DNSSEC Analyzer

Domain Name:

Time: 2021-03-09 07:19:09 UTC, NTP stratum 4

Analyzing DNSSEC problems for nic.cz

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to e.root-servers.net for ./DNSKEY
	Received 864 bytes from 192.203.230.10
	;; Answer received from 192.203.230.10 (864 bytes) ;; HEADER SECTION ;; id = 6224 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAbKGKkqc1VAvQr48iPf9Nd39f337MitggxF0AB9kLKRNSuq9joOEPC/R6PD/4lTzUms8U9oP +aiF0rVC2rGOKSdOLxPHRLA3ameMFT2/3bmVCFsRsn03IVTdN5VUAfczjqjmA0t9NM7bbN5oVzuQ L3P1FyQb1q6HX4M1qg+htMNEd9PdlPLMFcrUg5fcYtTr2llVkO1Xo3lAdrjmmxfGeIyQnskpwPyW 88J527DEytmgPo5KzLBYLMoL2Q41PK0ul0rs7yN+g5IG4LnJOcjew1yrmHXrp/OzrpsO4FkicufY t/ygfQKkT5HYbr/yFgeZAfaF80nYyc7wgDYxOeHdiRk= ) ; Key ID = 42351 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20210323000000 20210302000000 20326 . FNdtAv2V8CYbvlFqTS+GniRmB8onYYWV9Wi/o0nizx91+JlwGaHyh6ZcOkj9jy31+Mw6SlbOUKJx 1x2TzC8PG/gxf7piPBbdHDSdKvY1BczJLivM/BRu3+HKwAGVSPxrE+Uj682sFBGkcoi4jTXwrT/x pII8WSMQlvJrS6Db6jnaFzRVi1FXgfxVZaFmoxjuJg1azjEE6sqd+pS62QpnbI9bYniCwART2gOA 6S4102QbOw/3xGd+SeS91zFwdwec8N93per9eKWV1WidBpWexWcbOL92StJQyDjAPb77ieIojqk2 U8XNnMW7xVXwCY4aHU95iLY77CAtLM6CzyVRPg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option:
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbKGKkqc1VAvQr48iPf9Nd39f337MitggxF0AB9kLKRNSuq9joOEPC/R6PD/4lTzUms8U9oP +aiF0rVC2rGOKSdOLxPHRLA3ameMFT2/3bmVCFsRsn03IVTdN5VUAfczjqjmA0t9NM7bbN5oVzuQ L3P1FyQb1q6HX4M1qg+htMNEd9PdlPLMFcrUg5fcYtTr2llVkO1Xo3lAdrjmmxfGeIyQnskpwPyW 88J527DEytmgPo5KzLBYLMoL2Q41PK0ul0rs7yN+g5IG4LnJOcjew1yrmHXrp/OzrpsO4FkicufY t/ygfQKkT5HYbr/yFgeZAfaF80nYyc7wgDYxOeHdiRk= ) ; Key ID = 42351`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20210323000000 20210302000000 20326 . FNdtAv2V8CYbvlFqTS+GniRmB8onYYWV9Wi/o0nizx91+JlwGaHyh6ZcOkj9jy31+Mw6SlbOUKJx 1x2TzC8PG/gxf7piPBbdHDSdKvY1BczJLivM/BRu3+HKwAGVSPxrE+Uj682sFBGkcoi4jTXwrT/x pII8WSMQlvJrS6Db6jnaFzRVi1FXgfxVZaFmoxjuJg1azjEE6sqd+pS62QpnbI9bYniCwART2gOA 6S4102QbOw/3xGd+SeS91zFwdwec8N93per9eKWV1WidBpWexWcbOL92StJQyDjAPb77ieIojqk2 U8XNnMW7xVXwCY4aHU95iLY77CAtLM6CzyVRPg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=42351 is now in the chain-of-trust
	Query to b.root-servers.net for nic.cz/A
	Received 613 bytes from 199.9.14.201
	;; Answer received from 199.9.14.201 (613 bytes) ;; HEADER SECTION ;; id = 30084 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; nic.cz. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) cz. 172800 IN NS a.ns.nic.cz. cz. 172800 IN NS b.ns.nic.cz. cz. 172800 IN NS c.ns.nic.cz. cz. 172800 IN NS d.ns.nic.cz. cz. 86400 IN DS ( 20237 13 2 cff0f3ecdbc529c1f0031ba1840bfb835853b9209ed1e508fff48451d7b778e2 ) cz. 86400 IN RRSIG ( DS 8 1 86400 20210322050000 20210309040000 42351 . khizBPnL8WAhJb+Y09j6NiCLu5OylpR5Dl7dYn8nvImdFse7GDKlUmI7w9p7gIw+1ymQf5ozsOQ7 3XdV6jMFQMlmB6J2C0t531sIkcffayDip1NuP/vcofkCDBm/R3Hc3PKlQoM+TjgRJ17OblMIasi7 Vp4vrz3XOtyriZ0y6yNI0AMBjXlBm5uzDuyVSUgMka4afq3YVYoLOPhDg85ghGzzK1lHZ1GJ76Ok bL9Dd+8H+qyJlvW9AiXulSpdtXGCf3ATQMSod+aPFdKqZbw+P7xeTuAiUieQFUzZY87Q0uHXLd9j GbzqKYe+dBws9XBwHw7tDInoc6BtmqfzVqeJ8g== ) ;; ADDITIONAL SECTION (9 records) a.ns.nic.cz. 172800 IN A 194.0.12.1 a.ns.nic.cz. 172800 IN AAAA 2001:678:f::1 b.ns.nic.cz. 172800 IN A 194.0.13.1 b.ns.nic.cz. 172800 IN AAAA 2001:678:10::1 c.ns.nic.cz. 172800 IN A 194.0.14.1 c.ns.nic.cz. 172800 IN AAAA 2001:678:11::1 d.ns.nic.cz. 172800 IN A 193.29.206.1 d.ns.nic.cz. 172800 IN AAAA 2001:678:1::1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to i.root-servers.net for cz/DNSKEY
	Received 615 bytes from 192.36.148.17
	;; Answer received from 192.36.148.17 (615 bytes) ;; HEADER SECTION ;; id = 51424 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; cz. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) cz. 172800 IN NS b.ns.nic.cz. cz. 172800 IN NS c.ns.nic.cz. cz. 172800 IN NS d.ns.nic.cz. cz. 172800 IN NS a.ns.nic.cz. cz. 86400 IN DS ( 20237 13 2 cff0f3ecdbc529c1f0031ba1840bfb835853b9209ed1e508fff48451d7b778e2 ) cz. 86400 IN RRSIG ( DS 8 1 86400 20210322050000 20210309040000 42351 . khizBPnL8WAhJb+Y09j6NiCLu5OylpR5Dl7dYn8nvImdFse7GDKlUmI7w9p7gIw+1ymQf5ozsOQ7 3XdV6jMFQMlmB6J2C0t531sIkcffayDip1NuP/vcofkCDBm/R3Hc3PKlQoM+TjgRJ17OblMIasi7 Vp4vrz3XOtyriZ0y6yNI0AMBjXlBm5uzDuyVSUgMka4afq3YVYoLOPhDg85ghGzzK1lHZ1GJ76Ok bL9Dd+8H+qyJlvW9AiXulSpdtXGCf3ATQMSod+aPFdKqZbw+P7xeTuAiUieQFUzZY87Q0uHXLd9j GbzqKYe+dBws9XBwHw7tDInoc6BtmqfzVqeJ8g== ) ;; ADDITIONAL SECTION (9 records) d.ns.nic.cz. 172800 IN A 193.29.206.1 c.ns.nic.cz. 172800 IN A 194.0.14.1 b.ns.nic.cz. 172800 IN A 194.0.13.1 a.ns.nic.cz. 172800 IN A 194.0.12.1 d.ns.nic.cz. 172800 IN AAAA 2001:678:1::1 c.ns.nic.cz. 172800 IN AAAA 2001:678:11::1 b.ns.nic.cz. 172800 IN AAAA 2001:678:10::1 a.ns.nic.cz. 172800 IN AAAA 2001:678:f::1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone cz

	Checking DS between . and cz
	Query to f.root-servers.net for cz/DS
	Received 366 bytes from 192.5.5.241
	;; Answer received from 192.5.5.241 (366 bytes) ;; HEADER SECTION ;; id = 45021 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option: ;; QUESTION SECTION (1 record) ;; cz. IN DS ;; ANSWER SECTION (2 records) cz. 86400 IN DS ( 20237 13 2 cff0f3ecdbc529c1f0031ba1840bfb835853b9209ed1e508fff48451d7b778e2 ) cz. 86400 IN RRSIG ( DS 8 1 86400 20210322050000 20210309040000 42351 . khizBPnL8WAhJb+Y09j6NiCLu5OylpR5Dl7dYn8nvImdFse7GDKlUmI7w9p7gIw+1ymQf5ozsOQ7 3XdV6jMFQMlmB6J2C0t531sIkcffayDip1NuP/vcofkCDBm/R3Hc3PKlQoM+TjgRJ17OblMIasi7 Vp4vrz3XOtyriZ0y6yNI0AMBjXlBm5uzDuyVSUgMka4afq3YVYoLOPhDg85ghGzzK1lHZ1GJ76Ok bL9Dd+8H+qyJlvW9AiXulSpdtXGCf3ATQMSod+aPFdKqZbw+P7xeTuAiUieQFUzZY87Q0uHXLd9j GbzqKYe+dBws9XBwHw7tDInoc6BtmqfzVqeJ8g== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option:
	Found 1 DS records for cz in the . zone
	DS=20237/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`cz. 86400 IN RRSIG ( DS 8 1 86400 20210322050000 20210309040000 42351 . khizBPnL8WAhJb+Y09j6NiCLu5OylpR5Dl7dYn8nvImdFse7GDKlUmI7w9p7gIw+1ymQf5ozsOQ7 3XdV6jMFQMlmB6J2C0t531sIkcffayDip1NuP/vcofkCDBm/R3Hc3PKlQoM+TjgRJ17OblMIasi7 Vp4vrz3XOtyriZ0y6yNI0AMBjXlBm5uzDuyVSUgMka4afq3YVYoLOPhDg85ghGzzK1lHZ1GJ76Ok bL9Dd+8H+qyJlvW9AiXulSpdtXGCf3ATQMSod+aPFdKqZbw+P7xeTuAiUieQFUzZY87Q0uHXLd9j GbzqKYe+dBws9XBwHw7tDInoc6BtmqfzVqeJ8g== )`
	RRSIG=42351 and DNSKEY=42351 verifies the DS RRset
	DS=20237/SHA-256 is now in the chain-of-trust
	`cz. 86400 IN DS ( 20237 13 2 cff0f3ecdbc529c1f0031ba1840bfb835853b9209ed1e508fff48451d7b778e2 )`
	Query to a.ns.nic.cz for cz/DNSKEY
	Received 387 bytes from 194.0.12.1
	;; Answer received from 194.0.12.1 (387 bytes) ;; HEADER SECTION ;; id = 16785 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; cz. IN DNSKEY ;; ANSWER SECTION (4 records) cz. 18000 IN DNSKEY ( 256 3 13 WcjHTMS5U/iD+6j/o5geXcW5PnJ4cJGjbfjjUmDPCdfQIZHpypJefc4gWxD99DoAT2UDYT7FiVNo evYrefJbnA== ) ; Key ID = 12877 cz. 18000 IN DNSKEY ( 257 3 13 nqzH7xP1QU5UOVy/VvxFSlrB/XgX9JDJzj51PzIj35TXjZTyalTlAT/f7PAfaSD5mEG1N8Vk9NmI 2nxgQqhzDQ== ) ; Key ID = 20237 cz. 18000 IN RRSIG ( DNSKEY 13 1 18000 20210312000000 20210226000000 20237 cz. nZh2zEZRw07gJWcULA/bAhVqTO0CbKNELkA8jCE3rA/x2oabzWXX/fP4H0AgmGe7by/7ACgF/Cw2 ZbzBYyEIQg== ) cz. 18000 IN RRSIG ( DNSKEY 13 1 18000 20210322015748 20210309053543 12877 cz. heI2pRV4mSwzVsNxRyi8M+Yz67TCUIcfJVMArKvwB3a84BUpXTY2wsxbkV0OuI03q/wQDQ2VndEZ 00IuLTJqFA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 2 DNSKEY records for cz
	`cz. 18000 IN DNSKEY ( 256 3 13 WcjHTMS5U/iD+6j/o5geXcW5PnJ4cJGjbfjjUmDPCdfQIZHpypJefc4gWxD99DoAT2UDYT7FiVNo evYrefJbnA== ) ; Key ID = 12877`
	`cz. 18000 IN DNSKEY ( 257 3 13 nqzH7xP1QU5UOVy/VvxFSlrB/XgX9JDJzj51PzIj35TXjZTyalTlAT/f7PAfaSD5mEG1N8Vk9NmI 2nxgQqhzDQ== ) ; Key ID = 20237`
	DNSKEY=20237/SEP is now in the chain-of-trust
	DS=20237/SHA-256 verifies DNSKEY=20237/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`cz. 18000 IN RRSIG ( DNSKEY 13 1 18000 20210312000000 20210226000000 20237 cz. nZh2zEZRw07gJWcULA/bAhVqTO0CbKNELkA8jCE3rA/x2oabzWXX/fP4H0AgmGe7by/7ACgF/Cw2 ZbzBYyEIQg== )`
	`cz. 18000 IN RRSIG ( DNSKEY 13 1 18000 20210322015748 20210309053543 12877 cz. heI2pRV4mSwzVsNxRyi8M+Yz67TCUIcfJVMArKvwB3a84BUpXTY2wsxbkV0OuI03q/wQDQ2VndEZ 00IuLTJqFA== )`
	RRSIG=20237 and DNSKEY=20237/SEP verifies the DNSKEY RRset
	RRSIG=12877 and DNSKEY=12877 verifies the DNSKEY RRset
	DNSKEY=12877 is now in the chain-of-trust
	Query to d.ns.nic.cz for nic.cz/A
	Received 153 bytes from 193.29.206.1
	;; Answer received from 193.29.206.1 (153 bytes) ;; HEADER SECTION ;; id = 31580 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; nic.cz. IN A ;; ANSWER SECTION (2 records) nic.cz. 1800 IN A 217.31.205.50 nic.cz. 1800 IN RRSIG ( A 13 2 1800 20210322022515 20210308005515 33044 nic.cz. wmU1daFTlYiWOSRU4YTuxJTaxTPNmBkq2ySOuVCAv91sGS4LwZLQA+lmKP2DQG6YDjcg8cvjcW/S Kyb4okRBnw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	cz is authoritative for nic.cz
	Query to a.ns.nic.cz for nic.cz/DNSKEY
	Received 479 bytes from 194.0.12.1
	;; Answer received from 194.0.12.1 (479 bytes) ;; HEADER SECTION ;; id = 57338 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 5 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; nic.cz. IN DNSKEY ;; ANSWER SECTION (5 records) nic.cz. 1800 IN DNSKEY ( 256 3 13 EX7UibT1nsCUwLCSdJD7iaZI0iF0Lvyfm97e3xGKVIevimocuIlf1EA7m5+imDC58n/XdTvItt4M B/4H0gNJ8Q== ) ; Key ID = 33044 nic.cz. 1800 IN DNSKEY ( 257 3 13 BoTNhqnrZJOGZ+ZltMTWclACH9nWy14yfEOnoykMpDQVoVJpzAap6vJgZ04l+WjI7G3vZmfeH7Gx eZoHSK1edg== ) ; Key ID = 37140 nic.cz. 1800 IN DNSKEY ( 257 3 13 r5594R3W1u38u3RjJcUXT1dEaipKTpXk5jpwprdZygGcuBVLZVohBiFd9fURA+S6YB0Znq4/FcRi a+7PRl6mtA== ) ; Key ID = 4071 nic.cz. 1800 IN RRSIG ( DNSKEY 13 2 1800 20210322162509 20210308145509 37140 nic.cz. G35Ob5gvO6wi+TxXjhHiRJL706fPCLQZd+x+Mn/Hmn9aR2wb83AF7t4JDQ6ciP9k31xuvCRruet5 PPgyAhQTKQ== ) nic.cz. 1800 IN RRSIG ( DNSKEY 13 2 1800 20210322175509 20210308162509 4071 nic.cz. 9p8ZRd+4+io8CfGQzmyWUAeY8mZqrwQ4QEgFTr5L2votY1x0qvFRNU2egWG5d8Q/Hne4tMAPeKEv b4KIkPvZMA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found child zone nic.cz
	Attempting to learn nameservers for nic.cz
	Query to a.ns.nic.cz for nic.cz/NS
	Received 932 bytes from 194.0.12.1
	;; Answer received from 194.0.12.1 (932 bytes) ;; HEADER SECTION ;; id = 11762 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 13 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; nic.cz. IN NS ;; ANSWER SECTION (4 records) nic.cz. 1800 IN NS a.ns.nic.cz. nic.cz. 1800 IN NS b.ns.nic.cz. nic.cz. 1800 IN NS d.ns.nic.cz. nic.cz. 1800 IN RRSIG ( NS 13 2 1800 20210322022515 20210308005515 33044 nic.cz. mTmCAnGw9YUHtY4fUaymd43HHr2sqcm9O1Dv/lrhp3Tj7x356Sj/8jAsMBEYWlCH7rieHRVEQh1o OfS4/fEGYA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (13 records) a.ns.nic.cz. 1800 IN A 194.0.12.1 a.ns.nic.cz. 1800 IN AAAA 2001:678:f::1 b.ns.nic.cz. 1800 IN A 194.0.13.1 b.ns.nic.cz. 1800 IN AAAA 2001:678:10::1 d.ns.nic.cz. 1800 IN A 193.29.206.1 d.ns.nic.cz. 1800 IN AAAA 2001:678:1::1 a.ns.nic.cz. 1800 IN RRSIG ( A 13 4 1800 20210322022515 20210308005515 33044 nic.cz. FuJFlfs/a/+fl1Q9QUzMsUV0nDu9H+XAjdWuk1Gpeh3yoXmX0zaa5qwHden4zYECk7+V0iRBYsCM jMdRwwRvPw== ) a.ns.nic.cz. 1800 IN RRSIG ( AAAA 13 4 1800 20210322022515 20210308005515 33044 nic.cz. dgdy2PUG+mcZcEYPpMem1ERSaRXUqKj5RFXBaF2v7dY/otImj18sCpeTiS7A836a0I3QAWfAR9K9 Lnd8DLbYgw== ) b.ns.nic.cz. 1800 IN RRSIG ( A 13 4 1800 20210322022515 20210308005515 33044 nic.cz. Swtj7kXB1WGRX5PZyZ17xmxH9C0GF3oPQfVD76Q25T8K0zauvBCIpgeYI+2nx1tItkV4JNW5ZBl3 cV37jxqREg== ) b.ns.nic.cz. 1800 IN RRSIG ( AAAA 13 4 1800 20210322022515 20210308005515 33044 nic.cz. 4RUA5XMe34USyVIv2pn+o5pSIh8kTM1N7Ft3o93Wk+Y2eGk3uSLAZZQmAKlYffgPis6Z7uM4kCWC HmI55lX/bA== ) d.ns.nic.cz. 1800 IN RRSIG ( A 13 4 1800 20210322022515 20210308005515 33044 nic.cz. yr4lAnOKoMSIVe4yo/CeKYk2aMOFuRBwpjUoayxntIYpVqWKMt99+4esdJnybg7L5zeGQ9XLSeEe /zLHCNDSeA== ) d.ns.nic.cz. 1800 IN RRSIG ( AAAA 13 4 1800 20210322022515 20210308005515 33044 nic.cz. 5/6AFgPyu6KgBiAhhe1bKxxMYgHLNEBbrtX8pwAO79edNbekNtXKFDxTMhQECKD5IAUZG5I+cffp BcuSq+cRPg== ) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found nic.cz nameservers: a.ns.nic.cz, b.ns.nic.cz, d.ns.nic.cz

nic.cz

	Checking DS between cz and nic.cz
	Query to a.ns.nic.cz for nic.cz/DS
	Received 181 bytes from 194.0.12.1
	;; Answer received from 194.0.12.1 (181 bytes) ;; HEADER SECTION ;; id = 62663 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; nic.cz. IN DS ;; ANSWER SECTION (2 records) nic.cz. 3600 IN DS ( 37140 13 2 ad7665958a1b876e6a05a02189ddcb1ec15941434d03db326baa45211f050657 ) nic.cz. 3600 IN RRSIG ( DS 13 2 3600 20210322031031 20210308113543 12877 cz. dGLjQMd1v2ywGd4QmaXg0lbzPE+zhV0HzmEi/dB5Pv9FRFA9P3g4s4DeI5kargk/nBWzuRz+kool QaGPV7Q3tA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 1 DS records for nic.cz in the cz zone
	DS=37140/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`nic.cz. 3600 IN RRSIG ( DS 13 2 3600 20210322031031 20210308113543 12877 cz. dGLjQMd1v2ywGd4QmaXg0lbzPE+zhV0HzmEi/dB5Pv9FRFA9P3g4s4DeI5kargk/nBWzuRz+kool QaGPV7Q3tA== )`
	RRSIG=12877 and DNSKEY=12877 verifies the DS RRset
	DS=37140/SHA-256 is now in the chain-of-trust
	`nic.cz. 3600 IN DS ( 37140 13 2 ad7665958a1b876e6a05a02189ddcb1ec15941434d03db326baa45211f050657 )`
	Query to d.ns.nic.cz for nic.cz/DNSKEY
	Received 479 bytes from 193.29.206.1
	;; Answer received from 193.29.206.1 (479 bytes) ;; HEADER SECTION ;; id = 20634 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 5 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; nic.cz. IN DNSKEY ;; ANSWER SECTION (5 records) nic.cz. 1800 IN DNSKEY ( 256 3 13 EX7UibT1nsCUwLCSdJD7iaZI0iF0Lvyfm97e3xGKVIevimocuIlf1EA7m5+imDC58n/XdTvItt4M B/4H0gNJ8Q== ) ; Key ID = 33044 nic.cz. 1800 IN DNSKEY ( 257 3 13 BoTNhqnrZJOGZ+ZltMTWclACH9nWy14yfEOnoykMpDQVoVJpzAap6vJgZ04l+WjI7G3vZmfeH7Gx eZoHSK1edg== ) ; Key ID = 37140 nic.cz. 1800 IN DNSKEY ( 257 3 13 r5594R3W1u38u3RjJcUXT1dEaipKTpXk5jpwprdZygGcuBVLZVohBiFd9fURA+S6YB0Znq4/FcRi a+7PRl6mtA== ) ; Key ID = 4071 nic.cz. 1800 IN RRSIG ( DNSKEY 13 2 1800 20210322162509 20210308145509 37140 nic.cz. G35Ob5gvO6wi+TxXjhHiRJL706fPCLQZd+x+Mn/Hmn9aR2wb83AF7t4JDQ6ciP9k31xuvCRruet5 PPgyAhQTKQ== ) nic.cz. 1800 IN RRSIG ( DNSKEY 13 2 1800 20210322175509 20210308162509 4071 nic.cz. 9p8ZRd+4+io8CfGQzmyWUAeY8mZqrwQ4QEgFTr5L2votY1x0qvFRNU2egWG5d8Q/Hne4tMAPeKEv b4KIkPvZMA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 3 DNSKEY records for nic.cz
	`nic.cz. 1800 IN DNSKEY ( 256 3 13 EX7UibT1nsCUwLCSdJD7iaZI0iF0Lvyfm97e3xGKVIevimocuIlf1EA7m5+imDC58n/XdTvItt4M B/4H0gNJ8Q== ) ; Key ID = 33044`
	`nic.cz. 1800 IN DNSKEY ( 257 3 13 BoTNhqnrZJOGZ+ZltMTWclACH9nWy14yfEOnoykMpDQVoVJpzAap6vJgZ04l+WjI7G3vZmfeH7Gx eZoHSK1edg== ) ; Key ID = 37140`
	`nic.cz. 1800 IN DNSKEY ( 257 3 13 r5594R3W1u38u3RjJcUXT1dEaipKTpXk5jpwprdZygGcuBVLZVohBiFd9fURA+S6YB0Znq4/FcRi a+7PRl6mtA== ) ; Key ID = 4071`
	DNSKEY=37140/SEP is now in the chain-of-trust
	DS=37140/SHA-256 verifies DNSKEY=37140/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`nic.cz. 1800 IN RRSIG ( DNSKEY 13 2 1800 20210322162509 20210308145509 37140 nic.cz. G35Ob5gvO6wi+TxXjhHiRJL706fPCLQZd+x+Mn/Hmn9aR2wb83AF7t4JDQ6ciP9k31xuvCRruet5 PPgyAhQTKQ== )`
	`nic.cz. 1800 IN RRSIG ( DNSKEY 13 2 1800 20210322175509 20210308162509 4071 nic.cz. 9p8ZRd+4+io8CfGQzmyWUAeY8mZqrwQ4QEgFTr5L2votY1x0qvFRNU2egWG5d8Q/Hne4tMAPeKEv b4KIkPvZMA== )`
	RRSIG=37140 and DNSKEY=37140/SEP verifies the DNSKEY RRset
	RRSIG=4071 and DNSKEY=4071/SEP verifies the DNSKEY RRset
	DNSKEY=33044 is now in the chain-of-trust
	DNSKEY=4071/SEP is now in the chain-of-trust
	Query to d.ns.nic.cz for nic.cz/A
	Received 153 bytes from 193.29.206.1
	;; Answer received from 193.29.206.1 (153 bytes) ;; HEADER SECTION ;; id = 59897 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; nic.cz. IN A ;; ANSWER SECTION (2 records) nic.cz. 1800 IN A 217.31.205.50 nic.cz. 1800 IN RRSIG ( A 13 2 1800 20210322022515 20210308005515 33044 nic.cz. wmU1daFTlYiWOSRU4YTuxJTaxTPNmBkq2ySOuVCAv91sGS4LwZLQA+lmKP2DQG6YDjcg8cvjcW/S Kyb4okRBnw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	nic.cz is authoritative for nic.cz
	Found RRSIG signed by nic.cz zone
	Query to b.ns.nic.cz for nic.cz/SOA
	Received 1081 bytes from 194.0.13.1
	;; Answer received from 194.0.13.1 (1081 bytes) ;; HEADER SECTION ;; id = 18710 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 4 arcount = 13 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; nic.cz. IN SOA ;; ANSWER SECTION (2 records) nic.cz. 1800 IN SOA ( a.ns.nic.cz. hostmaster.nic.cz. 1615274283 ;serial 10800 ;refresh 3600 ;retry 1209600 ;expire 7200 ;minimum ) nic.cz. 1800 IN RRSIG ( SOA 13 2 1800 20210323071803 20210309054803 33044 nic.cz. zB+UZANZZwvc16BH9SlaixbTHHtr65qMYxNdTzTrkcT+I1mBtcT1/3PnwqSNqc8GKGa5/NMiBu4W 2+/BIFEs6w== ) ;; AUTHORITY SECTION (4 records) nic.cz. 1800 IN NS b.ns.nic.cz. nic.cz. 1800 IN NS d.ns.nic.cz. nic.cz. 1800 IN NS a.ns.nic.cz. nic.cz. 1800 IN RRSIG ( NS 13 2 1800 20210322022515 20210308005515 33044 nic.cz. mTmCAnGw9YUHtY4fUaymd43HHr2sqcm9O1Dv/lrhp3Tj7x356Sj/8jAsMBEYWlCH7rieHRVEQh1o OfS4/fEGYA== ) ;; ADDITIONAL SECTION (13 records) a.ns.nic.cz. 1800 IN A 194.0.12.1 a.ns.nic.cz. 1800 IN AAAA 2001:678:f::1 b.ns.nic.cz. 1800 IN A 194.0.13.1 b.ns.nic.cz. 1800 IN AAAA 2001:678:10::1 d.ns.nic.cz. 1800 IN A 193.29.206.1 d.ns.nic.cz. 1800 IN AAAA 2001:678:1::1 a.ns.nic.cz. 1800 IN RRSIG ( A 13 4 1800 20210322022515 20210308005515 33044 nic.cz. FuJFlfs/a/+fl1Q9QUzMsUV0nDu9H+XAjdWuk1Gpeh3yoXmX0zaa5qwHden4zYECk7+V0iRBYsCM jMdRwwRvPw== ) a.ns.nic.cz. 1800 IN RRSIG ( AAAA 13 4 1800 20210322022515 20210308005515 33044 nic.cz. dgdy2PUG+mcZcEYPpMem1ERSaRXUqKj5RFXBaF2v7dY/otImj18sCpeTiS7A836a0I3QAWfAR9K9 Lnd8DLbYgw== ) b.ns.nic.cz. 1800 IN RRSIG ( A 13 4 1800 20210322022515 20210308005515 33044 nic.cz. Swtj7kXB1WGRX5PZyZ17xmxH9C0GF3oPQfVD76Q25T8K0zauvBCIpgeYI+2nx1tItkV4JNW5ZBl3 cV37jxqREg== ) b.ns.nic.cz. 1800 IN RRSIG ( AAAA 13 4 1800 20210322022515 20210308005515 33044 nic.cz. 4RUA5XMe34USyVIv2pn+o5pSIh8kTM1N7Ft3o93Wk+Y2eGk3uSLAZZQmAKlYffgPis6Z7uM4kCWC HmI55lX/bA== ) d.ns.nic.cz. 1800 IN RRSIG ( A 13 4 1800 20210322022515 20210308005515 33044 nic.cz. yr4lAnOKoMSIVe4yo/CeKYk2aMOFuRBwpjUoayxntIYpVqWKMt99+4esdJnybg7L5zeGQ9XLSeEe /zLHCNDSeA== ) d.ns.nic.cz. 1800 IN RRSIG ( AAAA 13 4 1800 20210322022515 20210308005515 33044 nic.cz. 5/6AFgPyu6KgBiAhhe1bKxxMYgHLNEBbrtX8pwAO79edNbekNtXKFDxTMhQECKD5IAUZG5I+cffp BcuSq+cRPg== ) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to d.ns.nic.cz for nic.cz/SOA
	Received 189 bytes from 193.29.206.1
	;; Answer received from 193.29.206.1 (189 bytes) ;; HEADER SECTION ;; id = 11710 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; nic.cz. IN SOA ;; ANSWER SECTION (2 records) nic.cz. 1800 IN SOA ( a.ns.nic.cz. hostmaster.nic.cz. 1615274283 ;serial 10800 ;refresh 3600 ;retry 1209600 ;expire 7200 ;minimum ) nic.cz. 1800 IN RRSIG ( SOA 13 2 1800 20210323071803 20210309054803 33044 nic.cz. zB+UZANZZwvc16BH9SlaixbTHHtr65qMYxNdTzTrkcT+I1mBtcT1/3PnwqSNqc8GKGa5/NMiBu4W 2+/BIFEs6w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to a.ns.nic.cz for nic.cz/SOA
	Received 189 bytes from 194.0.12.1
	;; Answer received from 194.0.12.1 (189 bytes) ;; HEADER SECTION ;; id = 25759 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; nic.cz. IN SOA ;; ANSWER SECTION (2 records) nic.cz. 1800 IN SOA ( a.ns.nic.cz. hostmaster.nic.cz. 1615274283 ;serial 10800 ;refresh 3600 ;retry 1209600 ;expire 7200 ;minimum ) nic.cz. 1800 IN RRSIG ( SOA 13 2 1800 20210323071803 20210309054803 33044 nic.cz. zB+UZANZZwvc16BH9SlaixbTHHtr65qMYxNdTzTrkcT+I1mBtcT1/3PnwqSNqc8GKGa5/NMiBu4W 2+/BIFEs6w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to d.ns.nic.cz for nic.cz/A
	Received 153 bytes from 193.29.206.1
	;; Answer received from 193.29.206.1 (153 bytes) ;; HEADER SECTION ;; id = 1633 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; nic.cz. IN A ;; ANSWER SECTION (2 records) nic.cz. 1800 IN A 217.31.205.50 nic.cz. 1800 IN RRSIG ( A 13 2 1800 20210322022515 20210308005515 33044 nic.cz. wmU1daFTlYiWOSRU4YTuxJTaxTPNmBkq2ySOuVCAv91sGS4LwZLQA+lmKP2DQG6YDjcg8cvjcW/S Kyb4okRBnw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	nic.cz A RR has value 217.31.205.50
	Found 1 RRSIGs over A RRset
	`nic.cz. 1800 IN RRSIG ( A 13 2 1800 20210322022515 20210308005515 33044 nic.cz. wmU1daFTlYiWOSRU4YTuxJTaxTPNmBkq2ySOuVCAv91sGS4LwZLQA+lmKP2DQG6YDjcg8cvjcW/S Kyb4okRBnw== )`
	RRSIG=33044 and DNSKEY=33044 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test nic.cz at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: