DNSSEC Analyzer

Domain Name:

Time: 2020-09-26 18:58:09 UTC, NTP stratum 4

Analyzing DNSSEC problems for fed.us

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to l.root-servers.net for ./DNSKEY
	Received 1139 bytes from 199.7.83.42
	;; Answer received from 199.7.83.42 (1139 bytes) ;; HEADER SECTION ;; id = 32946 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAdauOGxLhfAKFTTZwGhBXbk793QKdWIQRjiSftWdusCwkPhNyJrIjwtNffCWXGLlZAbpcs41 4RE3oS1qVwV+AdXsO92SBu5haGlxMUk0NqZO7Xlf84/wrzGZVRRouPo5pNX/CKS8Mv9UOi0olKGC u31dNfh8qCszWZcloLDgeLzSnQSkvFoGe69vNCfh7feESKedkBC2qRz0BZv9+oJI0IY/3D7WEnV0 NOlf8gSHozhfJFJ/ZAKtvw/Q3ogrVJFk0LyVaU/NVtVA5FM4pVMIRID7pfrPi78aAzG7b/Wh/Pce 4jPAIpS3dApq25YkvMuPvfB91NMf9FemKwlp78PBVcM= ) ; Key ID = 46594 . 172800 IN DNSKEY ( 256 3 8 AwEAAfC/6HLClwss6h7rPfoG2cliv4/SPJRd2HPEglRsvKZRbPP2RLfiobeAkczcdqaD5q8loEt1 4lcTgDqwzOISZ3YvSVkM4JRMFwKzcjukKo5CsDVbMmhTD0C0yxWICRQ1M+Y5/XkZAT7mt4cb3fWc N9xgyq1wEXQX+zdLQHrNEVQSiL5SoA5cOtCSoQ45n8bKDXdw/0jjP9Rw1FVKsdzLVkQSrVMm8k30 WUkHm/SK/n/954KENkdQOA6Li2vO9nicQdegyAkDeNJCdPN/p3jEhCTQLyO4AlAmyaPcDHeeo7OX r/VsYu4NTDde9hBuS0zx/rewD+BvSnmnNHNmH2FjUE8= ) ; Key ID = 26116 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20201010000000 20200919000000 20326 . gNV6AU+66kB5XldvckVd/ldhaWTu0rO589zdyHDODOwQ1murJshvt8cjBw3G3G4xO06I1gCKT2HW IJLEEhhvQSRvowbcIW3EocWtTZjeQvCp4U1449doRAiUblpQi7EIstdOxIzcttvh0VcIRecWV7Fl 3kvBzEhpwX42EKXaWUV58Rrn/43o/bRSgh3XBSDwIuIsZVJiMMvHdgm0a5FM6jNHxuuXT1DLlXgL Qyggm/PFciUKTXAo91f6HiyWGNZY9AfAAlvprPiyFOCjBotvk7F5Bi5ss1p8mxl522t/8UuSKcFz qE1J3U4IisgEjTkyxnbCJqY/vKJcyPU8fCzxEg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAdauOGxLhfAKFTTZwGhBXbk793QKdWIQRjiSftWdusCwkPhNyJrIjwtNffCWXGLlZAbpcs41 4RE3oS1qVwV+AdXsO92SBu5haGlxMUk0NqZO7Xlf84/wrzGZVRRouPo5pNX/CKS8Mv9UOi0olKGC u31dNfh8qCszWZcloLDgeLzSnQSkvFoGe69vNCfh7feESKedkBC2qRz0BZv9+oJI0IY/3D7WEnV0 NOlf8gSHozhfJFJ/ZAKtvw/Q3ogrVJFk0LyVaU/NVtVA5FM4pVMIRID7pfrPi78aAzG7b/Wh/Pce 4jPAIpS3dApq25YkvMuPvfB91NMf9FemKwlp78PBVcM= ) ; Key ID = 46594`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAfC/6HLClwss6h7rPfoG2cliv4/SPJRd2HPEglRsvKZRbPP2RLfiobeAkczcdqaD5q8loEt1 4lcTgDqwzOISZ3YvSVkM4JRMFwKzcjukKo5CsDVbMmhTD0C0yxWICRQ1M+Y5/XkZAT7mt4cb3fWc N9xgyq1wEXQX+zdLQHrNEVQSiL5SoA5cOtCSoQ45n8bKDXdw/0jjP9Rw1FVKsdzLVkQSrVMm8k30 WUkHm/SK/n/954KENkdQOA6Li2vO9nicQdegyAkDeNJCdPN/p3jEhCTQLyO4AlAmyaPcDHeeo7OX r/VsYu4NTDde9hBuS0zx/rewD+BvSnmnNHNmH2FjUE8= ) ; Key ID = 26116`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20201010000000 20200919000000 20326 . gNV6AU+66kB5XldvckVd/ldhaWTu0rO589zdyHDODOwQ1murJshvt8cjBw3G3G4xO06I1gCKT2HW IJLEEhhvQSRvowbcIW3EocWtTZjeQvCp4U1449doRAiUblpQi7EIstdOxIzcttvh0VcIRecWV7Fl 3kvBzEhpwX42EKXaWUV58Rrn/43o/bRSgh3XBSDwIuIsZVJiMMvHdgm0a5FM6jNHxuuXT1DLlXgL Qyggm/PFciUKTXAo91f6HiyWGNZY9AfAAlvprPiyFOCjBotvk7F5Bi5ss1p8mxl522t/8UuSKcFz qE1J3U4IisgEjTkyxnbCJqY/vKJcyPU8fCzxEg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=46594 is now in the chain-of-trust
	DNSKEY=26116 is now in the chain-of-trust
	Query to l.root-servers.net for fed.us/A
	Received 688 bytes from 199.7.83.42
	;; Answer received from 199.7.83.42 (688 bytes) ;; HEADER SECTION ;; id = 323 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 9 arcount = 10 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; fed.us. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) us. 172800 IN NS a.cctld.us. us. 172800 IN NS b.cctld.us. us. 172800 IN NS c.cctld.us. us. 172800 IN NS e.cctld.us. us. 172800 IN NS f.cctld.us. us. 172800 IN NS k.cctld.us. us. 86400 IN DS 21364 8 1 260d0461242bcf8f05473a08b05ed01e6fa59b9c us. 86400 IN DS ( 21364 8 2 b499cfa7b54d25fde1e6fe93076fb013daa664da1f26585324740a1e6ebdab26 ) us. 86400 IN RRSIG ( DS 8 1 86400 20201009170000 20200926160000 46594 . V0xZOJZnulypDyP4wMQYk7RqOLWk6edFO2kwsXgvuDZCTBX+EvLpIUnkQ1NdheXCDptFQ5s3Pzy2 H0HiVp+KQBvN/IfDn27xBRA7IgK97UUA26b/ZfgxvFUxbmjwxdAiJVpCIKhCaVU7lJfiTi/kEvT4 f9IZ0tFIUOVVQc4WiGQCG5Aev6UElBO5ZpcFWEsPIK60o127a7F2aZpk09rVDAUD/W+8dfQfIcps QDCRc9JifqTKjdEYx2OFL5q8kqiEnDEAAb66ScGBERKzAsRBrCw55GPJMqkd8P3iTWe/phpZbuHw wETqcuhX6s5PEf3SkHY6n02tFks31BNTyt48Dg== ) ;; ADDITIONAL SECTION (10 records) a.cctld.us. 172800 IN A 156.154.124.70 b.cctld.us. 172800 IN A 156.154.125.70 c.cctld.us. 172800 IN A 156.154.127.70 e.cctld.us. 172800 IN A 156.154.126.70 f.cctld.us. 172800 IN A 209.173.58.70 k.cctld.us. 172800 IN A 156.154.128.70 b.cctld.us. 172800 IN AAAA 2001:502:ad09::29 f.cctld.us. 172800 IN AAAA 2001:500:3682::11 k.cctld.us. 172800 IN AAAA 2001:503:e239::3:1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to k.root-servers.net for us/DNSKEY
	Received 684 bytes from 193.0.14.129
	;; Answer received from 193.0.14.129 (684 bytes) ;; HEADER SECTION ;; id = 64142 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 9 arcount = 10 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; us. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) us. 172800 IN NS a.cctld.us. us. 172800 IN NS b.cctld.us. us. 172800 IN NS c.cctld.us. us. 172800 IN NS e.cctld.us. us. 172800 IN NS f.cctld.us. us. 172800 IN NS k.cctld.us. us. 86400 IN DS ( 21364 8 2 b499cfa7b54d25fde1e6fe93076fb013daa664da1f26585324740a1e6ebdab26 ) us. 86400 IN DS 21364 8 1 260d0461242bcf8f05473a08b05ed01e6fa59b9c us. 86400 IN RRSIG ( DS 8 1 86400 20201009170000 20200926160000 46594 . V0xZOJZnulypDyP4wMQYk7RqOLWk6edFO2kwsXgvuDZCTBX+EvLpIUnkQ1NdheXCDptFQ5s3Pzy2 H0HiVp+KQBvN/IfDn27xBRA7IgK97UUA26b/ZfgxvFUxbmjwxdAiJVpCIKhCaVU7lJfiTi/kEvT4 f9IZ0tFIUOVVQc4WiGQCG5Aev6UElBO5ZpcFWEsPIK60o127a7F2aZpk09rVDAUD/W+8dfQfIcps QDCRc9JifqTKjdEYx2OFL5q8kqiEnDEAAb66ScGBERKzAsRBrCw55GPJMqkd8P3iTWe/phpZbuHw wETqcuhX6s5PEf3SkHY6n02tFks31BNTyt48Dg== ) ;; ADDITIONAL SECTION (10 records) a.cctld.us. 172800 IN A 156.154.124.70 b.cctld.us. 172800 IN A 156.154.125.70 c.cctld.us. 172800 IN A 156.154.127.70 e.cctld.us. 172800 IN A 156.154.126.70 f.cctld.us. 172800 IN A 209.173.58.70 k.cctld.us. 172800 IN A 156.154.128.70 b.cctld.us. 172800 IN AAAA 2001:502:ad09::29 f.cctld.us. 172800 IN AAAA 2001:500:3682::11 k.cctld.us. 172800 IN AAAA 2001:503:e239::3:1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone us

	Checking DS between . and us
	Query to g.root-servers.net for us/DS
	Received 402 bytes from 192.112.36.4
	;; Answer received from 192.112.36.4 (402 bytes) ;; HEADER SECTION ;; id = 55469 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; us. IN DS ;; ANSWER SECTION (3 records) us. 86400 IN DS 21364 8 1 260d0461242bcf8f05473a08b05ed01e6fa59b9c us. 86400 IN DS ( 21364 8 2 b499cfa7b54d25fde1e6fe93076fb013daa664da1f26585324740a1e6ebdab26 ) us. 86400 IN RRSIG ( DS 8 1 86400 20201009170000 20200926160000 46594 . V0xZOJZnulypDyP4wMQYk7RqOLWk6edFO2kwsXgvuDZCTBX+EvLpIUnkQ1NdheXCDptFQ5s3Pzy2 H0HiVp+KQBvN/IfDn27xBRA7IgK97UUA26b/ZfgxvFUxbmjwxdAiJVpCIKhCaVU7lJfiTi/kEvT4 f9IZ0tFIUOVVQc4WiGQCG5Aev6UElBO5ZpcFWEsPIK60o127a7F2aZpk09rVDAUD/W+8dfQfIcps QDCRc9JifqTKjdEYx2OFL5q8kqiEnDEAAb66ScGBERKzAsRBrCw55GPJMqkd8P3iTWe/phpZbuHw wETqcuhX6s5PEf3SkHY6n02tFks31BNTyt48Dg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DS records for us in the . zone
	DS=21364/SHA-1 has algorithm RSASHA256
	DS=21364/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`us. 86400 IN RRSIG ( DS 8 1 86400 20201009170000 20200926160000 46594 . V0xZOJZnulypDyP4wMQYk7RqOLWk6edFO2kwsXgvuDZCTBX+EvLpIUnkQ1NdheXCDptFQ5s3Pzy2 H0HiVp+KQBvN/IfDn27xBRA7IgK97UUA26b/ZfgxvFUxbmjwxdAiJVpCIKhCaVU7lJfiTi/kEvT4 f9IZ0tFIUOVVQc4WiGQCG5Aev6UElBO5ZpcFWEsPIK60o127a7F2aZpk09rVDAUD/W+8dfQfIcps QDCRc9JifqTKjdEYx2OFL5q8kqiEnDEAAb66ScGBERKzAsRBrCw55GPJMqkd8P3iTWe/phpZbuHw wETqcuhX6s5PEf3SkHY6n02tFks31BNTyt48Dg== )`
