9W rYuyFr7oSi7MPyKU5cl49Q5+Kr9kMCLgdH1YOzH+3vOKv5DztSzyp4RYOcy6zom+t6Dx+2lwnKHv E1X7fM1RxX66Sh/uwAhrZPT3TXHOgt5oIZTa8/Ol50E= ) ; Key ID = 32829 am. 43200 IN DNSKEY ( 256 3 7 AwEAAbGx56++Xu++LRXXbc4LvQdyfjSo3ikmi1FXxcjYs409MPbxY+/DLOLJ9T/fpgCC8HToo5cO 1pEBbERTFbuj/br5UILFiVQHgPXHFud1oLG5h9SsTn6PSwLFiw1KTi5aGmosVNDQFQwaaZJTZr5B 05pJl4aEPPNGxNeszXcmjnnB ) ; Key ID = 59123 am. 43200 IN DNSKEY ( 257 3 7 AwEAAZawAjd4056P/UPnGBlTtawBwkgrGCZswWE5pN8qkpDpUrbmxX53+NkmVHVL3fCtNfILPNdq jmcXG0jbBlRlRSwc41nZQ10e1O+8D5EIUNaAt1c80PLiRgn9vTDhJptIfudlvsA0UUeVyqLa57/Q 2I/8EGvD4rPvRdFHHtTCyISsnk60C+UsD50o3jn65PY0nTlw8iMEz9Y2Wbx9GM+Kd2ETUQ0gtEVZ Ctw2yjfByalW0tzf6eE46l275dv2Y9KMG+eDK/iTl/79vytpLJADzyxnjSMTfBBWHtwQuOaNXYhU 3Zpcr8HlMgewDN6LogCA1gWBP4vT+LjghmWz8sQAXaU= ) ; Key ID = 9804 am. 43200 IN RRSIG ( DNSKEY 7 1 43200 20191015052455 20190915043739 9804 am. A2VLNL0WdwCH/rr6nTdvEhkcaffzlkzyF3ZugzD0ADjTwPdFZwBZdR3wNqssluYKfwAPEHN46mjh IuuvKgGSFzF2xKceTXyOzDu+Mz5Fp9P09yKvTGlg40Of8EXcfcJAZ16XO6U2XfB6Bz2i61EBYsWW JAS6GccXWH+z8elz6NVyCFXsLLkwq8R7VDAbYaLZN65MMGMxuVETigYvsUXQqo8LNa6HHqcWgfGd M+3Nf5msyD27R/TEh/F0Kzw6fvOMpiyd4aT2r585NKsIR0ERnNhD+9R56AbdArKJ1zRh5nCI9LcL wQF3o5g8OFMPlJbfCn41k/Fxf3/zIZv/GTLoxQ== ) am. 43200 IN RRSIG ( DNSKEY 7 1 43200 20191015052455 20190915043739 59123 am. AhwB7jBLQLwtDkkP/+107vlt7gTG6WR2ojMf+kYj83V5jdV/+Sn+1GeVhLzICeiz+RQA003lVGkD hnTG+ObLgxlUst7nBRV6tJclb6GrH2xbFiluQ8fYPmvt7c3m1cIa370em8ws3CQBIHKAhUEdR9Gj BFbYGScxVDI2VnDgmjM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 5 DNSKEY records for am
	`am. 43200 IN DNSKEY ( 256 3 7 AwEAAZtBhFUye5OaMl9lONkxWgrWrD6OctOSK8/fVrOyOk8ZjnP+Jv+qsrBznx+eOs82g8U8I9Tu MDThSQSVt7WeF7hFgGXaj6U1sut6OanHaZHBtmds/CS7IMa2HjBAnifZBSyTUR3RX8v/BIRSqPq4 8Q2xlG8It09gXkG32xtzMSIp ) ; Key ID = 62294`
	`am. 43200 IN DNSKEY ( 256 3 7 AwEAAa1WeAzqfUcQCAuRN5F14WwlTsg2vccDoCww6Nku2ns3zX5DPOo7ErSE1UNrQiocXHWZWNUg a0GpfsvdE1/NHOCDnJfd2Hugm6zNIMgiQ/VEaRyx5rU592aQMMwdlKHkJMLduVNSa41j/80/Mp/b QBDazueJtA4Jke87WcEQ+UPF ) ; Key ID = 50354`
	`am. 43200 IN DNSKEY ( 257 3 7 AwEAAbu7W3rkAxkYJOUw4ONmCcba/WaFDz3KCFmjkL1Q+t1HpheLgXfirliNipENGSnovWh9jk/e oRW/INeJQqNTjYuQuioJw4oDO5eh5UoBB26R3aK78O72l4GZ4SgVMuyXQgvPgqWCboJ/pvXkpoQ1 2NQxLaXDQJyzsBNXoPwU9kzqHOxgM/UhK1MOLAFTv+BEKTEgY9v1MnFCN0Cqx045+USAfTBkvo9W rYuyFr7oSi7MPyKU5cl49Q5+Kr9kMCLgdH1YOzH+3vOKv5DztSzyp4RYOcy6zom+t6Dx+2lwnKHv E1X7fM1RxX66Sh/uwAhrZPT3TXHOgt5oIZTa8/Ol50E= ) ; Key ID = 32829`
	`am. 43200 IN DNSKEY ( 256 3 7 AwEAAbGx56++Xu++LRXXbc4LvQdyfjSo3ikmi1FXxcjYs409MPbxY+/DLOLJ9T/fpgCC8HToo5cO 1pEBbERTFbuj/br5UILFiVQHgPXHFud1oLG5h9SsTn6PSwLFiw1KTi5aGmosVNDQFQwaaZJTZr5B 05pJl4aEPPNGxNeszXcmjnnB ) ; Key ID = 59123`
	`am. 43200 IN DNSKEY ( 257 3 7 AwEAAZawAjd4056P/UPnGBlTtawBwkgrGCZswWE5pN8qkpDpUrbmxX53+NkmVHVL3fCtNfILPNdq jmcXG0jbBlRlRSwc41nZQ10e1O+8D5EIUNaAt1c80PLiRgn9vTDhJptIfudlvsA0UUeVyqLa57/Q 2I/8EGvD4rPvRdFHHtTCyISsnk60C+UsD50o3jn65PY0nTlw8iMEz9Y2Wbx9GM+Kd2ETUQ0gtEVZ Ctw2yjfByalW0tzf6eE46l275dv2Y9KMG+eDK/iTl/79vytpLJADzyxnjSMTfBBWHtwQuOaNXYhU 3Zpcr8HlMgewDN6LogCA1gWBP4vT+LjghmWz8sQAXaU= ) ; Key ID = 9804`
	DNSKEY=9804/SEP is now in the chain-of-trust
	DS=9804/SHA-256 verifies DNSKEY=9804/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`am. 43200 IN RRSIG ( DNSKEY 7 1 43200 20191015052455 20190915043739 9804 am. A2VLNL0WdwCH/rr6nTdvEhkcaffzlkzyF3ZugzD0ADjTwPdFZwBZdR3wNqssluYKfwAPEHN46mjh IuuvKgGSFzF2xKceTXyOzDu+Mz5Fp9P09yKvTGlg40Of8EXcfcJAZ16XO6U2XfB6Bz2i61EBYsWW JAS6GccXWH+z8elz6NVyCFXsLLkwq8R7VDAbYaLZN65MMGMxuVETigYvsUXQqo8LNa6HHqcWgfGd M+3Nf5msyD27R/TEh/F0Kzw6fvOMpiyd4aT2r585NKsIR0ERnNhD+9R56AbdArKJ1zRh5nCI9LcL wQF3o5g8OFMPlJbfCn41k/Fxf3/zIZv/GTLoxQ== )`
	`am. 43200 IN RRSIG ( DNSKEY 7 1 43200 20191015052455 20190915043739 59123 am. AhwB7jBLQLwtDkkP/+107vlt7gTG6WR2ojMf+kYj83V5jdV/+Sn+1GeVhLzICeiz+RQA003lVGkD hnTG+ObLgxlUst7nBRV6tJclb6GrH2xbFiluQ8fYPmvt7c3m1cIa370em8ws3CQBIHKAhUEdR9Gj BFbYGScxVDI2VnDgmjM= )`
	RRSIG=9804 and DNSKEY=9804/SEP verifies the DNSKEY RRset
	RRSIG=59123 and DNSKEY=59123 verifies the DNSKEY RRset
	DNSKEY=62294 is now in the chain-of-trust
	DNSKEY=50354 is now in the chain-of-trust
	DNSKEY=32829/SEP is now in the chain-of-trust
	DNSKEY=59123 is now in the chain-of-trust
	Query to ns-pri.nic.am for aa.am/A
	Received 572 bytes from 195.43.75.53
	;; Answer received from 195.43.75.53 (572 bytes) ;; HEADER SECTION ;; id = 32836 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; aa.am. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) aa.am. 43200 IN NS ns1.20dragons.com. aa.am. 43200 IN NS ns2.20dragons.com. MCH4B9JR7OLVN96TJDHR1SE2CTCN7S94.am. 7200 IN NSEC3 ( 1 1 10 bed68c mffpcrfetfeg61jrthlpveq7q3an438d NS SOA TXT RRSIG DNSKEY NSEC3PARAM ) MCH4B9JR7OLVN96TJDHR1SE2CTCN7S94.am. 7200 IN RRSIG ( NSEC3 7 2 7200 20191015062915 20190915055427 59123 am. YF402DpKQ7E5rlvbKKX/VsFid4w6F3dioeRErpAhtCzHh7iKXbSoPiAPv3RupglmcQli+G48KllQ jQkrYdVup4t32GXsl8sXDawD2ARt2f4lFRzY6KbKJh8+js6zJL14AT+BrSw6fvKotNnsWktrK//y bgUDct2RURMdZINIdFs= ) U1H2GBG17OSQOOS8QNUSGB8QK8M11NQ0.am. 7200 IN NSEC3 ( 1 1 10 bed68c 31vcnkn0sv5qmmhm1235211v4fnicsed NS DS RRSIG ) U1H2GBG17OSQOOS8QNUSGB8QK8M11NQ0.am. 7200 IN RRSIG ( NSEC3 7 2 7200 20191015042258 20190915040854 59123 am. UxzKwI+3wdobU+ZApeddFNtq7rguxjVNYLXusAOSl/yrSN9ndiyraXOyRK9xJQQkSJWAbpA2UemT j0to7+7SkDJ7oVKS0rzz3ZCK24iw+9PGqxIO3ZHWyColJSjXJt8Hu4QNCiBtFDYi6iDgJepxzLi4 PppNZXU0UbojqV2Cuzg= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to ns-pri.nic.am for aa.am/DNSKEY
	Error querying ns-pri.nic.am/2001:7f9:8:53:0:0:0:1 for aa.am/DNSKEY: 'IPv6 transport disabled'
	Received 572 bytes from 195.43.75.53
	;; Answer received from 195.43.75.53 (572 bytes) ;; HEADER SECTION ;; id = 6229 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; aa.am. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) aa.am. 43200 IN NS ns2.20dragons.com. aa.am. 43200 IN NS ns1.20dragons.com. MCH4B9JR7OLVN96TJDHR1SE2CTCN7S94.am. 7200 IN NSEC3 ( 1 1 10 bed68c mffpcrfetfeg61jrthlpveq7q3an438d NS SOA TXT RRSIG DNSKEY NSEC3PARAM ) MCH4B9JR7OLVN96TJDHR1SE2CTCN7S94.am. 7200 IN RRSIG ( NSEC3 7 2 7200 20191015062915 20190915055427 59123 am. YF402DpKQ7E5rlvbKKX/VsFid4w6F3dioeRErpAhtCzHh7iKXbSoPiAPv3RupglmcQli+G48KllQ jQkrYdVup4t32GXsl8sXDawD2ARt2f4lFRzY6KbKJh8+js6zJL14AT+BrSw6fvKotNnsWktrK//y bgUDct2RURMdZINIdFs= ) U1H2GBG17OSQOOS8QNUSGB8QK8M11NQ0.am. 7200 IN NSEC3 ( 1 1 10 bed68c 31vcnkn0sv5qmmhm1235211v4fnicsed NS DS RRSIG ) U1H2GBG17OSQOOS8QNUSGB8QK8M11NQ0.am. 7200 IN RRSIG ( NSEC3 7 2 7200 20191015042258 20190915040854 59123 am. UxzKwI+3wdobU+ZApeddFNtq7rguxjVNYLXusAOSl/yrSN9ndiyraXOyRK9xJQQkSJWAbpA2UemT j0to7+7SkDJ7oVKS0rzz3ZCK24iw+9PGqxIO3ZHWyColJSjXJt8Hu4QNCiBtFDYi6iDgJepxzLi4 PppNZXU0UbojqV2Cuzg= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone aa.am

aa.am

	Checking DS between am and aa.am
	Query to fork.sth.dnsnode.net for aa.am/DS
	Error querying fork.sth.dnsnode.net/2a01:3f0:0:306:0:0:0:53 for aa.am/DS: 'IPv6 transport disabled'
	Received 745 bytes from 77.72.229.254
	;; Answer received from 77.72.229.254 (745 bytes) ;; HEADER SECTION ;; id = 61670 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; aa.am. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) MCH4B9JR7OLVN96TJDHR1SE2CTCN7S94.am. 7200 IN NSEC3 ( 1 1 10 bed68c mffpcrfetfeg61jrthlpveq7q3an438d NS SOA TXT RRSIG DNSKEY NSEC3PARAM ) MCH4B9JR7OLVN96TJDHR1SE2CTCN7S94.am. 7200 IN RRSIG ( NSEC3 7 2 7200 20191015062915 20190915055427 59123 am. YF402DpKQ7E5rlvbKKX/VsFid4w6F3dioeRErpAhtCzHh7iKXbSoPiAPv3RupglmcQli+G48KllQ jQkrYdVup4t32GXsl8sXDawD2ARt2f4lFRzY6KbKJh8+js6zJL14AT+BrSw6fvKotNnsWktrK//y bgUDct2RURMdZINIdFs= ) am. 7200 IN SOA ( ns-pri.nic.am. dns.amnic.net. 1568904003 ;serial 43200 ;refresh 7200 ;retry 1728000 ;expire 7200 ;minimum ) am. 7200 IN RRSIG ( SOA 7 1 43200 20191019144006 20190919134006 59123 am. K9dt921mOtN4fAsAkFlB/DrW5DK6iALi4+E+dizRzOWB3b6eg2h1lej/pWxXhh57GgoJqLclTnX3 h5UbV3WHprznw83P3ybkEJ63Dj3TkTdvHk1E8+Z8zK90ioGCmwd81LMBScObCq1aC0fYT/B0Roaq bf7aPibsXIY/8ERgIl0= ) U1H2GBG17OSQOOS8QNUSGB8QK8M11NQ0.am. 7200 IN NSEC3 ( 1 1 10 bed68c 31vcnkn0sv5qmmhm1235211v4fnicsed NS DS RRSIG ) U1H2GBG17OSQOOS8QNUSGB8QK8M11NQ0.am. 7200 IN RRSIG ( NSEC3 7 2 7200 20191015042258 20190915040854 59123 am. UxzKwI+3wdobU+ZApeddFNtq7rguxjVNYLXusAOSl/yrSN9ndiyraXOyRK9xJQQkSJWAbpA2UemT j0to7+7SkDJ7oVKS0rzz3ZCK24iw+9PGqxIO3ZHWyColJSjXJt8Hu4QNCiBtFDYi6iDgJepxzLi4 PppNZXU0UbojqV2Cuzg= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	No DS records found for aa.am in the am zone
	Query to ns2.20dragons.com for aa.am/DNSKEY
	Received 215 bytes from 107.172.60.68
	;; Answer received from 107.172.60.68 (215 bytes) ;; HEADER SECTION ;; id = 39251 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option: ;; QUESTION SECTION (1 record) ;; aa.am. IN DNSKEY ;; ANSWER SECTION (2 records) aa.am. 7200 IN RRSIG ( DNSKEY 13 2 7200 20191003000000 20190912000000 39176 aa.am. MHCsfubrgZTIUBm01s60ixFubpQXuNYUnYMYM7jtQ+9K5ZjoHtQbGPfGehLCK/Zhd1WXP3l/krJJ OkvUYPpWLA== ) aa.am. 7200 IN DNSKEY ( 257 3 13 w4a6VW5aEst3/wiL5Yu2eUe32eeit+RBlqlDgqrItWuqDDWOYeu6xqrV6p/ElY2Ni00FKPTmzFQE 3ojcMDWi6A== ) ; Key ID = 39176 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option:
	Found 1 DNSKEY records for aa.am
	`aa.am. 7200 IN DNSKEY ( 257 3 13 w4a6VW5aEst3/wiL5Yu2eUe32eeit+RBlqlDgqrItWuqDDWOYeu6xqrV6p/ElY2Ni00FKPTmzFQE 3ojcMDWi6A== ) ; Key ID = 39176`
	Found 1 RRSIGs over DNSKEY RRset
	`aa.am. 7200 IN RRSIG ( DNSKEY 13 2 7200 20191003000000 20190912000000 39176 aa.am. MHCsfubrgZTIUBm01s60ixFubpQXuNYUnYMYM7jtQ+9K5ZjoHtQbGPfGehLCK/Zhd1WXP3l/krJJ OkvUYPpWLA== )`
	RRSIG=39176 and DNSKEY=39176/SEP verifies the DNSKEY RRset
	Query to ns1.20dragons.com for aa.am/A
	Received 151 bytes from 77.81.110.236
	;; Answer received from 77.81.110.236 (151 bytes) ;; HEADER SECTION ;; id = 63208 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option: ;; QUESTION SECTION (1 record) ;; aa.am. IN A ;; ANSWER SECTION (2 records) aa.am. 86400 IN RRSIG ( A 13 2 86400 20191003000000 20190912000000 39176 aa.am. 2dJwexDo/2V9O1qdYwi6fttYbV6++zrNst6mIeWhkAfaeQ5Z1y65qKuf/R3qk7Gh5Tl8MDnnu4XK NfX9n0KG7A== ) aa.am. 86400 IN A 185.164.136.124 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option:
	aa.am is authoritative for aa.am
	Found RRSIG signed by aa.am zone
	Query to ns2.20dragons.com for aa.am/SOA
	Received 195 bytes from 107.172.60.68
	;; Answer received from 107.172.60.68 (195 bytes) ;; HEADER SECTION ;; id = 62875 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option: ;; QUESTION SECTION (1 record) ;; aa.am. IN SOA ;; ANSWER SECTION (2 records) aa.am. 3600 IN RRSIG ( SOA 13 2 3600 20191003000000 20190912000000 39176 aa.am. NvxX1hjE+82sr2t0xD9049c5ceCxgHYokX3RJMOEJlmvZvF/KAQLcMV1NC7S7UT3f+YcIWCfjKlk CPgweV99Lg== ) aa.am. 3600 IN SOA ( ns1.20dragons.com. admin1.20dragons.com. 2019091907 ;serial 14400 ;refresh 3600 ;retry 604800 ;expire 7200 ;minimum ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option:
	Query to ns1.20dragons.com for aa.am/SOA
	Error querying ns1.20dragons.com/2001:ac8:22:2:0:0:11fc:6413 for aa.am/SOA: 'IPv6 transport disabled'
	Received 195 bytes from 77.81.110.236
	;; Answer received from 77.81.110.236 (195 bytes) ;; HEADER SECTION ;; id = 63868 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option: ;; QUESTION SECTION (1 record) ;; aa.am. IN SOA ;; ANSWER SECTION (2 records) aa.am. 3600 IN SOA ( ns1.20dragons.com. admin1.20dragons.com. 2019091907 ;serial 14400 ;refresh 3600 ;retry 604800 ;expire 7200 ;minimum ) aa.am. 3600 IN RRSIG ( SOA 13 2 3600 20191003000000 20190912000000 39176 aa.am. NvxX1hjE+82sr2t0xD9049c5ceCxgHYokX3RJMOEJlmvZvF/KAQLcMV1NC7S7UT3f+YcIWCfjKlk CPgweV99Lg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option:
	Query to ns1.20dragons.com for aa.am/A
	Error querying ns1.20dragons.com/2001:ac8:22:2:0:0:11fc:6413 for aa.am/A: 'IPv6 transport disabled'
	Received 151 bytes from 77.81.110.236
	;; Answer received from 77.81.110.236 (151 bytes) ;; HEADER SECTION ;; id = 32013 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option: ;; QUESTION SECTION (1 record) ;; aa.am. IN A ;; ANSWER SECTION (2 records) aa.am. 86400 IN RRSIG ( A 13 2 86400 20191003000000 20190912000000 39176 aa.am. 2dJwexDo/2V9O1qdYwi6fttYbV6++zrNst6mIeWhkAfaeQ5Z1y65qKuf/R3qk7Gh5Tl8MDnnu4XK NfX9n0KG7A== ) aa.am. 86400 IN A 185.164.136.124 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option:
	aa.am A RR has value 185.164.136.124
	Found 1 RRSIGs over A RRset
	`aa.am. 86400 IN RRSIG ( A 13 2 86400 20191003000000 20190912000000 39176 aa.am. 2dJwexDo/2V9O1qdYwi6fttYbV6++zrNst6mIeWhkAfaeQ5Z1y65qKuf/R3qk7Gh5Tl8MDnnu4XK NfX9n0KG7A== )`
	RRSIG=39176 and DNSKEY=39176/SEP verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test aa.am at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: