DNSSEC Debugger

Back to Verisign Labs Tools

Domain Name:

Detail: more(+) / less(-)

Time: 2026-05-03 09:10:46 UTC

Analyzing DNSSEC problems for https

DS=20326/SHA-256 is now in the chain-of-trust

DS=38696/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	`. IN DS ( 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 )`
	Query to e.root-servers.net for ./DNSKEY
	Received 1139 bytes from 192.203.230.10
	;; Response received from [192.203.230.10] 1139 octets ;; HEADER SECTION ;; id = 6116 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAb5dDYffpgAJ8VUGLwQtWXPlQWsjIFJtCM00/XaKU+8ln+ofah3q2KxEIjvzQg+nqdxRj+8e mtPne1mtYcbFWP4Q9E+DniOJLK09R05FuzvGbrG7DDdRDUX/cedFdV7O8pFEAYpJqYNR9BCTIAV9 73DO2biauKSA31b7I2lK/woxoR1tf5cqJ4SMbJUviuHicAEoUi2ATswloZNWd5T5thmEFZnxFx7D 5UgKCY7oflS7+GU7dNJwEtmFnWYVETHN0kHXVz6aguouaAZp706YXNIoR/iTgQhmsR7XX+wL0Z8Q M2LxQIyU6vRZ06IyuJMGRMiwkSuGElbumyBt12JZbrU= ) ; keytag 54393 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20260522000000 20260501000000 20326 . XC4YzJpuixXq5eF9t9OXXvrNtB0+0gs/MO3lX+JodZefuAr2U4nez+6R/I9QRfgJqwfCotzoE8AL UikNxpFUw+hfd4bEMId+6iYfj+7gWVQRM2msZAidCdbp4NddeHYDrlsyOel4QBlnUJPyJFekQygB b3ZfyfLl0HEUD9Bb1R4C1uK7tAprVAP8XXA0n8PMhGEmr1SXgodiHpkZ9X4S31ahRh3tSpTn1eGz 04kydmswhw8RDzCdd18BXBZGDSpzFBSSUr1ttRkQmjTZbBFkNrG092D4yDu7h2xVrePmMcjZMhpL UI75Ks2vXO6dX08oey9sbDAezOwZtvSLld936w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAb5dDYffpgAJ8VUGLwQtWXPlQWsjIFJtCM00/XaKU+8ln+ofah3q2KxEIjvzQg+nqdxRj+8e mtPne1mtYcbFWP4Q9E+DniOJLK09R05FuzvGbrG7DDdRDUX/cedFdV7O8pFEAYpJqYNR9BCTIAV9 73DO2biauKSA31b7I2lK/woxoR1tf5cqJ4SMbJUviuHicAEoUi2ATswloZNWd5T5thmEFZnxFx7D 5UgKCY7oflS7+GU7dNJwEtmFnWYVETHN0kHXVz6aguouaAZp706YXNIoR/iTgQhmsR7XX+wL0Z8Q M2LxQIyU6vRZ06IyuJMGRMiwkSuGElbumyBt12JZbrU= ) ; keytag 54393`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	DNSKEY=38696/SEP is now in the chain-of-trust
	DS=38696/SHA-256 verifies DNSKEY=38696/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20260522000000 20260501000000 20326 . XC4YzJpuixXq5eF9t9OXXvrNtB0+0gs/MO3lX+JodZefuAr2U4nez+6R/I9QRfgJqwfCotzoE8AL UikNxpFUw+hfd4bEMId+6iYfj+7gWVQRM2msZAidCdbp4NddeHYDrlsyOel4QBlnUJPyJFekQygB b3ZfyfLl0HEUD9Bb1R4C1uK7tAprVAP8XXA0n8PMhGEmr1SXgodiHpkZ9X4S31ahRh3tSpTn1eGz 04kydmswhw8RDzCdd18BXBZGDSpzFBSSUr1ttRkQmjTZbBFkNrG092D4yDu7h2xVrePmMcjZMhpL UI75Ks2vXO6dX08oey9sbDAezOwZtvSLld936w== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=54393 is now in the chain-of-trust
	Query to f.root-servers.net for https/A
	Received 1020 bytes from 192.5.5.241
	;; Response received from [192.5.5.241] 1020 octets ;; HEADER SECTION ;; id = 20431 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NXDOMAIN ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; https. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) . 86400 IN SOA ( a.root-servers.net. nstld.verisign-grs.com. 2026050300 ;serial 1800 ;refresh 900 ;retry 604800 ;expire 86400 ;minimum ) . 86400 IN RRSIG ( SOA 8 0 86400 20260516050000 20260503040000 54393 . lavMxRFxQFc9HR7ppYj0kW6pglBABGEzPyx8y/0UTm3mCMS88H4Gcq5GlQb9LNPf9tqK+31fJ+7e 8+YUcM8GQR6LCt1xmBQMvy5UuAysi5UIC95XhR/e0FsB5uijFP/9QSGAmGeWtJjMhMngBaGRvp7r odyL/9O7pXfUeyuXMMyxtOPgA8XIlp8QFf7q0ohZPDwMrQPhxDrX0Itlt3/VLg/SFIEU330pA1BQ LfGg9emU8rmbZXgfQvFujJBGv1iYN0aaQhZCjDQbl4BF+xZEnXz/Wk9ZCqCKrw42AXFqdzlDdNwZ Gv6/RZAl8S+ntF7jeBpdOn8H08HKyG+dxVxVCg== ) ht. 86400 IN NSEC hu. NS DS RRSIG NSEC ht. 86400 IN RRSIG ( NSEC 8 1 86400 20260516050000 20260503040000 54393 . TJDsjJsY6Nl+mIqeEWjUifXsCUa/PepYLbsQB/lxMqq9kS7mHrX1neLRzd4wpzV6XiikhaIuMd5f WE8822TZR7RoV5e09jAQFo3MnovTDfRBoTByl9l23Qi4ZCZrXiNewt0QtyoM1LZ9noevxedp6Rwc OkQlayVeINAgowjKtQ39fZmMMyvz3bEd66rshGX6BFujoDab9mm0iUtxZC0B6OKta855XWv66riJ yYK/irywprhlSyh9b8gZ+eZFPxQURJUO+whUX2rMy3zQ/C61PL0r2QxEMFnMP3X8FuvtOWJeZAqz yoemoPasbNha5WpgXtlJgNnzsZxwEICZcmxTZg== ) . 86400 IN NSEC aaa. NS SOA RRSIG NSEC DNSKEY ZONEMD . 86400 IN RRSIG ( NSEC 8 0 86400 20260516050000 20260503040000 54393 . Em0B4pjLH/r3mpECNN0NYwhVdM74PB6DI0HDWipa/ZoiY+QqTXqv09P+EWD3m11X3eT79gJlt6Sg EGV5PrWxT+BV9f09voYoersDyGWyUL79AOtK+p//tsihQm2ya3QPL2+B6Z0o9h9RrS/ggcZ4a+D8 mHVZ2N4nV9DdEUm0r2AILrJJMs/cH/HlJsCHlC6fQS5TCHZG2fErb8HK3NxXoK2+rjoDH0BJdirB 2LOtz4X8+hBIEm1m630UEIFC2yhHnQIZ8BmTTn3aIhg/jfnYKMKBFlM288QCvKYeikrv7UcvDqV4 7b9dCNvFZ/VdnnP3s0ZoQCaXrdbIyiF48jzGzQ== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Zone . (192.5.5.241) returns NXDOMAIN for https
	Checking NSEC records for an NXDOMAIN response
	Found 1 RRSIGs over NSEC RRset
	`ht. 86400 IN RRSIG ( NSEC 8 1 86400 20260516050000 20260503040000 54393 . TJDsjJsY6Nl+mIqeEWjUifXsCUa/PepYLbsQB/lxMqq9kS7mHrX1neLRzd4wpzV6XiikhaIuMd5f WE8822TZR7RoV5e09jAQFo3MnovTDfRBoTByl9l23Qi4ZCZrXiNewt0QtyoM1LZ9noevxedp6Rwc OkQlayVeINAgowjKtQ39fZmMMyvz3bEd66rshGX6BFujoDab9mm0iUtxZC0B6OKta855XWv66riJ yYK/irywprhlSyh9b8gZ+eZFPxQURJUO+whUX2rMy3zQ/C61PL0r2QxEMFnMP3X8FuvtOWJeZAqz yoemoPasbNha5WpgXtlJgNnzsZxwEICZcmxTZg== )`
	RRSIG=54393 and DNSKEY=54393 verifies the NSEC RRset
	NSEC proves no records exist with name https