	RRSIG=46594 and DNSKEY=46594 verifies the DS RRset
	DS=21364/SHA-1 is now in the chain-of-trust
	`us. 86400 IN DS 21364 8 1 260d0461242bcf8f05473a08b05ed01e6fa59b9c`
	`us. 86400 IN DS ( 21364 8 2 b499cfa7b54d25fde1e6fe93076fb013daa664da1f26585324740a1e6ebdab26 )`
	Query to c.cctld.us for us/DNSKEY
	Received 971 bytes from 156.154.127.70
	;; Answer received from 156.154.127.70 (971 bytes) ;; HEADER SECTION ;; id = 56403 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; us. IN DNSKEY ;; ANSWER SECTION (4 records) us. 900 IN DNSKEY ( 256 3 8 AwEAAcwcUIrWOVugF3H4D/tlgS1LEra51IIhp4NzdGIW3snNMRrsTo17DnDC/+0bl+mGExbQPNks 4/iFAanmeiPgq42IeruoJNFOr0ovzfhQwnF+9WPGhwx5X+lPBoifvQ6DUTFgVFAyc+ZD/DoQQmIY MxtKH1MUSlprtH1E0AyEsdaur7f6NjMsY9BN97k69AFFwHCduKi/Y3twxVdt16xulLM= ) ; Key ID = 53985 us. 900 IN DNSKEY ( 257 3 8 AwEAAbG5GyJm+lZKYQNOCSGENzKrPA2BVwmCXTon4R998WZBawBvILuPnPXBfuUPp94eWTuK9v3Q I11fkzdxGlcXZ7PyZOybiytM8LtWcjqz69qKRgjLJl+ClVLuL4Wzy2CrZJFRhf12VRHGixaf1GBr m7vooMWaALGLXqgFcdA73eMTWr0kdDAY7W8V103QnXqgoT2NvY/DHza2U13967LquEM3f9HrNUIB 5joQif2aNfkRRnmY5TpsBckkZECSJzAM1G7BQgAd9Ga9J02Ebqootoac5CM9Ti/xAkoQDXGkrSWH jiPx9uZu01Mo582n1Ew3mUJB+LwEU1APs0awVUH1tGU= ) ; Key ID = 21364 us. 900 IN RRSIG ( DNSKEY 8 1 900 20201021171214 20200921170216 21364 us. qFduDXB48eRGPvrwnSnFQLrT6LTtIKUtMAdlAVDsqxD7VAXCHW/0DYzIQaja1Z2VjBB5NS6nnsSu HWI1KqMzAR4DCO6E05jA8QFwCwcnGrM8Iqn3SIMh3AgljD9xCpAr7jmxjxft6uiEW+GvOVX0ZUWc ugpGSpeYM/mVxfqaW/hoYVZj1KgeS9xdctcA4TvJPRMbTpFHhMyYEUTVqZ/rh2wugn4fz1bcBTBm AAq0wewhUHQnifbFa5tQGY4hP92u1bqmpYBJwTQJ+UJYV8zLPV7W8Kd4WaPYraHcZxlHsnkUZZKJ fNogElMA4GhqLtb6AiYbxjS4DKSQPQnyKFPSPA== ) us. 900 IN RRSIG ( DNSKEY 8 1 900 20201021171214 20200921170216 53985 us. nVzWunP8aNAK5y+g8TWxqBwK5V3JsGn19HPd6w8ag0T3OZz9mlSQ8yF0PXnAsVBDBpjBXWXaXhoh hgz9ieNwemegihwGAj2XZM/KqCesvNmWQXQdKFA33qGbul5jFSxLgnGi7eU+24YKSMHtLS4MJV1w qXOSTC2M4uLVJNziK4+czZ+wdIzjvQwqzA4/2M4pstjGdRr5gMTjQNQsfriZhA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DNSKEY records for us
	`us. 900 IN DNSKEY ( 256 3 8 AwEAAcwcUIrWOVugF3H4D/tlgS1LEra51IIhp4NzdGIW3snNMRrsTo17DnDC/+0bl+mGExbQPNks 4/iFAanmeiPgq42IeruoJNFOr0ovzfhQwnF+9WPGhwx5X+lPBoifvQ6DUTFgVFAyc+ZD/DoQQmIY MxtKH1MUSlprtH1E0AyEsdaur7f6NjMsY9BN97k69AFFwHCduKi/Y3twxVdt16xulLM= ) ; Key ID = 53985`
	`us. 900 IN DNSKEY ( 257 3 8 AwEAAbG5GyJm+lZKYQNOCSGENzKrPA2BVwmCXTon4R998WZBawBvILuPnPXBfuUPp94eWTuK9v3Q I11fkzdxGlcXZ7PyZOybiytM8LtWcjqz69qKRgjLJl+ClVLuL4Wzy2CrZJFRhf12VRHGixaf1GBr m7vooMWaALGLXqgFcdA73eMTWr0kdDAY7W8V103QnXqgoT2NvY/DHza2U13967LquEM3f9HrNUIB 5joQif2aNfkRRnmY5TpsBckkZECSJzAM1G7BQgAd9Ga9J02Ebqootoac5CM9Ti/xAkoQDXGkrSWH jiPx9uZu01Mo582n1Ew3mUJB+LwEU1APs0awVUH1tGU= ) ; Key ID = 21364`
	DNSKEY=21364/SEP is now in the chain-of-trust
	DS=21364/SHA-1 verifies DNSKEY=21364/SEP
	DS=21364/SHA-256 verifies DNSKEY=21364/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`us. 900 IN RRSIG ( DNSKEY 8 1 900 20201021171214 20200921170216 21364 us. qFduDXB48eRGPvrwnSnFQLrT6LTtIKUtMAdlAVDsqxD7VAXCHW/0DYzIQaja1Z2VjBB5NS6nnsSu HWI1KqMzAR4DCO6E05jA8QFwCwcnGrM8Iqn3SIMh3AgljD9xCpAr7jmxjxft6uiEW+GvOVX0ZUWc ugpGSpeYM/mVxfqaW/hoYVZj1KgeS9xdctcA4TvJPRMbTpFHhMyYEUTVqZ/rh2wugn4fz1bcBTBm AAq0wewhUHQnifbFa5tQGY4hP92u1bqmpYBJwTQJ+UJYV8zLPV7W8Kd4WaPYraHcZxlHsnkUZZKJ fNogElMA4GhqLtb6AiYbxjS4DKSQPQnyKFPSPA== )`
	`us. 900 IN RRSIG ( DNSKEY 8 1 900 20201021171214 20200921170216 53985 us. nVzWunP8aNAK5y+g8TWxqBwK5V3JsGn19HPd6w8ag0T3OZz9mlSQ8yF0PXnAsVBDBpjBXWXaXhoh hgz9ieNwemegihwGAj2XZM/KqCesvNmWQXQdKFA33qGbul5jFSxLgnGi7eU+24YKSMHtLS4MJV1w qXOSTC2M4uLVJNziK4+czZ+wdIzjvQwqzA4/2M4pstjGdRr5gMTjQNQsfriZhA== )`
	RRSIG=21364 and DNSKEY=21364/SEP verifies the DNSKEY RRset
	RRSIG=53985 and DNSKEY=53985 verifies the DNSKEY RRset
	DNSKEY=53985 is now in the chain-of-trust
	Query to f.cctld.us for fed.us/A
	Received 669 bytes from 209.173.58.70
	;; Answer received from 209.173.58.70 (669 bytes) ;; HEADER SECTION ;; id = 17220 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; fed.us. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) fed.us. 7200 IN NS b.gov-servers.net. fed.us. 7200 IN NS d.gov-servers.net. fed.us. 7200 IN NS a.gov-servers.net. fed.us. 7200 IN NS c.gov-servers.net. 04mlcpvb7mqd2gpuv2rh2rcgskp50v81.us. 86400 IN NSEC3 ( 1 1 1 5bf34c13 04n7kph0sauv14jcv0o77jp3ohld0bf5 NS SOA RRSIG DNSKEY NSEC3PARAM ) 04mlcpvb7mqd2gpuv2rh2rcgskp50v81.us. 86400 IN RRSIG ( NSEC3 8 2 86400 20201022010859 20200922003233 53985 us. vl6ljRtzyDJDYuv6EySLtUdTD4DfF/u0xost5qfkwGwQbo7ZwCBw7EJiLNh4i13RuA2qUe1zZBkU GU40w82+weVkgMnYceH6rX9nBRALy9DHAowovHrRc421hrI2+9W3r7aLFz80i7tG5SPjTK1NNGkB 1rwqMOHXY2Th+HT27iRdSmA/DKTrcfiLwqTzLu5gN6hndaBvV8uSlQRo3QnU1w== ) igdtdmjp0smsoj66bs0jh7narqk46itn.us. 86400 IN NSEC3 ( 1 1 1 5bf34c13 igh4llta8r2sas4fn3b9046mup9igq28 NS DS RRSIG ) igdtdmjp0smsoj66bs0jh7narqk46itn.us. 86400 IN RRSIG ( NSEC3 8 2 86400 20201026025744 20200926024424 53985 us. xFSLBiqrYmBKmGA50XpGlXQUzqkLC5MMx1bS3b9yw5ah8ceyaNuDJB/uv1eeRSTPVSi2haTxmwTe THBgsKNh6lWxQfJ3xVD8zM0hHBpThm+iPTG9+ay8wmUeptpJTXsHtKOuEVZyoJgtFtnzPusAcyR2 b6T66pbny6cV9OzXaKqQuWZiAzNnPaoeyLLrLmobcr8QfzTZFSR+Ugw5arGLsg== ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to e.cctld.us for fed.us/DNSKEY
	Received 669 bytes from 156.154.126.70
	;; Answer received from 156.154.126.70 (669 bytes) ;; HEADER SECTION ;; id = 9617 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; fed.us. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) fed.us. 7200 IN NS b.gov-servers.net. fed.us. 7200 IN NS a.gov-servers.net. fed.us. 7200 IN NS c.gov-servers.net. fed.us. 7200 IN NS d.gov-servers.net. 04mlcpvb7mqd2gpuv2rh2rcgskp50v81.us. 86400 IN NSEC3 ( 1 1 1 5bf34c13 04n7kph0sauv14jcv0o77jp3ohld0bf5 NS SOA RRSIG DNSKEY NSEC3PARAM ) 04mlcpvb7mqd2gpuv2rh2rcgskp50v81.us. 86400 IN RRSIG ( NSEC3 8 2 86400 20201022010859 20200922003233 53985 us. vl6ljRtzyDJDYuv6EySLtUdTD4DfF/u0xost5qfkwGwQbo7ZwCBw7EJiLNh4i13RuA2qUe1zZBkU GU40w82+weVkgMnYceH6rX9nBRALy9DHAowovHrRc421hrI2+9W3r7aLFz80i7tG5SPjTK1NNGkB 1rwqMOHXY2Th+HT27iRdSmA/DKTrcfiLwqTzLu5gN6hndaBvV8uSlQRo3QnU1w== ) igdtdmjp0smsoj66bs0jh7narqk46itn.us. 86400 IN NSEC3 ( 1 1 1 5bf34c13 igh4llta8r2sas4fn3b9046mup9igq28 NS DS RRSIG ) igdtdmjp0smsoj66bs0jh7narqk46itn.us. 86400 IN RRSIG ( NSEC3 8 2 86400 20201026025744 20200926024424 53985 us. xFSLBiqrYmBKmGA50XpGlXQUzqkLC5MMx1bS3b9yw5ah8ceyaNuDJB/uv1eeRSTPVSi2haTxmwTe THBgsKNh6lWxQfJ3xVD8zM0hHBpThm+iPTG9+ay8wmUeptpJTXsHtKOuEVZyoJgtFtnzPusAcyR2 b6T66pbny6cV9OzXaKqQuWZiAzNnPaoeyLLrLmobcr8QfzTZFSR+Ugw5arGLsg== ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone fed.us

fed.us

	Checking DS between us and fed.us
	Query to c.cctld.us for fed.us/DS
	Received 850 bytes from 156.154.127.70
	;; Answer received from 156.154.127.70 (850 bytes) ;; HEADER SECTION ;; id = 30139 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; fed.us. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) 04mlcpvb7mqd2gpuv2rh2rcgskp50v81.us. 86400 IN NSEC3 ( 1 1 1 5bf34c13 04n7kph0sauv14jcv0o77jp3ohld0bf5 NS SOA RRSIG DNSKEY NSEC3PARAM ) 04mlcpvb7mqd2gpuv2rh2rcgskp50v81.us. 86400 IN RRSIG ( NSEC3 8 2 86400 20201022010859 20200922003233 53985 us. vl6ljRtzyDJDYuv6EySLtUdTD4DfF/u0xost5qfkwGwQbo7ZwCBw7EJiLNh4i13RuA2qUe1zZBkU GU40w82+weVkgMnYceH6rX9nBRALy9DHAowovHrRc421hrI2+9W3r7aLFz80i7tG5SPjTK1NNGkB 1rwqMOHXY2Th+HT27iRdSmA/DKTrcfiLwqTzLu5gN6hndaBvV8uSlQRo3QnU1w== ) us. 900 IN SOA ( a.cctld.us. hostmaster.neustar.biz. 2027216157 ;serial 900 ;refresh 900 ;retry 604800 ;expire 86400 ;minimum ) us. 900 IN RRSIG ( SOA 8 1 900 20201026184507 20200926174507 53985 us. wsU9p7ivg7J3edXMbn55Z8fhJDk7DgVFslNuYDu7EDEtkAUQv+MpthJsPvLp1Kwm8J7VEYUaeAJw k0tcwMGuJnopniPGWVv2qfGdvW/BTw4Il5iihi+fmhywT05XvpHr5sDrpw3bd/Ee09bE44OGra+l b869dcRozL6y5fITbjunp30KA3DJbObzidigeKxIgHnTlIi/icilMFxihmt7Cw== ) igdtdmjp0smsoj66bs0jh7narqk46itn.us. 86400 IN NSEC3 ( 1 1 1 5bf34c13 igh4llta8r2sas4fn3b9046mup9igq28 NS DS RRSIG ) igdtdmjp0smsoj66bs0jh7narqk46itn.us. 86400 IN RRSIG ( NSEC3 8 2 86400 20201026025744 20200926024424 53985 us. xFSLBiqrYmBKmGA50XpGlXQUzqkLC5MMx1bS3b9yw5ah8ceyaNuDJB/uv1eeRSTPVSi2haTxmwTe THBgsKNh6lWxQfJ3xVD8zM0hHBpThm+iPTG9+ay8wmUeptpJTXsHtKOuEVZyoJgtFtnzPusAcyR2 b6T66pbny6cV9OzXaKqQuWZiAzNnPaoeyLLrLmobcr8QfzTZFSR+Ugw5arGLsg== ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	No DS records found for fed.us in the us zone
	Query to a.gov-servers.net for fed.us/DNSKEY
	Received 110 bytes from 69.36.157.30
	;; Answer received from 69.36.157.30 (110 bytes) ;; HEADER SECTION ;; id = 3761 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 1 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; fed.us. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) fed.us. 86400 IN SOA ( a.gov-servers.net. nstld.verisign-grs.com. 1601140201 ;serial 3600 ;refresh 900 ;retry 1814400 ;expire 86400 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	No DNSKEY records found
	Query to a.gov-servers.net for fed.us/A
	Received 110 bytes from 69.36.157.30
	;; Answer received from 69.36.157.30 (110 bytes) ;; HEADER SECTION ;; id = 13511 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 1 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; fed.us. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) fed.us. 86400 IN SOA ( a.gov-servers.net. nstld.verisign-grs.com. 1601140201 ;serial 3600 ;refresh 900 ;retry 1814400 ;expire 86400 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	fed.us is authoritative for fed.us
	Query to a.gov-servers.net for fed.us/SOA
	Received 172 bytes from 69.36.157.30
	;; Answer received from 69.36.157.30 (172 bytes) ;; HEADER SECTION ;; id = 26362 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; fed.us. IN SOA ;; ANSWER SECTION (1 record) fed.us. 86400 IN SOA ( a.gov-servers.net. nstld.verisign-grs.com. 1601140201 ;serial 3600 ;refresh 900 ;retry 1814400 ;expire 86400 ;minimum ) ;; AUTHORITY SECTION (4 records) fed.us. 172800 IN NS c.gov-servers.net. fed.us. 172800 IN NS a.gov-servers.net. fed.us. 172800 IN NS d.gov-servers.net. fed.us. 172800 IN NS b.gov-servers.net. ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to b.gov-servers.net for fed.us/SOA
	Received 172 bytes from 209.112.123.30
	;; Answer received from 209.112.123.30 (172 bytes) ;; HEADER SECTION ;; id = 59713 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; fed.us. IN SOA ;; ANSWER SECTION (1 record) fed.us. 86400 IN SOA ( a.gov-servers.net. nstld.verisign-grs.com. 1601140201 ;serial 3600 ;refresh 900 ;retry 1814400 ;expire 86400 ;minimum ) ;; AUTHORITY SECTION (4 records) fed.us. 172800 IN NS c.gov-servers.net. fed.us. 172800 IN NS a.gov-servers.net. fed.us. 172800 IN NS d.gov-servers.net. fed.us. 172800 IN NS b.gov-servers.net. ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to d.gov-servers.net for fed.us/SOA
	Received 172 bytes from 81.19.194.30
	;; Answer received from 81.19.194.30 (172 bytes) ;; HEADER SECTION ;; id = 43946 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; fed.us. IN SOA ;; ANSWER SECTION (1 record) fed.us. 86400 IN SOA ( a.gov-servers.net. nstld.verisign-grs.com. 1601140201 ;serial 3600 ;refresh 900 ;retry 1814400 ;expire 86400 ;minimum ) ;; AUTHORITY SECTION (4 records) fed.us. 172800 IN NS c.gov-servers.net. fed.us. 172800 IN NS a.gov-servers.net. fed.us. 172800 IN NS d.gov-servers.net. fed.us. 172800 IN NS b.gov-servers.net. ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to c.gov-servers.net for fed.us/SOA
	Received 172 bytes from 69.36.153.30
	;; Answer received from 69.36.153.30 (172 bytes) ;; HEADER SECTION ;; id = 4417 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; fed.us. IN SOA ;; ANSWER SECTION (1 record) fed.us. 86400 IN SOA ( a.gov-servers.net. nstld.verisign-grs.com. 1601140201 ;serial 3600 ;refresh 900 ;retry 1814400 ;expire 86400 ;minimum ) ;; AUTHORITY SECTION (4 records) fed.us. 172800 IN NS c.gov-servers.net. fed.us. 172800 IN NS a.gov-servers.net. fed.us. 172800 IN NS d.gov-servers.net. fed.us. 172800 IN NS b.gov-servers.net. ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to a.gov-servers.net for fed.us/A
	Received 110 bytes from 69.36.157.30
	;; Answer received from 69.36.157.30 (110 bytes) ;; HEADER SECTION ;; id = 53580 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 1 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; fed.us. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) fed.us. 86400 IN SOA ( a.gov-servers.net. nstld.verisign-grs.com. 1601140201 ;serial 3600 ;refresh 900 ;retry 1814400 ;expire 86400 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	No NSEC records in response
	No RRSIGs found

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test fed.us at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: