DNSSEC Analyzer - intternetti.fi

Domain Name:

Time: 2021-06-18 00:26:07 UTC, NTP stratum 4

Analyzing DNSSEC problems for intternetti.fi

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to d.root-servers.net for ./DNSKEY
	Received 864 bytes from 199.7.91.13
	;; Answer received from 199.7.91.13 (864 bytes) ;; HEADER SECTION ;; id = 19805 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1450 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAa+HvD7XXjmL+1htThUQyZW7oWGnjzKHJASg3TSR5Bmu5LfnSVW7fxqZa2oAYo2ionIQWyqA j/loApzg8GNMhyIibftPJso54uWRQ2GaoMrwLD5SLu676kf7urJq6nqdjNC0aJM/C888li69lVH6 tiu2tZm1NH3cmgfnMUJpD60bsrDUqs7XwftmNkdkHa4ltQbM3UNPyfTaNBQYoH3wpOpSjdk3tyDR nreBO6Idrw+DGf/rve4sL3qiSaXfYIkcwAwozxR34iHU5dbCDs8S6FmZYhoSVKVgNSUkudxhd9/6 RrZkYRgvwRsQXl3UwsacU1DsXcORqIC+7NlQ6M2OJVU= ) ; Key ID = 14631 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20210701000000 20210610000000 20326 . BnlgUs78N3ckYFZHySrbdpmlrvI6d7lY5TNKs2J7miY5T03UuR2EJGcLwpoEL5trbTVqKL3/MCSD E+1E8N8kB6yskFAqloUMifyI+5sqApbuWtohUU7IcEYQ8cko/PLngbVwVMNJyipXd54A4pmWKSy4 qAa74sdsYTDmyPrsYibxTKwdmjLOrAxB1gOj435BgmV7z50feme761b06SwG3ChyQdVOXWOhbWtL IvrqIxiHvjSSgmCyicZSvbP+m+oan4BDhe/cH6/yhsQOtBC3enr/QP7mhhcoURGoF0bd/S0eoLMp e5PDeyKeyzV0R5O7CAb44lX37G2VOlSTH/1crQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1450 ;; option:
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAa+HvD7XXjmL+1htThUQyZW7oWGnjzKHJASg3TSR5Bmu5LfnSVW7fxqZa2oAYo2ionIQWyqA j/loApzg8GNMhyIibftPJso54uWRQ2GaoMrwLD5SLu676kf7urJq6nqdjNC0aJM/C888li69lVH6 tiu2tZm1NH3cmgfnMUJpD60bsrDUqs7XwftmNkdkHa4ltQbM3UNPyfTaNBQYoH3wpOpSjdk3tyDR nreBO6Idrw+DGf/rve4sL3qiSaXfYIkcwAwozxR34iHU5dbCDs8S6FmZYhoSVKVgNSUkudxhd9/6 RrZkYRgvwRsQXl3UwsacU1DsXcORqIC+7NlQ6M2OJVU= ) ; Key ID = 14631`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20210701000000 20210610000000 20326 . BnlgUs78N3ckYFZHySrbdpmlrvI6d7lY5TNKs2J7miY5T03UuR2EJGcLwpoEL5trbTVqKL3/MCSD E+1E8N8kB6yskFAqloUMifyI+5sqApbuWtohUU7IcEYQ8cko/PLngbVwVMNJyipXd54A4pmWKSy4 qAa74sdsYTDmyPrsYibxTKwdmjLOrAxB1gOj435BgmV7z50feme761b06SwG3ChyQdVOXWOhbWtL IvrqIxiHvjSSgmCyicZSvbP+m+oan4BDhe/cH6/yhsQOtBC3enr/QP7mhhcoURGoF0bd/S0eoLMp e5PDeyKeyzV0R5O7CAb44lX37G2VOlSTH/1crQ== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=14631 is now in the chain-of-trust
	Query to h.root-servers.net for intternetti.fi/A
	Received 978 bytes from 198.97.190.53
	;; Answer received from 198.97.190.53 (978 bytes) ;; HEADER SECTION ;; id = 40128 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 12 arcount = 21 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; intternetti.fi. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (12 records) fi. 172800 IN NS a.fi. fi. 172800 IN NS b.fi. fi. 172800 IN NS c.fi. fi. 172800 IN NS d.fi. fi. 172800 IN NS e.fi. fi. 172800 IN NS f.fi. fi. 172800 IN NS g.fi. fi. 172800 IN NS h.fi. fi. 172800 IN NS i.fi. fi. 172800 IN NS j.fi. fi. 86400 IN DS ( 44855 8 2 80cd184a31c50d5dc44b4f98811f298315986b44edcc0666455c6aef7dbd997e ) fi. 86400 IN RRSIG ( DS 8 1 86400 20210630170000 20210617160000 14631 . I4X9Serb3BL1rY/TFOtxpB0GuEEBys4Y0hsCH3JsQyX2KSUOG3kB//ezHl0i0bba0c9CooGeFi/g /UW9V4Z9eZ6/zh9JC5oz7W+4S1VbhzSwwu7szSv8SX07iPHTBn0X9JJFvqkhQR5o5KQmiIYBGMDf jCbInXMp9WfKMvA9/fF53d7oAC/oz1I++Dv+AGkNUIlP3fzfbQzXKUFdexM4tFQqvEgNY504I4QD UNvKQb+2qwirnefRhlVTFRNKz/eznd08qkCj2q8VPJvNEuIJRlnKGg+4NmQIvVm1sF/QvfqPxShq F7lh5aegBmAybn60pOVO4gQXpEkBjB6FOvGlSA== ) ;; ADDITIONAL SECTION (21 records) a.fi. 172800 IN A 193.166.4.1 b.fi. 172800 IN A 194.146.106.26 c.fi. 172800 IN A 194.0.11.104 d.fi. 172800 IN A 77.72.229.253 e.fi. 172800 IN A 194.0.1.14 f.fi. 172800 IN A 87.239.127.198 g.fi. 172800 IN A 204.61.216.98 h.fi. 172800 IN A 87.239.120.11 i.fi. 172800 IN A 194.0.25.30 j.fi. 172800 IN A 185.159.199.190 a.fi. 172800 IN AAAA 2001:708:10:53::53 b.fi. 172800 IN AAAA 2001:67c:1010:6::53 c.fi. 172800 IN AAAA 2001:678:e:104::53 d.fi. 172800 IN AAAA 2a01:3f0:0:302::53 e.fi. 172800 IN AAAA 2001:678:4::e f.fi. 172800 IN AAAA 2a00:13f0:0:3::aaaa g.fi. 172800 IN AAAA 2001:500:14:6098:ad::1 h.fi. 172800 IN AAAA 2001:678:a0::aaaa i.fi. 172800 IN AAAA 2001:678:20::30 j.fi. 172800 IN AAAA 2620:10a:80ac::190 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to i.root-servers.net for fi/DNSKEY
	Received 966 bytes from 192.36.148.17
	;; Answer received from 192.36.148.17 (966 bytes) ;; HEADER SECTION ;; id = 60474 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 12 arcount = 21 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; fi. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (12 records) fi. 172800 IN NS b.fi. fi. 172800 IN NS g.fi. fi. 172800 IN NS j.fi. fi. 172800 IN NS d.fi. fi. 172800 IN NS c.fi. fi. 172800 IN NS a.fi. fi. 172800 IN NS e.fi. fi. 172800 IN NS f.fi. fi. 172800 IN NS h.fi. fi. 172800 IN NS i.fi. fi. 86400 IN DS ( 44855 8 2 80cd184a31c50d5dc44b4f98811f298315986b44edcc0666455c6aef7dbd997e ) fi. 86400 IN RRSIG ( DS 8 1 86400 20210630170000 20210617160000 14631 . I4X9Serb3BL1rY/TFOtxpB0GuEEBys4Y0hsCH3JsQyX2KSUOG3kB//ezHl0i0bba0c9CooGeFi/g /UW9V4Z9eZ6/zh9JC5oz7W+4S1VbhzSwwu7szSv8SX07iPHTBn0X9JJFvqkhQR5o5KQmiIYBGMDf jCbInXMp9WfKMvA9/fF53d7oAC/oz1I++Dv+AGkNUIlP3fzfbQzXKUFdexM4tFQqvEgNY504I4QD UNvKQb+2qwirnefRhlVTFRNKz/eznd08qkCj2q8VPJvNEuIJRlnKGg+4NmQIvVm1sF/QvfqPxShq F7lh5aegBmAybn60pOVO4gQXpEkBjB6FOvGlSA== ) ;; ADDITIONAL SECTION (21 records) j.fi. 172800 IN A 185.159.199.190 i.fi. 172800 IN A 194.0.25.30 h.fi. 172800 IN A 87.239.120.11 g.fi. 172800 IN A 204.61.216.98 f.fi. 172800 IN A 87.239.127.198 e.fi. 172800 IN A 194.0.1.14 d.fi. 172800 IN A 77.72.229.253 c.fi. 172800 IN A 194.0.11.104 b.fi. 172800 IN A 194.146.106.26 a.fi. 172800 IN A 193.166.4.1 j.fi. 172800 IN AAAA 2620:10a:80ac::190 i.fi. 172800 IN AAAA 2001:678:20::30 h.fi. 172800 IN AAAA 2001:678:a0::aaaa g.fi. 172800 IN AAAA 2001:500:14:6098:ad::1 f.fi. 172800 IN AAAA 2a00:13f0:0:3::aaaa e.fi. 172800 IN AAAA 2001:678:4::e d.fi. 172800 IN AAAA 2a01:3f0:0:302::53 c.fi. 172800 IN AAAA 2001:678:e:104::53 b.fi. 172800 IN AAAA 2001:67c:1010:6::53 a.fi. 172800 IN AAAA 2001:708:10:53::53 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone fi

	Checking DS between . and fi
	Query to g.root-servers.net for fi/DS
	Received 366 bytes from 192.112.36.4
	;; Answer received from 192.112.36.4 (366 bytes) ;; HEADER SECTION ;; id = 64953 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; fi. IN DS ;; ANSWER SECTION (2 records) fi. 86400 IN DS ( 44855 8 2 80cd184a31c50d5dc44b4f98811f298315986b44edcc0666455c6aef7dbd997e ) fi. 86400 IN RRSIG ( DS 8 1 86400 20210630170000 20210617160000 14631 . I4X9Serb3BL1rY/TFOtxpB0GuEEBys4Y0hsCH3JsQyX2KSUOG3kB//ezHl0i0bba0c9CooGeFi/g /UW9V4Z9eZ6/zh9JC5oz7W+4S1VbhzSwwu7szSv8SX07iPHTBn0X9JJFvqkhQR5o5KQmiIYBGMDf jCbInXMp9WfKMvA9/fF53d7oAC/oz1I++Dv+AGkNUIlP3fzfbQzXKUFdexM4tFQqvEgNY504I4QD UNvKQb+2qwirnefRhlVTFRNKz/eznd08qkCj2q8VPJvNEuIJRlnKGg+4NmQIvVm1sF/QvfqPxShq F7lh5aegBmAybn60pOVO4gQXpEkBjB6FOvGlSA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 1 DS records for fi in the . zone
	DS=44855/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`fi. 86400 IN RRSIG ( DS 8 1 86400 20210630170000 20210617160000 14631 . I4X9Serb3BL1rY/TFOtxpB0GuEEBys4Y0hsCH3JsQyX2KSUOG3kB//ezHl0i0bba0c9CooGeFi/g /UW9V4Z9eZ6/zh9JC5oz7W+4S1VbhzSwwu7szSv8SX07iPHTBn0X9JJFvqkhQR5o5KQmiIYBGMDf jCbInXMp9WfKMvA9/fF53d7oAC/oz1I++Dv+AGkNUIlP3fzfbQzXKUFdexM4tFQqvEgNY504I4QD UNvKQb+2qwirnefRhlVTFRNKz/eznd08qkCj2q8VPJvNEuIJRlnKGg+4NmQIvVm1sF/QvfqPxShq F7lh5aegBmAybn60pOVO4gQXpEkBjB6FOvGlSA== )`
	RRSIG=14631 and DNSKEY=14631 verifies the DS RRset
	DS=44855/SHA-256 is now in the chain-of-trust
	`fi. 86400 IN DS ( 44855 8 2 80cd184a31c50d5dc44b4f98811f298315986b44edcc0666455c6aef7dbd997e )`
	Query to j.fi for fi/DNSKEY
	Received 1439 bytes from 185.159.199.190
	;; Answer received from 185.159.199.190 (1439 bytes) ;; HEADER SECTION ;; id = 2453 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 5 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; fi. IN DNSKEY ;; ANSWER SECTION (5 records) fi. 900 IN DNSKEY ( 256 3 8 AwEAAcNLpOCDV22nPT3tPn8WSqBxqPAMfuKwhu/l2L5GbOVmEvnWm+idmF+1zHN/NrJC+kTJaY+J 0y/D9Yh/Y3Lg4p1GiQy+BYPdtsjBKV/itVFl16+RaMxtnc5yr4i1fYOgImWfgso84XdfTj5yTY8e t0RyUk6yHfUr6+KO2ZvoOI6B/34+zNauclqDBD4E4vyW96sqIFqrizGRKwBPDE1gDQ8Lemhu5knv Rwxcoqu8VIoczliZZiWu+kvo75fADccp7chxeZ1T9P9TZThg2C57cLjUq5gFix5r4JEp7iFC5Dkw IAM/CUNc90Jrem6fjLeOfGMi4dJwL113qQC8ILf0dpk= ) ; Key ID = 37335 fi. 900 IN DNSKEY ( 257 3 8 AwEAAb9AMR4NV2YxZH9E6ELMFY5DOszkdTd5AxhSg1YZWi8B9cruHXjghFCmApd1VfUyQ4MX3DZb skfML/ToxumeSv9OhfA4I6Fao9bN9UxsBbFlkqwqhAGmuJapSgNuyMWArSoUG4XB/dykPNdyFt+3 t1dEH/S3hS5JmZccSI6YAjnUfG+Pd45R8ljO8ERI1wSa0IJjDArkuFaLcGrtjR9GJluVmM150gWV UIiUkBfDUz8pFjqAWewk0QY9TX22Z8gfl3yKhO9TYPVHN1oMHTydVqjQKbdbs/BvGXx/GPh63OOx E2ICmxXcz2Ma+082eA0DfwKLo86PFOre8YK7pEWuw4U= ) ; Key ID = 44855 fi. 900 IN DNSKEY ( 257 3 8 AwEAAciMz/FpbpdTYvPhQOHNMLjEI9USPPKnTydWAt6Uw9rRK+d6+H3+W41hwO4Bm57VUIs6cIQO hnE/hMIAjS+ygcMkFbooF7/gUOOrZU/TE0q3+CKx+jkLXWWi7MWOjBM/58tJo9+loES1ZTm4mute Xny1OTij7ypPXi12GpsYd7Eo6S7eXnAwP9KfJB/e/hdY52ilm/4ezIKVk7pEcH4U1qkeD5mz6Cf/ 9Gcfbz0CY1zkmM29Ib9UmJWMP8iYyOqdycmPZ6xrQBi/AKMF8s+dovRPXBviNgMvEmUgKA1763m/ KA9mskOd5xgLEmCQzVzk38hiNie4XCJcq2TIPBGAyV0= ) ; Key ID = 54049 fi. 900 IN RRSIG ( DNSKEY 8 1 900 20210629082517 20210615142621 44855 fi. Pr0rAQ8Iip1H2+heYmDeCV2cu/P4d/sGZdjFL5oaSlRHhI0eTxYeQik0mLo+0EkbtDKzvEPSxP0j EKPR53TMNOTTqT8mn4w9c5DphfjwDFgaHBx/ulQwwicV+zcJmkKX7R7sxzlyghtWZwCmEXEmObQt EJmBgmLqxgsk3xjWRwreXYl1zxEQgFuYVVzD2Zcqq7x7/tlST0a/OLvgNHGUpdvVLXzrpPf0AFEs rANS9TH/q0fdRjVCMU+VnyYgxPkRqNoayWmX9p8OBpbImmfAGy9rXbDoB/1253D8S5qixPypXddQ iC852WbpVyofX45ovGyhoqxLHoJ5ya47TNZUag== ) fi. 900 IN RRSIG ( DNSKEY 8 1 900 20210629082517 20210615142621 54049 fi. NBgJxoJCZ8HAItJm6qgH/V5YPhjURr6K3uwTalGWDErIttgdKSSQfTAQo/b6zXDszFnVjkGdhEx6 V5BRde1dRy5UWqoO38HssviPndX5iBfhvJWyGPudOCKvjeYjpNKw0jZZqsDxXn4igwl8TzAhySF4 umLWUgEJUMOVw+cBja/PsJ7MtJWGdbTeUAfivPA97YYg1Ugr76AomKGMSKjLNnD52STkVm3rhiPr nlD654JXTVJMmkD6RMu95YAtKJ7184YWvVpf846rUlk1UU9ofSiTztmLshcRBmC43XFe2WLGwIpq SVSqGiMFvUDleoqah048OURGYLJ+14VRKrvI8w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 3 DNSKEY records for fi
	`fi. 900 IN DNSKEY ( 256 3 8 AwEAAcNLpOCDV22nPT3tPn8WSqBxqPAMfuKwhu/l2L5GbOVmEvnWm+idmF+1zHN/NrJC+kTJaY+J 0y/D9Yh/Y3Lg4p1GiQy+BYPdtsjBKV/itVFl16+RaMxtnc5yr4i1fYOgImWfgso84XdfTj5yTY8e t0RyUk6yHfUr6+KO2ZvoOI6B/34+zNauclqDBD4E4vyW96sqIFqrizGRKwBPDE1gDQ8Lemhu5knv Rwxcoqu8VIoczliZZiWu+kvo75fADccp7chxeZ1T9P9TZThg2C57cLjUq5gFix5r4JEp7iFC5Dkw IAM/CUNc90Jrem6fjLeOfGMi4dJwL113qQC8ILf0dpk= ) ; Key ID = 37335`
	`fi. 900 IN DNSKEY ( 257 3 8 AwEAAb9AMR4NV2YxZH9E6ELMFY5DOszkdTd5AxhSg1YZWi8B9cruHXjghFCmApd1VfUyQ4MX3DZb skfML/ToxumeSv9OhfA4I6Fao9bN9UxsBbFlkqwqhAGmuJapSgNuyMWArSoUG4XB/dykPNdyFt+3 t1dEH/S3hS5JmZccSI6YAjnUfG+Pd45R8ljO8ERI1wSa0IJjDArkuFaLcGrtjR9GJluVmM150gWV UIiUkBfDUz8pFjqAWewk0QY9TX22Z8gfl3yKhO9TYPVHN1oMHTydVqjQKbdbs/BvGXx/GPh63OOx E2ICmxXcz2Ma+082eA0DfwKLo86PFOre8YK7pEWuw4U= ) ; Key ID = 44855`
	`fi. 900 IN DNSKEY ( 257 3 8 AwEAAciMz/FpbpdTYvPhQOHNMLjEI9USPPKnTydWAt6Uw9rRK+d6+H3+W41hwO4Bm57VUIs6cIQO hnE/hMIAjS+ygcMkFbooF7/gUOOrZU/TE0q3+CKx+jkLXWWi7MWOjBM/58tJo9+loES1ZTm4mute Xny1OTij7ypPXi12GpsYd7Eo6S7eXnAwP9KfJB/e/hdY52ilm/4ezIKVk7pEcH4U1qkeD5mz6Cf/ 9Gcfbz0CY1zkmM29Ib9UmJWMP8iYyOqdycmPZ6xrQBi/AKMF8s+dovRPXBviNgMvEmUgKA1763m/ KA9mskOd5xgLEmCQzVzk38hiNie4XCJcq2TIPBGAyV0= ) ; Key ID = 54049`
	DNSKEY=44855/SEP is now in the chain-of-trust
	DS=44855/SHA-256 verifies DNSKEY=44855/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`fi. 900 IN RRSIG ( DNSKEY 8 1 900 20210629082517 20210615142621 44855 fi. Pr0rAQ8Iip1H2+heYmDeCV2cu/P4d/sGZdjFL5oaSlRHhI0eTxYeQik0mLo+0EkbtDKzvEPSxP0j EKPR53TMNOTTqT8mn4w9c5DphfjwDFgaHBx/ulQwwicV+zcJmkKX7R7sxzlyghtWZwCmEXEmObQt EJmBgmLqxgsk3xjWRwreXYl1zxEQgFuYVVzD2Zcqq7x7/tlST0a/OLvgNHGUpdvVLXzrpPf0AFEs rANS9TH/q0fdRjVCMU+VnyYgxPkRqNoayWmX9p8OBpbImmfAGy9rXbDoB/1253D8S5qixPypXddQ iC852WbpVyofX45ovGyhoqxLHoJ5ya47TNZUag== )`
	`fi. 900 IN RRSIG ( DNSKEY 8 1 900 20210629082517 20210615142621 54049 fi. NBgJxoJCZ8HAItJm6qgH/V5YPhjURr6K3uwTalGWDErIttgdKSSQfTAQo/b6zXDszFnVjkGdhEx6 V5BRde1dRy5UWqoO38HssviPndX5iBfhvJWyGPudOCKvjeYjpNKw0jZZqsDxXn4igwl8TzAhySF4 umLWUgEJUMOVw+cBja/PsJ7MtJWGdbTeUAfivPA97YYg1Ugr76AomKGMSKjLNnD52STkVm3rhiPr nlD654JXTVJMmkD6RMu95YAtKJ7184YWvVpf846rUlk1UU9ofSiTztmLshcRBmC43XFe2WLGwIpq SVSqGiMFvUDleoqah048OURGYLJ+14VRKrvI8w== )`
	RRSIG=44855 and DNSKEY=44855/SEP verifies the DNSKEY RRset
	RRSIG=54049 and DNSKEY=54049/SEP verifies the DNSKEY RRset
	DNSKEY=37335 is now in the chain-of-trust
	DNSKEY=54049/SEP is now in the chain-of-trust
	Query to b.fi for intternetti.fi/A
	Received 498 bytes from 194.146.106.26
	;; Answer received from 194.146.106.26 (498 bytes) ;; HEADER SECTION ;; id = 57868 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 5 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; intternetti.fi. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (5 records) intternetti.fi. 21600 IN NS ns1.desec.io. intternetti.fi. 21600 IN NS ns2.desec.org. intternetti.fi. 21600 IN DS ( 39012 13 2 1367137addc1101bb84d6f52b1ad9a91df3962585a7b1ce8a677c02b0aa01c83 ) intternetti.fi. 21600 IN DS ( 39012 13 4 706c36f417fbdad26ec58b80f1ad266b1ffcb2dc2051dd1129f693f9a2bfe228 f7f3e57eea375d326bd8ec6c2055db14 ) intternetti.fi. 21600 IN RRSIG ( DS 8 2 21600 20210630095517 20210616060621 37335 fi. QodhV/Q+dp0QQ+zkkh4hCGC6N3RslLXgSiKBo3kx6meYpoj+Zmm7rBIor1NxFArBYpVlmq66B4S4 FV606FKkIKHU9RBWw+PdCZNqtVHPZV8+wU9ZbplFDhi9vo4YXgTT6yvloipQ+NWubcwFb6DlV3Ta TT66bFpB4RIdms3XXrx1DbnsmJKg+YZib52RVTn+BHEKcDW4pWQIxhdit/+yjrYxlR3/ZjWRv/k5 K6cCp8gjkI97m4ksldvbOW+jnUjCwgd9j9nV/RF1KWHB856hJqZlVvm6waF2Uilpa8YZxrSXswkP llUbdw8lOmy4KmOUveXOY9JGHybQM1ar1k/4eA== ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to a.fi for intternetti.fi/DNSKEY
	Received 498 bytes from 193.166.4.1
	;; Answer received from 193.166.4.1 (498 bytes) ;; HEADER SECTION ;; id = 63713 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 5 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; intternetti.fi. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (5 records) intternetti.fi. 21600 IN NS ns1.desec.io. intternetti.fi. 21600 IN NS ns2.desec.org. intternetti.fi. 21600 IN DS ( 39012 13 2 1367137addc1101bb84d6f52b1ad9a91df3962585a7b1ce8a677c02b0aa01c83 ) intternetti.fi. 21600 IN DS ( 39012 13 4 706c36f417fbdad26ec58b80f1ad266b1ffcb2dc2051dd1129f693f9a2bfe228 f7f3e57eea375d326bd8ec6c2055db14 ) intternetti.fi. 21600 IN RRSIG ( DS 8 2 21600 20210630095517 20210616060621 37335 fi. QodhV/Q+dp0QQ+zkkh4hCGC6N3RslLXgSiKBo3kx6meYpoj+Zmm7rBIor1NxFArBYpVlmq66B4S4 FV606FKkIKHU9RBWw+PdCZNqtVHPZV8+wU9ZbplFDhi9vo4YXgTT6yvloipQ+NWubcwFb6DlV3Ta TT66bFpB4RIdms3XXrx1DbnsmJKg+YZib52RVTn+BHEKcDW4pWQIxhdit/+yjrYxlR3/ZjWRv/k5 K6cCp8gjkI97m4ksldvbOW+jnUjCwgd9j9nV/RF1KWHB856hJqZlVvm6waF2Uilpa8YZxrSXswkP llUbdw8lOmy4KmOUveXOY9JGHybQM1ar1k/4eA== ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found child zone intternetti.fi

intternetti.fi

	Checking DS between fi and intternetti.fi
	Query to e.fi for intternetti.fi/DS
	Received 445 bytes from 194.0.1.14
	;; Answer received from 194.0.1.14 (445 bytes) ;; HEADER SECTION ;; id = 57359 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; intternetti.fi. IN DS ;; ANSWER SECTION (3 records) intternetti.fi. 21600 IN DS ( 39012 13 2 1367137addc1101bb84d6f52b1ad9a91df3962585a7b1ce8a677c02b0aa01c83 ) intternetti.fi. 21600 IN DS ( 39012 13 4 706c36f417fbdad26ec58b80f1ad266b1ffcb2dc2051dd1129f693f9a2bfe228 f7f3e57eea375d326bd8ec6c2055db14 ) intternetti.fi. 21600 IN RRSIG ( DS 8 2 21600 20210630095517 20210616060621 37335 fi. QodhV/Q+dp0QQ+zkkh4hCGC6N3RslLXgSiKBo3kx6meYpoj+Zmm7rBIor1NxFArBYpVlmq66B4S4 FV606FKkIKHU9RBWw+PdCZNqtVHPZV8+wU9ZbplFDhi9vo4YXgTT6yvloipQ+NWubcwFb6DlV3Ta TT66bFpB4RIdms3XXrx1DbnsmJKg+YZib52RVTn+BHEKcDW4pWQIxhdit/+yjrYxlR3/ZjWRv/k5 K6cCp8gjkI97m4ksldvbOW+jnUjCwgd9j9nV/RF1KWHB856hJqZlVvm6waF2Uilpa8YZxrSXswkP llUbdw8lOmy4KmOUveXOY9JGHybQM1ar1k/4eA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DS records for intternetti.fi in the fi zone
	DS=39012/SHA-256 has algorithm ECDSAP256SHA256
	DS=39012/SHA-384 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`intternetti.fi. 21600 IN RRSIG ( DS 8 2 21600 20210630095517 20210616060621 37335 fi. QodhV/Q+dp0QQ+zkkh4hCGC6N3RslLXgSiKBo3kx6meYpoj+Zmm7rBIor1NxFArBYpVlmq66B4S4 FV606FKkIKHU9RBWw+PdCZNqtVHPZV8+wU9ZbplFDhi9vo4YXgTT6yvloipQ+NWubcwFb6DlV3Ta TT66bFpB4RIdms3XXrx1DbnsmJKg+YZib52RVTn+BHEKcDW4pWQIxhdit/+yjrYxlR3/ZjWRv/k5 K6cCp8gjkI97m4ksldvbOW+jnUjCwgd9j9nV/RF1KWHB856hJqZlVvm6waF2Uilpa8YZxrSXswkP llUbdw8lOmy4KmOUveXOY9JGHybQM1ar1k/4eA== )`
	RRSIG=37335 and DNSKEY=37335 verifies the DS RRset
	DS=39012/SHA-256 is now in the chain-of-trust
	`intternetti.fi. 21600 IN DS ( 39012 13 2 1367137addc1101bb84d6f52b1ad9a91df3962585a7b1ce8a677c02b0aa01c83 )`
	`intternetti.fi. 21600 IN DS ( 39012 13 4 706c36f417fbdad26ec58b80f1ad266b1ffcb2dc2051dd1129f693f9a2bfe228 f7f3e57eea375d326bd8ec6c2055db14 )`
	Query to ns1.desec.io for intternetti.fi/DNSKEY
	Received 233 bytes from 45.54.76.1
	;; Answer received from 45.54.76.1 (233 bytes) ;; HEADER SECTION ;; id = 11938 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; intternetti.fi. IN DNSKEY ;; ANSWER SECTION (2 records) intternetti.fi. 3600 IN RRSIG ( DNSKEY 13 2 3600 20210701000000 20210610000000 39012 intternetti.fi. 8ApQakts1K161laMC/QAJIUthXZ/wcZmfOSy38JvOKr7mLqO9D8j8KmPFX1mc0WrpwgBII2w/4E9 cHLMSm7woA== ) intternetti.fi. 3600 IN DNSKEY ( 257 3 13 kJ/1KTegw2Ii/z0j2ODNyq1nYihVdPqndKJFt/niK0wev11pjX9ffT404ejCsuUETjJ4/M6gQv9b utoAdG4ZlA== ) ; Key ID = 39012 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 1 DNSKEY records for intternetti.fi
	`intternetti.fi. 3600 IN DNSKEY ( 257 3 13 kJ/1KTegw2Ii/z0j2ODNyq1nYihVdPqndKJFt/niK0wev11pjX9ffT404ejCsuUETjJ4/M6gQv9b utoAdG4ZlA== ) ; Key ID = 39012`
	DNSKEY=39012/SEP is now in the chain-of-trust
	DS=39012/SHA-256 verifies DNSKEY=39012/SEP
	DS=39012/SHA-384 verifies DNSKEY=39012/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`intternetti.fi. 3600 IN RRSIG ( DNSKEY 13 2 3600 20210701000000 20210610000000 39012 intternetti.fi. 8ApQakts1K161laMC/QAJIUthXZ/wcZmfOSy38JvOKr7mLqO9D8j8KmPFX1mc0WrpwgBII2w/4E9 cHLMSm7woA== )`
	RRSIG=39012 and DNSKEY=39012/SEP verifies the DNSKEY RRset
	Query to ns2.desec.org for intternetti.fi/A
	Received 169 bytes from 157.53.224.1
	;; Answer received from 157.53.224.1 (169 bytes) ;; HEADER SECTION ;; id = 14125 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; intternetti.fi. IN A ;; ANSWER SECTION (2 records) intternetti.fi. 3600 IN A 95.216.136.90 intternetti.fi. 3600 IN RRSIG ( A 13 2 3600 20210701000000 20210610000000 39012 intternetti.fi. lIKkqeIJ7LKPpXdZmugYGqD+XH8ZBIKPniKeSPmbdXsmLDENVj7tSTUE4aZI3RXSz5qM5l+dvslE yFeR3AEFgA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	ns2.desec.org is authoritative for intternetti.fi
	Found RRSIG signed by intternetti.fi zone
	Query to ns1.desec.io for intternetti.fi/SOA
	Received 201 bytes from 45.54.76.1
	;; Answer received from 45.54.76.1 (201 bytes) ;; HEADER SECTION ;; id = 7083 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; intternetti.fi. IN SOA ;; ANSWER SECTION (2 records) intternetti.fi. 300 IN RRSIG ( SOA 13 2 300 20210701000000 20210610000000 39012 intternetti.fi. WIqs3y7F0yYFS9OEEQZORmIAC8p2NNQn2DQXAWnG0KGr79c55OaAJtWm7m1WWDMRPea0g+Sxspbs JLxx+4XKsg== ) intternetti.fi. 300 IN SOA ( get.desec.io. get.desec.io. 2021055603 ;serial 86400 ;refresh 86400 ;retry 2419200 ;expire 3600 ;minimum ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to ns2.desec.org for intternetti.fi/A
	Received 169 bytes from 157.53.224.1
	;; Answer received from 157.53.224.1 (169 bytes) ;; HEADER SECTION ;; id = 15775 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; intternetti.fi. IN A ;; ANSWER SECTION (2 records) intternetti.fi. 3600 IN A 95.216.136.90 intternetti.fi. 3600 IN RRSIG ( A 13 2 3600 20210701000000 20210610000000 39012 intternetti.fi. lIKkqeIJ7LKPpXdZmugYGqD+XH8ZBIKPniKeSPmbdXsmLDENVj7tSTUE4aZI3RXSz5qM5l+dvslE yFeR3AEFgA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	intternetti.fi A RR has value 95.216.136.90
	Found 1 RRSIGs over A RRset
	`intternetti.fi. 3600 IN RRSIG ( A 13 2 3600 20210701000000 20210610000000 39012 intternetti.fi. lIKkqeIJ7LKPpXdZmugYGqD+XH8ZBIKPniKeSPmbdXsmLDENVj7tSTUE4aZI3RXSz5qM5l+dvslE yFeR3AEFgA== )`
	RRSIG=39012 and DNSKEY=39012/SEP verifies the A RRset

intternetti.fi

	Query to ns1.desec.io for intternetti.fi/A
	Received 169 bytes from 45.54.76.1
	;; Answer received from 45.54.76.1 (169 bytes) ;; HEADER SECTION ;; id = 60851 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; intternetti.fi. IN A ;; ANSWER SECTION (2 records) intternetti.fi. 3600 IN A 95.216.136.90 intternetti.fi. 3600 IN RRSIG ( A 13 2 3600 20210701000000 20210610000000 39012 intternetti.fi. lIKkqeIJ7LKPpXdZmugYGqD+XH8ZBIKPniKeSPmbdXsmLDENVj7tSTUE4aZI3RXSz5qM5l+dvslE yFeR3AEFgA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	ns1.desec.io is authoritative for intternetti.fi
	Found RRSIG signed by intternetti.fi zone
	Query to ns1.desec.io for intternetti.fi/A
	Received 169 bytes from 45.54.76.1
	;; Answer received from 45.54.76.1 (169 bytes) ;; HEADER SECTION ;; id = 2762 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; intternetti.fi. IN A ;; ANSWER SECTION (2 records) intternetti.fi. 3600 IN A 95.216.136.90 intternetti.fi. 3600 IN RRSIG ( A 13 2 3600 20210701000000 20210610000000 39012 intternetti.fi. lIKkqeIJ7LKPpXdZmugYGqD+XH8ZBIKPniKeSPmbdXsmLDENVj7tSTUE4aZI3RXSz5qM5l+dvslE yFeR3AEFgA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	intternetti.fi A RR has value 95.216.136.90
	Found 1 RRSIGs over A RRset
	`intternetti.fi. 3600 IN RRSIG ( A 13 2 3600 20210701000000 20210610000000 39012 intternetti.fi. lIKkqeIJ7LKPpXdZmugYGqD+XH8ZBIKPniKeSPmbdXsmLDENVj7tSTUE4aZI3RXSz5qM5l+dvslE yFeR3AEFgA== )`
	RRSIG=39012 and DNSKEY=39012/SEP verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test intternetti.fi at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: