DNSSEC Analyzer - dnssec-analyzer.verisignlabs.com

Domain Name:

Time: 2023-07-05 08:29:18 UTC, NTP stratum 4

Analyzing DNSSEC problems for dnssec-analyzer.verisignlabs.com

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to d.root-servers.net for ./DNSKEY
	Received 1139 bytes from 199.7.91.13
	;; Response received from 199.7.91.13 (1139 octets) ;; HEADER SECTION ;; id = 36511 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1450 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAbF1LAxEQPtClEQno48k6u7JjCOfVfwdENOxQUrX0JbpN5DnKGMAKIfdiWa5oDeKQ3OoQ58y CC8vjtaaGFDgpJxoLwqzhBYHPGFgins5HIERcCQPGAJKWu/ku4XLh+Fu7UyBubDCelxKTbnj26Ew bochltRqGIE8hbwSXEzRNo4g+NXkaRMq2FFbaBtEE82yTmZUgFRYAFUvfGTPWblyZGtkepVuHyNb 0w/u24dpsz+uyCZZR04cHfRrWOKvqD3lDOwC4+sqd6f7F841R0N2tqSh/WDUZzWdvPBaBOz0FWFL b9porIeZ3Jm08tAMHa+3SGRXfK4RAmxVCmIQQypGabE= ) ; Key ID = 60955 . 172800 IN DNSKEY ( 256 3 8 AwEAAcEtWatIO3exfN3A+WnZl7AVEBA3crRrrwKTfnmcdLt79C3DCOF1JX5zb4s84v0OxwlOVg+T R8VpkuYynMp3PQXLomLxe7j7PlxqEBo1LQaWfqyymCuF7rKebTLB5yZcr8/QUPwk/weLyguX6iVN DjIZOmeMqPkGJtDFp+EUfKgOa8AulKPLtsUL1W+1FT8sqroSxKXVXnhkEZN1O1zBxTG/z9xjwiPc d3//LSPUpEC9+rU2XIuCJq8nwAwJ7W6Rc49RxUT0Svc57HKqHjNuapvG0PCYh3bXCQzb7mb2pNwu erMFTzP5iEzXWZD7izLg9j3wEJ2Ia/WIEts/Tp9GIQM= ) ; Key ID = 11019 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20230722000000 20230701000000 20326 . l2cHcDB5PUjALpTR78ar1JOCC0Y05oz5+c6IZhr35MZ4dCnw0Dn6qbDzOVRl2INlonN5RFB2+Abx 5UeTnBdOqlcujs5p5/t0wTCAzMM9JgNFVB8nOE5ZADfmOv04vM1ofXE2GN3OHBoAV0KaxG/mcJHq qlj1HBQcft0w3Z+IxQUEfTemj3jruLBLaVB8ashCDjjMGztrxj5+z57n+0NNmS3rYTVVES9egc7b TcpGeaWw6rqSMBFq2S3yRRkuBatvMBzoipesgjUr8j0MuwRMmKNd9indIWgchMHlZ4jdN7Ff9dO5 IEvyKdlNOzIXxLb+47qVJtNZEn5duEQRd4Izzw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1450 ;; option:
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbF1LAxEQPtClEQno48k6u7JjCOfVfwdENOxQUrX0JbpN5DnKGMAKIfdiWa5oDeKQ3OoQ58y CC8vjtaaGFDgpJxoLwqzhBYHPGFgins5HIERcCQPGAJKWu/ku4XLh+Fu7UyBubDCelxKTbnj26Ew bochltRqGIE8hbwSXEzRNo4g+NXkaRMq2FFbaBtEE82yTmZUgFRYAFUvfGTPWblyZGtkepVuHyNb 0w/u24dpsz+uyCZZR04cHfRrWOKvqD3lDOwC4+sqd6f7F841R0N2tqSh/WDUZzWdvPBaBOz0FWFL b9porIeZ3Jm08tAMHa+3SGRXfK4RAmxVCmIQQypGabE= ) ; Key ID = 60955`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAcEtWatIO3exfN3A+WnZl7AVEBA3crRrrwKTfnmcdLt79C3DCOF1JX5zb4s84v0OxwlOVg+T R8VpkuYynMp3PQXLomLxe7j7PlxqEBo1LQaWfqyymCuF7rKebTLB5yZcr8/QUPwk/weLyguX6iVN DjIZOmeMqPkGJtDFp+EUfKgOa8AulKPLtsUL1W+1FT8sqroSxKXVXnhkEZN1O1zBxTG/z9xjwiPc d3//LSPUpEC9+rU2XIuCJq8nwAwJ7W6Rc49RxUT0Svc57HKqHjNuapvG0PCYh3bXCQzb7mb2pNwu erMFTzP5iEzXWZD7izLg9j3wEJ2Ia/WIEts/Tp9GIQM= ) ; Key ID = 11019`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20230722000000 20230701000000 20326 . l2cHcDB5PUjALpTR78ar1JOCC0Y05oz5+c6IZhr35MZ4dCnw0Dn6qbDzOVRl2INlonN5RFB2+Abx 5UeTnBdOqlcujs5p5/t0wTCAzMM9JgNFVB8nOE5ZADfmOv04vM1ofXE2GN3OHBoAV0KaxG/mcJHq qlj1HBQcft0w3Z+IxQUEfTemj3jruLBLaVB8ashCDjjMGztrxj5+z57n+0NNmS3rYTVVES9egc7b TcpGeaWw6rqSMBFq2S3yRRkuBatvMBzoipesgjUr8j0MuwRMmKNd9indIWgchMHlZ4jdN7Ff9dO5 IEvyKdlNOzIXxLb+47qVJtNZEn5duEQRd4Izzw== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=60955 is now in the chain-of-trust
	DNSKEY=11019 is now in the chain-of-trust
	Query to m.root-servers.net for dnssec-analyzer.verisignlabs.com/A
	Received 1195 bytes from 202.12.27.33
	;; Response received from 202.12.27.33 (1195 octets) ;; HEADER SECTION ;; id = 1758 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 15 arcount = 27 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer.verisignlabs.com. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 86400 IN DS ( 30909 8 2 e2d3c916f6deeac73294e8268fb5885044a833fc5459588f4a9184cfc41a5766 ) com. 86400 IN RRSIG ( DS 8 1 86400 20230718050000 20230705040000 11019 . mqSH0xOMoOZfUTbW8Nl7uC+G9G4+THK242i2mVJLVeczdVN0Mnsfi2YM0n33P3Yn3SRg78XllfbK ttYbQdqn0ybALM5vkvtV/ltP7Z5Upo4qh2ksBy8vWXCgiD4Jqs8Hy8XiT6aSEEPYtfbh+jH1GU1L mw6qDif//55iImq2AG7+Pw+xt5qF9UOhlTkgXCi6/juYcuuDo5JCEgu//NSwToeSAi5SbLT8BXdz LAvlBvuZ0SdIAkAxDGrTr+ZDRBpGipC/edv6LlKtqx8zWjUP7SbCHCY+DTcolvTp8fgeIuhtqmem QYPbtTfgjtsU6MR1frLj4Mulkqnvsdt+99eImg== ) ;; ADDITIONAL SECTION (27 records) m.gtld-servers.net. 172800 IN A 192.55.83.30 l.gtld-servers.net. 172800 IN A 192.41.162.30 k.gtld-servers.net. 172800 IN A 192.52.178.30 j.gtld-servers.net. 172800 IN A 192.48.79.30 i.gtld-servers.net. 172800 IN A 192.43.172.30 h.gtld-servers.net. 172800 IN A 192.54.112.30 g.gtld-servers.net. 172800 IN A 192.42.93.30 f.gtld-servers.net. 172800 IN A 192.35.51.30 e.gtld-servers.net. 172800 IN A 192.12.94.30 d.gtld-servers.net. 172800 IN A 192.31.80.30 c.gtld-servers.net. 172800 IN A 192.26.92.30 b.gtld-servers.net. 172800 IN A 192.33.14.30 a.gtld-servers.net. 172800 IN A 192.5.6.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to c.root-servers.net for com/DNSKEY
	Received 1163 bytes from 192.33.4.12
	;; Response received from 192.33.4.12 (1163 octets) ;; HEADER SECTION ;; id = 1712 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 15 arcount = 27 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; com. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 86400 IN DS ( 30909 8 2 e2d3c916f6deeac73294e8268fb5885044a833fc5459588f4a9184cfc41a5766 ) com. 86400 IN RRSIG ( DS 8 1 86400 20230718050000 20230705040000 11019 . mqSH0xOMoOZfUTbW8Nl7uC+G9G4+THK242i2mVJLVeczdVN0Mnsfi2YM0n33P3Yn3SRg78XllfbK ttYbQdqn0ybALM5vkvtV/ltP7Z5Upo4qh2ksBy8vWXCgiD4Jqs8Hy8XiT6aSEEPYtfbh+jH1GU1L mw6qDif//55iImq2AG7+Pw+xt5qF9UOhlTkgXCi6/juYcuuDo5JCEgu//NSwToeSAi5SbLT8BXdz LAvlBvuZ0SdIAkAxDGrTr+ZDRBpGipC/edv6LlKtqx8zWjUP7SbCHCY+DTcolvTp8fgeIuhtqmem QYPbtTfgjtsU6MR1frLj4Mulkqnvsdt+99eImg== ) ;; ADDITIONAL SECTION (27 records) m.gtld-servers.net. 172800 IN A 192.55.83.30 l.gtld-servers.net. 172800 IN A 192.41.162.30 k.gtld-servers.net. 172800 IN A 192.52.178.30 j.gtld-servers.net. 172800 IN A 192.48.79.30 i.gtld-servers.net. 172800 IN A 192.43.172.30 h.gtld-servers.net. 172800 IN A 192.54.112.30 g.gtld-servers.net. 172800 IN A 192.42.93.30 f.gtld-servers.net. 172800 IN A 192.35.51.30 e.gtld-servers.net. 172800 IN A 192.12.94.30 d.gtld-servers.net. 172800 IN A 192.31.80.30 c.gtld-servers.net. 172800 IN A 192.26.92.30 b.gtld-servers.net. 172800 IN A 192.33.14.30 a.gtld-servers.net. 172800 IN A 192.5.6.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found child zone com

com

	Checking DS between . and com
	Query to g.root-servers.net for com/DS
	Received 367 bytes from 192.112.36.4
	;; Response received from 192.112.36.4 (367 octets) ;; HEADER SECTION ;; id = 59336 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; com. IN DS ;; ANSWER SECTION (2 records) com. 86400 IN DS ( 30909 8 2 e2d3c916f6deeac73294e8268fb5885044a833fc5459588f4a9184cfc41a5766 ) com. 86400 IN RRSIG ( DS 8 1 86400 20230718050000 20230705040000 11019 . mqSH0xOMoOZfUTbW8Nl7uC+G9G4+THK242i2mVJLVeczdVN0Mnsfi2YM0n33P3Yn3SRg78XllfbK ttYbQdqn0ybALM5vkvtV/ltP7Z5Upo4qh2ksBy8vWXCgiD4Jqs8Hy8XiT6aSEEPYtfbh+jH1GU1L mw6qDif//55iImq2AG7+Pw+xt5qF9UOhlTkgXCi6/juYcuuDo5JCEgu//NSwToeSAi5SbLT8BXdz LAvlBvuZ0SdIAkAxDGrTr+ZDRBpGipC/edv6LlKtqx8zWjUP7SbCHCY+DTcolvTp8fgeIuhtqmem QYPbtTfgjtsU6MR1frLj4Mulkqnvsdt+99eImg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 1 DS records for com in the . zone
	DS=30909/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`com. 86400 IN RRSIG ( DS 8 1 86400 20230718050000 20230705040000 11019 . mqSH0xOMoOZfUTbW8Nl7uC+G9G4+THK242i2mVJLVeczdVN0Mnsfi2YM0n33P3Yn3SRg78XllfbK ttYbQdqn0ybALM5vkvtV/ltP7Z5Upo4qh2ksBy8vWXCgiD4Jqs8Hy8XiT6aSEEPYtfbh+jH1GU1L mw6qDif//55iImq2AG7+Pw+xt5qF9UOhlTkgXCi6/juYcuuDo5JCEgu//NSwToeSAi5SbLT8BXdz LAvlBvuZ0SdIAkAxDGrTr+ZDRBpGipC/edv6LlKtqx8zWjUP7SbCHCY+DTcolvTp8fgeIuhtqmem QYPbtTfgjtsU6MR1frLj4Mulkqnvsdt+99eImg== )`
	RRSIG=11019 and DNSKEY=11019 verifies the DS RRset
	DS=30909/SHA-256 is now in the chain-of-trust
	`com. 86400 IN DS ( 30909 8 2 e2d3c916f6deeac73294e8268fb5885044a833fc5459588f4a9184cfc41a5766 )`
	Query to m.gtld-servers.net for com/DNSKEY
	Received 777 bytes from 192.55.83.30
	;; Response received from 192.55.83.30 (777 octets) ;; HEADER SECTION ;; id = 65490 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; com. IN DNSKEY ;; ANSWER SECTION (3 records) com. 86400 IN DNSKEY ( 256 3 8 AwEAAafzT8S3jJvYeZ0v2q6ot5LyCeY3ldQvUrDBeDmtf4Js4ZSHNK/LPZO8GGQBabsq0dsTm1ur GjjV7j8eWtdEXIGZWBY8nE2QNmZ61B2X7xVqJGTn1QlRz4HdeqDOAL2TyU/P4cI6sq/X8xCs4kj2 vBmVYENMMNEYXlIWG74uKF/MrZP3/p8IjiFBF2Jes3jKZk6WY9Y1OiQFmo9JzeVzU+M= ) ; Key ID = 46551 com. 86400 IN DNSKEY ( 257 3 8 AQPDzldNmMvZFX4NcNJ0uEnKDg7tmv/F3MyQR0lpBmVcNcsIszxNFxsBfKNW9JYCYqpik8366LE7 VbIcNRzfp2h9OO8HRl+H+E08zauK8k7evWEmu/6od+2boggPoiEfGNyvNPaSI7FOIroDsnw/tagg zHRX1Z7SOiOiPWPNIwSUyWOZ79VmcQ1GLkC6NlYvG3HwYmynQv6oFwGv/KELSw7ZSdrbTQ0HXvZb qMUI7BaMskmvgm1G7oKZ1YiF7O9ioVNc0+7ASbqmZN7Z98EGU/Qh2K/BgUe8Hs0XVcdPKrtyYnoQ Hd2ynKPcMMlTEih2/2HDHjRPJ2aywIpKNnv4oPo/ ) ; Key ID = 30909 com. 86400 IN RRSIG ( DNSKEY 8 1 86400 20230714172421 20230629171921 30909 com. Sj6SLc++M1esbeLyO4JZH+BZ3WKRACCjJDsFCxK17UKwHhr43l9+Mt3O3zG3JdV3veVZcE4n4jlR 2D3WLRvdqd/ZtBhFj91kWIXs+zjDZOdIsqlOKUjqlLCocbsx1lZl4+nPay9LIoETo+nc4WAr1s8k Cpu/MvtTIxSUEagXriFpRWPmsJXvNWOBxhTQDnkaiNe5/BdhYKa2EC7bD98D4xVmDMe7pGUaJhJQ uKD77zUUxK24sYlPO40W7qIXqkLTSSxriqg0hATqeACkvnpZgj8GSGSd5pw3BuNCK6c8GAkUGcQj 53lTZ0YVfLpp2jydRF28tdMh/knloRQAanyYnw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DNSKEY records for com
	`com. 86400 IN DNSKEY ( 256 3 8 AwEAAafzT8S3jJvYeZ0v2q6ot5LyCeY3ldQvUrDBeDmtf4Js4ZSHNK/LPZO8GGQBabsq0dsTm1ur GjjV7j8eWtdEXIGZWBY8nE2QNmZ61B2X7xVqJGTn1QlRz4HdeqDOAL2TyU/P4cI6sq/X8xCs4kj2 vBmVYENMMNEYXlIWG74uKF/MrZP3/p8IjiFBF2Jes3jKZk6WY9Y1OiQFmo9JzeVzU+M= ) ; Key ID = 46551`
	`com. 86400 IN DNSKEY ( 257 3 8 AQPDzldNmMvZFX4NcNJ0uEnKDg7tmv/F3MyQR0lpBmVcNcsIszxNFxsBfKNW9JYCYqpik8366LE7 VbIcNRzfp2h9OO8HRl+H+E08zauK8k7evWEmu/6od+2boggPoiEfGNyvNPaSI7FOIroDsnw/tagg zHRX1Z7SOiOiPWPNIwSUyWOZ79VmcQ1GLkC6NlYvG3HwYmynQv6oFwGv/KELSw7ZSdrbTQ0HXvZb qMUI7BaMskmvgm1G7oKZ1YiF7O9ioVNc0+7ASbqmZN7Z98EGU/Qh2K/BgUe8Hs0XVcdPKrtyYnoQ Hd2ynKPcMMlTEih2/2HDHjRPJ2aywIpKNnv4oPo/ ) ; Key ID = 30909`
	DNSKEY=30909/SEP is now in the chain-of-trust
	DS=30909/SHA-256 verifies DNSKEY=30909/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`com. 86400 IN RRSIG ( DNSKEY 8 1 86400 20230714172421 20230629171921 30909 com. Sj6SLc++M1esbeLyO4JZH+BZ3WKRACCjJDsFCxK17UKwHhr43l9+Mt3O3zG3JdV3veVZcE4n4jlR 2D3WLRvdqd/ZtBhFj91kWIXs+zjDZOdIsqlOKUjqlLCocbsx1lZl4+nPay9LIoETo+nc4WAr1s8k Cpu/MvtTIxSUEagXriFpRWPmsJXvNWOBxhTQDnkaiNe5/BdhYKa2EC7bD98D4xVmDMe7pGUaJhJQ uKD77zUUxK24sYlPO40W7qIXqkLTSSxriqg0hATqeACkvnpZgj8GSGSd5pw3BuNCK6c8GAkUGcQj 53lTZ0YVfLpp2jydRF28tdMh/knloRQAanyYnw== )`
	RRSIG=30909 and DNSKEY=30909/SEP verifies the DNSKEY RRset
	DNSKEY=46551 is now in the chain-of-trust
	Query to g.gtld-servers.net for dnssec-analyzer.verisignlabs.com/A
	Received 558 bytes from 192.42.93.30
	;; Response received from 192.42.93.30 (558 octets) ;; HEADER SECTION ;; id = 51708 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer.verisignlabs.com. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) verisignlabs.com. 172800 IN NS av1.nstld.com. verisignlabs.com. 172800 IN NS av2.nstld.com. verisignlabs.com. 172800 IN NS av3.nstld.com. verisignlabs.com. 172800 IN NS av4.nstld.com. verisignlabs.com. 86400 IN DS ( 57947 8 2 64877db0ea66b229fbe8380decf40a8ba36114f5fb34b5bfaef0716d6029638d ) verisignlabs.com. 86400 IN RRSIG ( DS 8 2 86400 20230711041708 20230704030708 46551 com. o1Tb1w3QHboKOyJYZpqdaD0mxqD59ZrxjA7NwzRgIg/0TZ5On6wzMclfjSL/508nafshopnD2bgM OCtRbK93eTfId10kP3hVF3U9saJLeAcEQJzJcHuLr/0/9PH6+loX/DxNfYFciKoI5IIT90e+e6Lc O0zmMqDPBl4OXU8PpZY5ifcumLzdiIHU4yuYdWLfxG7reR2GgTuHiwMqVmbFPA== ) ;; ADDITIONAL SECTION (9 records) av1.nstld.com. 172800 IN A 192.42.177.30 av1.nstld.com. 172800 IN AAAA 2001:500:124::30 av2.nstld.com. 172800 IN A 192.42.178.30 av2.nstld.com. 172800 IN AAAA 2001:500:125::30 av3.nstld.com. 172800 IN A 192.82.133.30 av3.nstld.com. 172800 IN AAAA 2001:500:126::30 av4.nstld.com. 172800 IN A 192.82.134.30 av4.nstld.com. 172800 IN AAAA 2001:500:127::30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to a.gtld-servers.net for verisignlabs.com/DNSKEY
	Received 542 bytes from 192.5.6.30
	;; Response received from 192.5.6.30 (542 octets) ;; HEADER SECTION ;; id = 58907 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; verisignlabs.com. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) verisignlabs.com. 172800 IN NS av1.nstld.com. verisignlabs.com. 172800 IN NS av2.nstld.com. verisignlabs.com. 172800 IN NS av3.nstld.com. verisignlabs.com. 172800 IN NS av4.nstld.com. verisignlabs.com. 86400 IN DS ( 57947 8 2 64877db0ea66b229fbe8380decf40a8ba36114f5fb34b5bfaef0716d6029638d ) verisignlabs.com. 86400 IN RRSIG ( DS 8 2 86400 20230711041708 20230704030708 46551 com. o1Tb1w3QHboKOyJYZpqdaD0mxqD59ZrxjA7NwzRgIg/0TZ5On6wzMclfjSL/508nafshopnD2bgM OCtRbK93eTfId10kP3hVF3U9saJLeAcEQJzJcHuLr/0/9PH6+loX/DxNfYFciKoI5IIT90e+e6Lc O0zmMqDPBl4OXU8PpZY5ifcumLzdiIHU4yuYdWLfxG7reR2GgTuHiwMqVmbFPA== ) ;; ADDITIONAL SECTION (9 records) av1.nstld.com. 172800 IN A 192.42.177.30 av1.nstld.com. 172800 IN AAAA 2001:500:124::30 av2.nstld.com. 172800 IN A 192.42.178.30 av2.nstld.com. 172800 IN AAAA 2001:500:125::30 av3.nstld.com. 172800 IN A 192.82.133.30 av3.nstld.com. 172800 IN AAAA 2001:500:126::30 av4.nstld.com. 172800 IN A 192.82.134.30 av4.nstld.com. 172800 IN AAAA 2001:500:127::30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone verisignlabs.com

verisignlabs.com

	Checking DS between com and verisignlabs.com
	Query to d.gtld-servers.net for verisignlabs.com/DS
	Received 1191 bytes from 192.31.80.30
	;; Response received from 192.31.80.30 (1191 octets) ;; HEADER SECTION ;; id = 6913 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 14 arcount = 23 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; verisignlabs.com. IN DS ;; ANSWER SECTION (2 records) verisignlabs.com. 86400 IN DS ( 57947 8 2 64877db0ea66b229fbe8380decf40a8ba36114f5fb34b5bfaef0716d6029638d ) verisignlabs.com. 86400 IN RRSIG ( DS 8 2 86400 20230711041708 20230704030708 46551 com. o1Tb1w3QHboKOyJYZpqdaD0mxqD59ZrxjA7NwzRgIg/0TZ5On6wzMclfjSL/508nafshopnD2bgM OCtRbK93eTfId10kP3hVF3U9saJLeAcEQJzJcHuLr/0/9PH6+loX/DxNfYFciKoI5IIT90e+e6Lc O0zmMqDPBl4OXU8PpZY5ifcumLzdiIHU4yuYdWLfxG7reR2GgTuHiwMqVmbFPA== ) ;; AUTHORITY SECTION (14 records) com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS a.gtld-servers.net. com. 172800 IN RRSIG ( NS 8 1 172800 20230709042334 20230702031334 46551 com. mM65GNuWh4e0ZjWzZZpqHVwAS7CVyJWy7sTrMhT2VKPjMGxCCUPZB+2wNGbW7Aes0NgyX+lfFj9W n+8HoI8f0otiChM8LFyjg2nbghrmdDrBy8UW1MUbvSVwvATJmRTfPZO3fmOoz+7na69JxueICFEz 3jIEDuklYfEuUrY8wEi0O1sLIkAdFFRKHowKOPa6tJC5o+vVKp14ykPi4sQHCQ== ) ;; ADDITIONAL SECTION (23 records) h.gtld-servers.net. 172800 IN A 192.54.112.30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 c.gtld-servers.net. 172800 IN A 192.26.92.30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 k.gtld-servers.net. 172800 IN A 192.52.178.30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 i.gtld-servers.net. 172800 IN A 192.43.172.30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 e.gtld-servers.net. 172800 IN A 192.12.94.30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 f.gtld-servers.net. 172800 IN A 192.35.51.30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 m.gtld-servers.net. 172800 IN A 192.55.83.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 b.gtld-servers.net. 172800 IN A 192.33.14.30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 j.gtld-servers.net. 172800 IN A 192.48.79.30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 l.gtld-servers.net. 172800 IN A 192.41.162.30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 g.gtld-servers.net. 172800 IN A 192.42.93.30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 1 DS records for verisignlabs.com in the com zone
	DS=57947/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`verisignlabs.com. 86400 IN RRSIG ( DS 8 2 86400 20230711041708 20230704030708 46551 com. o1Tb1w3QHboKOyJYZpqdaD0mxqD59ZrxjA7NwzRgIg/0TZ5On6wzMclfjSL/508nafshopnD2bgM OCtRbK93eTfId10kP3hVF3U9saJLeAcEQJzJcHuLr/0/9PH6+loX/DxNfYFciKoI5IIT90e+e6Lc O0zmMqDPBl4OXU8PpZY5ifcumLzdiIHU4yuYdWLfxG7reR2GgTuHiwMqVmbFPA== )`
	RRSIG=46551 and DNSKEY=46551 verifies the DS RRset
	DS=57947/SHA-256 is now in the chain-of-trust
	`verisignlabs.com. 86400 IN DS ( 57947 8 2 64877db0ea66b229fbe8380decf40a8ba36114f5fb34b5bfaef0716d6029638d )`
	Query to av2.nstld.com for verisignlabs.com/DNSKEY
	Received 773 bytes from 192.42.178.30
	;; Response received from 192.42.178.30 (773 octets) ;; HEADER SECTION ;; id = 45578 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; verisignlabs.com. IN DNSKEY ;; ANSWER SECTION (3 records) verisignlabs.com. 3600 IN DNSKEY ( 257 3 8 AwEAAdiAmIhpo/OUFkl4Y0Tk+cWsmZmpklKZYkgoeKJG8WbNKwEnjMMVT9xoEKFvY4UkmL0/RYE+ 16Zij9njGbDZbfuDr9GozUFCopAddvkf9Dzi2EXzN6+buiIVxN0n5Q30eZjt+1w1fYdulZIe3MN+ 96BT50jCliQ6FSZD7IGOumOKoG8mxg1WUfFVt3sMF4U+Djth4s2/ECXi5iidYcz7LxhOQ6zkiPVM XaFenSm4rBjkgICYFLI3D44XDwDbErlFloxRl6HVjPokY0zuTswie3ZENNZYSbdL70PCIBiVmWfB XmKUc9JTGZSK96ozOksWzd8+HWV2s28W+S2O1BGjdrU= ) ; Key ID = 57947 verisignlabs.com. 3600 IN DNSKEY ( 256 3 8 AwEAAZYXMJJy3Ypx2tqDbRYfGFFC3iP3JMKFxy2sLSuJSzm0l6CT0f/gDm/XvPTrY3+Pi60i/jSs TLZv6SsXc3agO6cn4o+G/cp9m9kapr46g3KPZgw9MNJRUWSuuqfzVOUAl3MVWV30Le39ztKbEKS6 3sdN5QA41awoO5grzXzyjUmh ) ; Key ID = 40476 verisignlabs.com. 3600 IN RRSIG ( DNSKEY 8 2 3600 20230803231953 20230704231953 57947 verisignlabs.com. 0qbSuwPr6wIaTLNYmryLj1UiyftiQmAvXY3PH3tu4lKOunxsL75Eh5DeDquXwS//yIRSJs/D3jba a8hpUgzl244F5DnyfvaZ9WMhQitI0utHY9S4OPJywdkHZdxTnxc9FjukbJDIew+/kMc1t2jKs1tu XlwczDdheYsgonMkluq3gYIyZkfb+NAID7mOBaeyR8SxTegZ/QmghVJTrmdAFHuocGohpNUxqDbc X4NzDNRnsoA0ZcixuH03mC/6JI3qtQQZlW7l+sl4k6vl4ftyp0qKq35KmCctn64TReST7e0ZRrl5 hfb/3bJU7129aeUhOU9kAbw0R0qfhwNsEMBxHg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DNSKEY records for verisignlabs.com
	`verisignlabs.com. 3600 IN DNSKEY ( 257 3 8 AwEAAdiAmIhpo/OUFkl4Y0Tk+cWsmZmpklKZYkgoeKJG8WbNKwEnjMMVT9xoEKFvY4UkmL0/RYE+ 16Zij9njGbDZbfuDr9GozUFCopAddvkf9Dzi2EXzN6+buiIVxN0n5Q30eZjt+1w1fYdulZIe3MN+ 96BT50jCliQ6FSZD7IGOumOKoG8mxg1WUfFVt3sMF4U+Djth4s2/ECXi5iidYcz7LxhOQ6zkiPVM XaFenSm4rBjkgICYFLI3D44XDwDbErlFloxRl6HVjPokY0zuTswie3ZENNZYSbdL70PCIBiVmWfB XmKUc9JTGZSK96ozOksWzd8+HWV2s28W+S2O1BGjdrU= ) ; Key ID = 57947`
	`verisignlabs.com. 3600 IN DNSKEY ( 256 3 8 AwEAAZYXMJJy3Ypx2tqDbRYfGFFC3iP3JMKFxy2sLSuJSzm0l6CT0f/gDm/XvPTrY3+Pi60i/jSs TLZv6SsXc3agO6cn4o+G/cp9m9kapr46g3KPZgw9MNJRUWSuuqfzVOUAl3MVWV30Le39ztKbEKS6 3sdN5QA41awoO5grzXzyjUmh ) ; Key ID = 40476`
	DNSKEY=57947/SEP is now in the chain-of-trust
	DS=57947/SHA-256 verifies DNSKEY=57947/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`verisignlabs.com. 3600 IN RRSIG ( DNSKEY 8 2 3600 20230803231953 20230704231953 57947 verisignlabs.com. 0qbSuwPr6wIaTLNYmryLj1UiyftiQmAvXY3PH3tu4lKOunxsL75Eh5DeDquXwS//yIRSJs/D3jba a8hpUgzl244F5DnyfvaZ9WMhQitI0utHY9S4OPJywdkHZdxTnxc9FjukbJDIew+/kMc1t2jKs1tu XlwczDdheYsgonMkluq3gYIyZkfb+NAID7mOBaeyR8SxTegZ/QmghVJTrmdAFHuocGohpNUxqDbc X4NzDNRnsoA0ZcixuH03mC/6JI3qtQQZlW7l+sl4k6vl4ftyp0qKq35KmCctn64TReST7e0ZRrl5 hfb/3bJU7129aeUhOU9kAbw0R0qfhwNsEMBxHg== )`
	RRSIG=57947 and DNSKEY=57947/SEP verifies the DNSKEY RRset
	DNSKEY=40476 is now in the chain-of-trust
	Query to av1.nstld.com for dnssec-analyzer.verisignlabs.com/A
	Received 609 bytes from 192.42.177.30
	;; Response received from 192.42.177.30 (609 octets) ;; HEADER SECTION ;; id = 49010 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 5 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer.verisignlabs.com. IN A ;; ANSWER SECTION (2 records) dnssec-analyzer.verisignlabs.com. 3600 IN CNAME ( dnssec-analyzer-gslb.verisignlabs.com. ) dnssec-analyzer.verisignlabs.com. 3600 IN RRSIG ( CNAME 8 3 3600 20230803231953 20230704231953 40476 verisignlabs.com. a4817PgjM47W2iP/C1blnj87bURZbDE7SNO+yCPPwnIJpKOA/vuQ1TbPnMf/lGRQE6WTQAnC7jqA KRJnslqLM/MsiEzkfvujfKWk5l0nApzZdJmzctD80v4fu7roNw+9GT1rS1LkN3MguAouTCs4GY1V mNrFAaXdX0QM4CIahEU= ) ;; AUTHORITY SECTION (5 records) dnssec-analyzer-gslb.verisignlabs.com. 3600 IN NS gslb.ash3.verisign.com. dnssec-analyzer-gslb.verisignlabs.com. 3600 IN NS gslb.brn1.verisign.com. dnssec-analyzer-gslb.verisignlabs.com. 3600 IN NS gslb.ilg1.verisign.com. 9B8BK6V53SSJHHL01Q7GGA3O31TUHIVE.verisignlabs.com. 86400 IN NSEC3 ( 1 0 0 4c44934802d3 aaafg2snsi2pbncspunvfhru1j714k27 NS ) 9B8BK6V53SSJHHL01Q7GGA3O31TUHIVE.verisignlabs.com. 86400 IN RRSIG ( NSEC3 8 3 86400 20230803231953 20230704231953 40476 verisignlabs.com. Q3Rypoc05FwqrzwiejjGnHrouwZ7JPIqZo892HQ6+rhK6NoZIgUkAHUitbbcIwx5qoBWzWJcFJvn +4V4KigTVIPycDVqRP/hMk+nU5O/QjKrazosbxWw71NAvw8QWljU5bp6UefSmmrj+zB3kR/ysCz0 A0m3qh7kSsCL3IGmLk0= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	av1.nstld.com is authoritative for dnssec-analyzer.verisignlabs.com
	Query to av1.nstld.com for dnssec-analyzer.verisignlabs.com/DNSKEY
	Received 609 bytes from 192.42.177.30
	;; Response received from 192.42.177.30 (609 octets) ;; HEADER SECTION ;; id = 11594 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 5 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer.verisignlabs.com. IN DNSKEY ;; ANSWER SECTION (2 records) dnssec-analyzer.verisignlabs.com. 3600 IN CNAME ( dnssec-analyzer-gslb.verisignlabs.com. ) dnssec-analyzer.verisignlabs.com. 3600 IN RRSIG ( CNAME 8 3 3600 20230803231953 20230704231953 40476 verisignlabs.com. a4817PgjM47W2iP/C1blnj87bURZbDE7SNO+yCPPwnIJpKOA/vuQ1TbPnMf/lGRQE6WTQAnC7jqA KRJnslqLM/MsiEzkfvujfKWk5l0nApzZdJmzctD80v4fu7roNw+9GT1rS1LkN3MguAouTCs4GY1V mNrFAaXdX0QM4CIahEU= ) ;; AUTHORITY SECTION (5 records) dnssec-analyzer-gslb.verisignlabs.com. 3600 IN NS gslb.ash3.verisign.com. dnssec-analyzer-gslb.verisignlabs.com. 3600 IN NS gslb.brn1.verisign.com. dnssec-analyzer-gslb.verisignlabs.com. 3600 IN NS gslb.ilg1.verisign.com. 9B8BK6V53SSJHHL01Q7GGA3O31TUHIVE.verisignlabs.com. 86400 IN NSEC3 ( 1 0 0 4c44934802d3 aaafg2snsi2pbncspunvfhru1j714k27 NS ) 9B8BK6V53SSJHHL01Q7GGA3O31TUHIVE.verisignlabs.com. 86400 IN RRSIG ( NSEC3 8 3 86400 20230803231953 20230704231953 40476 verisignlabs.com. Q3Rypoc05FwqrzwiejjGnHrouwZ7JPIqZo892HQ6+rhK6NoZIgUkAHUitbbcIwx5qoBWzWJcFJvn +4V4KigTVIPycDVqRP/hMk+nU5O/QjKrazosbxWw71NAvw8QWljU5bp6UefSmmrj+zB3kR/ysCz0 A0m3qh7kSsCL3IGmLk0= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found RRSIG signed by verisignlabs.com zone
	dnssec-analyzer.verisignlabs.com is a CNAME to dnssec-analyzer-gslb.verisignlabs.com
	Found 1 RRSIGs over CNAME RRset
	`dnssec-analyzer.verisignlabs.com. 3600 IN RRSIG ( CNAME 8 3 3600 20230803231953 20230704231953 40476 verisignlabs.com. a4817PgjM47W2iP/C1blnj87bURZbDE7SNO+yCPPwnIJpKOA/vuQ1TbPnMf/lGRQE6WTQAnC7jqA KRJnslqLM/MsiEzkfvujfKWk5l0nApzZdJmzctD80v4fu7roNw+9GT1rS1LkN3MguAouTCs4GY1V mNrFAaXdX0QM4CIahEU= )`
	RRSIG=40476 and DNSKEY=40476 verifies the CNAME RRset
	Query to av4.nstld.com for dnssec-analyzer-gslb.verisignlabs.com/A
	Received 403 bytes from 192.82.134.30
	;; Response received from 192.82.134.30 (403 octets) ;; HEADER SECTION ;; id = 38832 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 5 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer-gslb.verisignlabs.com. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (5 records) dnssec-analyzer-gslb.verisignlabs.com. 3600 IN NS gslb.ash3.verisign.com. dnssec-analyzer-gslb.verisignlabs.com. 3600 IN NS gslb.brn1.verisign.com. dnssec-analyzer-gslb.verisignlabs.com. 3600 IN NS gslb.ilg1.verisign.com. 9B8BK6V53SSJHHL01Q7GGA3O31TUHIVE.verisignlabs.com. 86400 IN NSEC3 ( 1 0 0 4c44934802d3 aaafg2snsi2pbncspunvfhru1j714k27 NS ) 9B8BK6V53SSJHHL01Q7GGA3O31TUHIVE.verisignlabs.com. 86400 IN RRSIG ( NSEC3 8 3 86400 20230803231953 20230704231953 40476 verisignlabs.com. Q3Rypoc05FwqrzwiejjGnHrouwZ7JPIqZo892HQ6+rhK6NoZIgUkAHUitbbcIwx5qoBWzWJcFJvn +4V4KigTVIPycDVqRP/hMk+nU5O/QjKrazosbxWw71NAvw8QWljU5bp6UefSmmrj+zB3kR/ysCz0 A0m3qh7kSsCL3IGmLk0= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to av3.nstld.com for dnssec-analyzer-gslb.verisignlabs.com/DNSKEY
	Received 403 bytes from 192.82.133.30
	;; Response received from 192.82.133.30 (403 octets) ;; HEADER SECTION ;; id = 44845 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 5 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer-gslb.verisignlabs.com. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (5 records) dnssec-analyzer-gslb.verisignlabs.com. 3600 IN NS gslb.ash3.verisign.com. dnssec-analyzer-gslb.verisignlabs.com. 3600 IN NS gslb.brn1.verisign.com. dnssec-analyzer-gslb.verisignlabs.com. 3600 IN NS gslb.ilg1.verisign.com. 9B8BK6V53SSJHHL01Q7GGA3O31TUHIVE.verisignlabs.com. 86400 IN NSEC3 ( 1 0 0 4c44934802d3 aaafg2snsi2pbncspunvfhru1j714k27 NS ) 9B8BK6V53SSJHHL01Q7GGA3O31TUHIVE.verisignlabs.com. 86400 IN RRSIG ( NSEC3 8 3 86400 20230803231953 20230704231953 40476 verisignlabs.com. Q3Rypoc05FwqrzwiejjGnHrouwZ7JPIqZo892HQ6+rhK6NoZIgUkAHUitbbcIwx5qoBWzWJcFJvn +4V4KigTVIPycDVqRP/hMk+nU5O/QjKrazosbxWw71NAvw8QWljU5bp6UefSmmrj+zB3kR/ysCz0 A0m3qh7kSsCL3IGmLk0= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone dnssec-analyzer-gslb.verisignlabs.com

dnssec-analyzer-gslb.verisignlabs.com

	Checking DS between verisignlabs.com and dnssec-analyzer-gslb.verisignlabs.com
	Query to av3.nstld.com for dnssec-analyzer-gslb.verisignlabs.com/DS
	Received 562 bytes from 192.82.133.30
	;; Response received from 192.82.133.30 (562 octets) ;; HEADER SECTION ;; id = 11542 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer-gslb.verisignlabs.com. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) verisignlabs.com. 86400 IN SOA ( av1.nstld.com. mdnshelp.verisign.com. 1688516393 ;serial 300 ;refresh 7200 ;retry 1209600 ;expire 86400 ;minimum ) verisignlabs.com. 86400 IN RRSIG ( SOA 8 2 86400 20230803231953 20230704231953 40476 verisignlabs.com. f168qDzPurN2x3JYdjiFXog77sWrgOTG95EVBd11Q7VPc/CWHNtzVDlj26+mQ7rY1BtjfsG+9XTB n5sR5O3g2oxIqIWaJrkxAbjC56I4qLJ54gCCXDqzibThz2JbDRh7O5HEtmdeGdFxi1t1/ZBvEThN Ir49bJy6dq7kQGib+Cw= ) 9B8BK6V53SSJHHL01Q7GGA3O31TUHIVE.verisignlabs.com. 86400 IN NSEC3 ( 1 0 0 4c44934802d3 aaafg2snsi2pbncspunvfhru1j714k27 NS ) 9B8BK6V53SSJHHL01Q7GGA3O31TUHIVE.verisignlabs.com. 86400 IN RRSIG ( NSEC3 8 3 86400 20230803231953 20230704231953 40476 verisignlabs.com. Q3Rypoc05FwqrzwiejjGnHrouwZ7JPIqZo892HQ6+rhK6NoZIgUkAHUitbbcIwx5qoBWzWJcFJvn +4V4KigTVIPycDVqRP/hMk+nU5O/QjKrazosbxWw71NAvw8QWljU5bp6UefSmmrj+zB3kR/ysCz0 A0m3qh7kSsCL3IGmLk0= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	No DS records found for dnssec-analyzer-gslb.verisignlabs.com in the verisignlabs.com zone
	Query to gslb.ilg1.verisign.com for dnssec-analyzer-gslb.verisignlabs.com/DNSKEY
	Received 133 bytes from 199.16.87.22
	;; Response received from 199.16.87.22 (133 octets) ;; HEADER SECTION ;; id = 7106 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 1 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer-gslb.verisignlabs.com. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) com. 60 IN SOA ( this.name.is.invalid. hostmaster.this.name.is.invalid. 2023030710 ;serial 10800 ;refresh 3600 ;retry 604800 ;expire 60 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	No DNSKEY records found
	Query to gslb.ash3.verisign.com for dnssec-analyzer-gslb.verisignlabs.com/A
	Received 82 bytes from 69.36.158.22
	;; Response received from 69.36.158.22 (82 octets) ;; HEADER SECTION ;; id = 60333 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer-gslb.verisignlabs.com. IN A ;; ANSWER SECTION (1 record) dnssec-analyzer-gslb.verisignlabs.com. 30 IN A 209.131.161.48 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	gslb.ash3.verisign.com is authoritative for dnssec-analyzer-gslb.verisignlabs.com
	Query to gslb.brn1.verisign.com for dnssec-analyzer-gslb.verisignlabs.com/SOA
	Received 133 bytes from 72.13.39.22
	;; Response received from 72.13.39.22 (133 octets) ;; HEADER SECTION ;; id = 30078 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 1 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer-gslb.verisignlabs.com. IN SOA ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) com. 60 IN SOA ( this.name.is.invalid. hostmaster.this.name.is.invalid. 2023030710 ;serial 10800 ;refresh 3600 ;retry 604800 ;expire 60 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to gslb.ilg1.verisign.com for dnssec-analyzer-gslb.verisignlabs.com/SOA
	Received 133 bytes from 199.16.87.22
	;; Response received from 199.16.87.22 (133 octets) ;; HEADER SECTION ;; id = 25740 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 1 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer-gslb.verisignlabs.com. IN SOA ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) com. 60 IN SOA ( this.name.is.invalid. hostmaster.this.name.is.invalid. 2023030710 ;serial 10800 ;refresh 3600 ;retry 604800 ;expire 60 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to gslb.ash3.verisign.com for dnssec-analyzer-gslb.verisignlabs.com/A
	Received 82 bytes from 69.36.158.22
	;; Response received from 69.36.158.22 (82 octets) ;; HEADER SECTION ;; id = 44967 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer-gslb.verisignlabs.com. IN A ;; ANSWER SECTION (1 record) dnssec-analyzer-gslb.verisignlabs.com. 30 IN A 209.131.161.48 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	dnssec-analyzer-gslb.verisignlabs.com A RR has value 209.131.161.48
	No RRSIGs found

dnssec-analyzer-gslb.verisignlabs.com

	Query to gslb.brn1.verisign.com for dnssec-analyzer-gslb.verisignlabs.com/A
	Received 82 bytes from 72.13.39.22
	;; Response received from 72.13.39.22 (82 octets) ;; HEADER SECTION ;; id = 14688 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer-gslb.verisignlabs.com. IN A ;; ANSWER SECTION (1 record) dnssec-analyzer-gslb.verisignlabs.com. 30 IN A 209.131.158.42 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	gslb.brn1.verisign.com is authoritative for dnssec-analyzer-gslb.verisignlabs.com
	Query to gslb.brn1.verisign.com for dnssec-analyzer-gslb.verisignlabs.com/A
	Received 82 bytes from 72.13.39.22
	;; Response received from 72.13.39.22 (82 octets) ;; HEADER SECTION ;; id = 29720 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer-gslb.verisignlabs.com. IN A ;; ANSWER SECTION (1 record) dnssec-analyzer-gslb.verisignlabs.com. 30 IN A 209.131.161.48 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	dnssec-analyzer-gslb.verisignlabs.com A RR has value 209.131.161.48
	No RRSIGs found

dnssec-analyzer-gslb.verisignlabs.com

	Query to gslb.ilg1.verisign.com for dnssec-analyzer-gslb.verisignlabs.com/A
	Received 82 bytes from 199.16.87.22
	;; Response received from 199.16.87.22 (82 octets) ;; HEADER SECTION ;; id = 12026 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer-gslb.verisignlabs.com. IN A ;; ANSWER SECTION (1 record) dnssec-analyzer-gslb.verisignlabs.com. 30 IN A 209.131.158.42 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	gslb.ilg1.verisign.com is authoritative for dnssec-analyzer-gslb.verisignlabs.com
	Query to gslb.ilg1.verisign.com for dnssec-analyzer-gslb.verisignlabs.com/A
	Received 82 bytes from 199.16.87.22
	;; Response received from 199.16.87.22 (82 octets) ;; HEADER SECTION ;; id = 54975 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; dnssec-analyzer-gslb.verisignlabs.com. IN A ;; ANSWER SECTION (1 record) dnssec-analyzer-gslb.verisignlabs.com. 30 IN A 209.131.161.48 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	dnssec-analyzer-gslb.verisignlabs.com A RR has value 209.131.161.48
	No RRSIGs found

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test dnssec-analyzer.verisignlabs.com at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: