DNSSEC Debugger

Back to Verisign Labs Tools

Domain Name:

Detail: more(+) / less(-)

Time: 2026-10-15 08:44:25 UTC

Analyzing DNSSEC problems for nic.li

DS=20326/SHA-256 is now in the chain-of-trust

DS=38696/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	`. IN DS ( 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 )`
	Query to i.root-servers.net for ./DNSKEY
	Received 1139 bytes from 192.36.148.17
	;; Response received from [192.36.148.17] 1139 octets ;; HEADER SECTION ;; id = 27967 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAcorNxNc9t0ue1ZenPjVMRujlQ2YLBJ0pR/4XMjHby9vr03cRxFSKnWpxeg5PL384D9VeqdS 1bjrGyTsHtoagzI3NiXFd8sjHMOnZxu5pp/+UBIg7tasYgVMMdUiM1Yu/c+t30d1Qw/v6NYLNnOn ywTu6HuUh7Y1sZRq/GZcrxLENXHQoyKpOrOr8R3+qd6wK69IKB80ZBZtkX9rdEqKJk+yYXjEZzZ0 zkAFthmNgCreAoU9PVlU66dyOsaLjf3wKUlUm9SNOKs+tK6LuSmRbK6+1T/tPaRaMBSEuv2G6vXf nJ1uyMbGvtpRn/YDcvTjrp6DzE6XyF44QdwJ3oKx4ek= ) ; keytag 8763 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20261101000000 20261011000000 38696 . llXxlp+gWc4h/F9G8UPj3VXhNDQoZrco3Piivk7YMKS7pi8B+CBQHHPO/QNw+VfpNq7CtBDA6gxu cyia1ZZx8yM0oLve7qJKgPuRVNnw5AOegtdxy+NKSy8rT6XNtCdM2gL9EmqKux+/JNATbZG2efGk VpHuirkq0Vs1bvYglVl6fvHbqoHpfjbnHVheuKpq+HvdsZOphoEJu74Y4lpYNBNTJijGgajnJ64A UMPbMfu76uLi68CcWKDGWhzCNeSwnSjK7CA6aKte5StW61Nuz0Nv8mvzqMX0epPQ7lXJ9Yc/6850 81BdzAYK3yMAfTOqL4EgluNZQAtAAh9bseJVyw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAcorNxNc9t0ue1ZenPjVMRujlQ2YLBJ0pR/4XMjHby9vr03cRxFSKnWpxeg5PL384D9VeqdS 1bjrGyTsHtoagzI3NiXFd8sjHMOnZxu5pp/+UBIg7tasYgVMMdUiM1Yu/c+t30d1Qw/v6NYLNnOn ywTu6HuUh7Y1sZRq/GZcrxLENXHQoyKpOrOr8R3+qd6wK69IKB80ZBZtkX9rdEqKJk+yYXjEZzZ0 zkAFthmNgCreAoU9PVlU66dyOsaLjf3wKUlUm9SNOKs+tK6LuSmRbK6+1T/tPaRaMBSEuv2G6vXf nJ1uyMbGvtpRn/YDcvTjrp6DzE6XyF44QdwJ3oKx4ek= ) ; keytag 8763`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	DNSKEY=38696/SEP is now in the chain-of-trust
	DS=38696/SHA-256 verifies DNSKEY=38696/SEP
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20261101000000 20261011000000 38696 . llXxlp+gWc4h/F9G8UPj3VXhNDQoZrco3Piivk7YMKS7pi8B+CBQHHPO/QNw+VfpNq7CtBDA6gxu cyia1ZZx8yM0oLve7qJKgPuRVNnw5AOegtdxy+NKSy8rT6XNtCdM2gL9EmqKux+/JNATbZG2efGk VpHuirkq0Vs1bvYglVl6fvHbqoHpfjbnHVheuKpq+HvdsZOphoEJu74Y4lpYNBNTJijGgajnJ64A UMPbMfu76uLi68CcWKDGWhzCNeSwnSjK7CA6aKte5StW61Nuz0Nv8mvzqMX0epPQ7lXJ9Yc/6850 81BdzAYK3yMAfTOqL4EgluNZQAtAAh9bseJVyw== )`
	RRSIG=38696 and DNSKEY=38696/SEP verifies the DNSKEY RRset
	DNSKEY=8763 is now in the chain-of-trust
	Query to i.root-servers.net for nic.li/A
	Received 670 bytes from 192.36.148.17
	;; Response received from [192.36.148.17] 670 octets ;; HEADER SECTION ;; id = 47568 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 11 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nic.li. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) li. 172800 IN NS a.nic.li. li. 172800 IN NS b.nic.li. li. 172800 IN NS d.nic.li. li. 172800 IN NS e.nic.li. li. 172800 IN NS f.nic.li. li. 86400 IN DS ( 22695 13 2 798ef08ce942abacfa9a8db7b70f2a6f5a4c19c709e4d16c676bb8a5fdc9e2dd ) li. 86400 IN RRSIG ( DS 8 1 86400 20261028050000 20261015040000 8763 . X+uDBn+HaHsV39kHZhn/zogj/c50MAO04rgM8unguf3GwVOnx6PxjTWnHec61JASPW8SL/HhETvE vCO2w/Bnvvvx/4yfB4J6jXhWygXaZ2FOAaBdIi6XxwRwb53nInWbHH4yyf3CRRaivDj/87TtbE3z yfGyQg+oeQXCmzlUJwk0Gtj8d1AG86A2kkAH+m4yrtq6zxdriMvd0A6D1Yb3MCCsPfk3ln6T6IA1 gUyGdKcEed4NPmYBZfFHFTiTGVc9VJof2Dm1UN2EsD3xuwF/4i3KZGwHqrqdF4YCeLnfQCG21emK RCc+ZizFt6xZ5TT4sFUblVZNkY3v3tjXVrqBmw== ) ;; ADDITIONAL SECTION (11 records) a.nic.li. 172800 IN A 130.59.31.42 b.nic.li. 172800 IN A 130.59.31.44 d.nic.li. 172800 IN A 194.0.25.40 e.nic.li. 172800 IN A 194.0.17.1 f.nic.li. 172800 IN A 194.146.106.14 a.nic.li. 172800 IN AAAA 2001:620:0:ff::57 b.nic.li. 172800 IN AAAA 2001:620:0:ff::59 d.nic.li. 172800 IN AAAA 2001:678:20::40 e.nic.li. 172800 IN AAAA 2001:678:3::1 f.nic.li. 172800 IN AAAA 2001:67c:1010:3::53 ;; { "EDNS-VERSION": 0 }
	Query to a.root-servers.net for li/DNSKEY
	Received 670 bytes from 198.41.0.4
	;; Response received from [198.41.0.4] 670 octets ;; HEADER SECTION ;; id = 16842 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 11 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; li. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) li. 172800 IN NS a.nic.li. li. 172800 IN NS d.nic.li. li. 172800 IN NS f.nic.li. li. 172800 IN NS b.nic.li. li. 172800 IN NS e.nic.li. li. 86400 IN DS ( 22695 13 2 798ef08ce942abacfa9a8db7b70f2a6f5a4c19c709e4d16c676bb8a5fdc9e2dd ) li. 86400 IN RRSIG ( DS 8 1 86400 20261028050000 20261015040000 8763 . X+uDBn+HaHsV39kHZhn/zogj/c50MAO04rgM8unguf3GwVOnx6PxjTWnHec61JASPW8SL/HhETvE vCO2w/Bnvvvx/4yfB4J6jXhWygXaZ2FOAaBdIi6XxwRwb53nInWbHH4yyf3CRRaivDj/87TtbE3z yfGyQg+oeQXCmzlUJwk0Gtj8d1AG86A2kkAH+m4yrtq6zxdriMvd0A6D1Yb3MCCsPfk3ln6T6IA1 gUyGdKcEed4NPmYBZfFHFTiTGVc9VJof2Dm1UN2EsD3xuwF/4i3KZGwHqrqdF4YCeLnfQCG21emK RCc+ZizFt6xZ5TT4sFUblVZNkY3v3tjXVrqBmw== ) ;; ADDITIONAL SECTION (11 records) a.nic.li. 172800 IN A 130.59.31.42 a.nic.li. 172800 IN AAAA 2001:620:0:ff::57 d.nic.li. 172800 IN A 194.0.25.40 d.nic.li. 172800 IN AAAA 2001:678:20::40 f.nic.li. 172800 IN A 194.146.106.14 f.nic.li. 172800 IN AAAA 2001:67c:1010:3::53 b.nic.li. 172800 IN A 130.59.31.44 b.nic.li. 172800 IN AAAA 2001:620:0:ff::59 e.nic.li. 172800 IN A 194.0.17.1 e.nic.li. 172800 IN AAAA 2001:678:3::1 ;; { "EDNS-VERSION": 0 }
	Found child zone li

	Checking DS between . and li
	Query to e.root-servers.net for li/DS
	Received 366 bytes from 192.203.230.10
	;; Response received from [192.203.230.10] 366 octets ;; HEADER SECTION ;; id = 42020 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; li. IN DS ;; ANSWER SECTION (2 records) li. 86400 IN DS ( 22695 13 2 798ef08ce942abacfa9a8db7b70f2a6f5a4c19c709e4d16c676bb8a5fdc9e2dd ) li. 86400 IN RRSIG ( DS 8 1 86400 20261028050000 20261015040000 8763 . X+uDBn+HaHsV39kHZhn/zogj/c50MAO04rgM8unguf3GwVOnx6PxjTWnHec61JASPW8SL/HhETvE vCO2w/Bnvvvx/4yfB4J6jXhWygXaZ2FOAaBdIi6XxwRwb53nInWbHH4yyf3CRRaivDj/87TtbE3z yfGyQg+oeQXCmzlUJwk0Gtj8d1AG86A2kkAH+m4yrtq6zxdriMvd0A6D1Yb3MCCsPfk3ln6T6IA1 gUyGdKcEed4NPmYBZfFHFTiTGVc9VJof2Dm1UN2EsD3xuwF/4i3KZGwHqrqdF4YCeLnfQCG21emK RCc+ZizFt6xZ5TT4sFUblVZNkY3v3tjXVrqBmw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for li in the . zone
	DS=22695/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`li. 86400 IN RRSIG ( DS 8 1 86400 20261028050000 20261015040000 8763 . X+uDBn+HaHsV39kHZhn/zogj/c50MAO04rgM8unguf3GwVOnx6PxjTWnHec61JASPW8SL/HhETvE vCO2w/Bnvvvx/4yfB4J6jXhWygXaZ2FOAaBdIi6XxwRwb53nInWbHH4yyf3CRRaivDj/87TtbE3z yfGyQg+oeQXCmzlUJwk0Gtj8d1AG86A2kkAH+m4yrtq6zxdriMvd0A6D1Yb3MCCsPfk3ln6T6IA1 gUyGdKcEed4NPmYBZfFHFTiTGVc9VJof2Dm1UN2EsD3xuwF/4i3KZGwHqrqdF4YCeLnfQCG21emK RCc+ZizFt6xZ5TT4sFUblVZNkY3v3tjXVrqBmw== )`
	RRSIG=8763 and DNSKEY=8763 verifies the DS RRset
	DS=22695/SHA-256 is now in the chain-of-trust
	`li. 86400 IN DS ( 22695 13 2 798ef08ce942abacfa9a8db7b70f2a6f5a4c19c709e4d16c676bb8a5fdc9e2dd )`
	Query to f.nic.li for li/DNSKEY
	Received 369 bytes from 194.146.106.14
	;; Response received from [194.146.106.14] 369 octets ;; HEADER SECTION ;; id = 64392 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; li. IN DNSKEY ;; ANSWER SECTION (4 records) li. 86400 IN DNSKEY ( 256 3 13 4LrXD4jsE9Du77kE+X80rGW3ANk15lYjVq60SxB4NaFGOrwAhZZNBKOo38/IArUHcilZ9Zslj3Yi WrCzIjg2fg== ) ; keytag 27194 li. 86400 IN DNSKEY ( 257 3 13 rXfcrHOvlfACg2AAl4qFGklrWLhZYJJNdlll6O0sJNPuphE321iVos+0lsnisqJYp6XALmPA72SE GlQjuf4b/w== ) ; keytag 22695 li. 86400 IN DNSKEY ( 256 3 13 3V/LCKU+OvjBIMintfYfFVdYcYg1uUibU4flMZ2deeU8Or0orRdpQUlHr5//ObNJPtB8JICT7GK4 JrtM0Y+z3w== ) ; keytag 24295 li. 86400 IN RRSIG ( DNSKEY 13 1 86400 20261125100909 20261010090909 22695 li. pi3th7aaYx2TmIwfuTI1a38jk4gi/FAklOgk7UGr6W+FuedaYMXlpzX0JNtTTQxi7FYiqkSFpg7l I5m2JgcISQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for li
	`li. 86400 IN DNSKEY ( 256 3 13 4LrXD4jsE9Du77kE+X80rGW3ANk15lYjVq60SxB4NaFGOrwAhZZNBKOo38/IArUHcilZ9Zslj3Yi WrCzIjg2fg== ) ; keytag 27194`
	`li. 86400 IN DNSKEY ( 257 3 13 rXfcrHOvlfACg2AAl4qFGklrWLhZYJJNdlll6O0sJNPuphE321iVos+0lsnisqJYp6XALmPA72SE GlQjuf4b/w== ) ; keytag 22695`
	`li. 86400 IN DNSKEY ( 256 3 13 3V/LCKU+OvjBIMintfYfFVdYcYg1uUibU4flMZ2deeU8Or0orRdpQUlHr5//ObNJPtB8JICT7GK4 JrtM0Y+z3w== ) ; keytag 24295`
	DNSKEY=22695/SEP is now in the chain-of-trust
	DS=22695/SHA-256 verifies DNSKEY=22695/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`li. 86400 IN RRSIG ( DNSKEY 13 1 86400 20261125100909 20261010090909 22695 li. pi3th7aaYx2TmIwfuTI1a38jk4gi/FAklOgk7UGr6W+FuedaYMXlpzX0JNtTTQxi7FYiqkSFpg7l I5m2JgcISQ== )`
	RRSIG=22695 and DNSKEY=22695/SEP verifies the DNSKEY RRset
	DNSKEY=27194 is now in the chain-of-trust
	DNSKEY=24295 is now in the chain-of-trust
	Query to f.nic.li for nic.li/A
	Received 149 bytes from 194.146.106.14
	;; Response received from [194.146.106.14] 149 octets ;; HEADER SECTION ;; id = 28744 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nic.li. IN A ;; ANSWER SECTION (2 records) nic.li. 3600 IN A 130.59.31.80 nic.li. 3600 IN RRSIG ( A 13 2 3600 20261109194843 20261010190008 27194 li. 3V2dIIw6nZ8vOKK1iMmS7Y/tXeKYB2Oe2t8eafA8bxtTdG05M9aAt7zyfYEQaILoRHpFpvTkMr4r EZ0fVcWrXA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	f.nic.li is authoritative for nic.li
	Query to a.nic.li for nic.li/DNSKEY
	Received 330 bytes from 130.59.31.42
	;; Response received from [130.59.31.42] 330 octets ;; HEADER SECTION ;; id = 48350 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nic.li. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) li. 900 IN SOA ( a.nic.li. dns-operation.switch.ch. 2026101521 ;serial 900 ;refresh 600 ;retry 1209600 ;expire 900 ;minimum ) li. 900 IN RRSIG ( SOA 13 1 900 20261114073258 20261015073008 27194 li. +fZWglBnkaGbP1CvfuIDZkMaZWslDWYBRW516h+oyVYMIXFbmzZJEBUr7TT0rtPfpJCn1Cy9dWZh iXGiP6likg== ) nic.li. 900 IN NSEC _dmarc.nic.li. A MX TXT AAAA RRSIG NSEC CAA nic.li. 900 IN RRSIG ( NSEC 13 2 900 20261103125005 20261004120007 27194 li. HfaXCh5MnUf6QftPp4BN28dO15dKbHOFc0DwU/64V2hCDsA+EgUWn2cibNemiyp07MoL/3YDtYpQ QUkytxMwLQ== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found RRSIG signed by li zone
	Query to e.nic.li for li/SOA
	Received 1180 bytes from 194.0.17.1
	;; Response received from [194.0.17.1] 1180 octets ;; HEADER SECTION ;; id = 26193 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 6 arcount = 17 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; li. IN SOA ;; ANSWER SECTION (2 records) li. 900 IN SOA ( a.nic.li. dns-operation.switch.ch. 2026101521 ;serial 900 ;refresh 600 ;retry 1209600 ;expire 900 ;minimum ) li. 900 IN RRSIG ( SOA 13 1 900 20261114073258 20261015073008 27194 li. +fZWglBnkaGbP1CvfuIDZkMaZWslDWYBRW516h+oyVYMIXFbmzZJEBUr7TT0rtPfpJCn1Cy9dWZh iXGiP6likg== ) ;; AUTHORITY SECTION (6 records) li. 86400 IN NS a.nic.li. li. 86400 IN NS d.nic.li. li. 86400 IN NS b.nic.li. li. 86400 IN NS f.nic.li. li. 86400 IN NS e.nic.li. li. 86400 IN RRSIG ( NS 13 1 86400 20261110171253 20261011163007 27194 li. +gYoZ2o5a5aBlU1QQrrYplYENiO00gG10HQ9o9mB8/XOm3yQd9gYMgAocAOOQqKMvBIZVES8b5PO aAxu4/FPzg== ) ;; ADDITIONAL SECTION (17 records) a.nic.li. 86400 IN A 130.59.31.42 b.nic.li. 86400 IN A 130.59.31.44 d.nic.li. 86400 IN A 194.0.25.40 e.nic.li. 86400 IN A 194.0.17.1 f.nic.li. 86400 IN A 194.146.106.14 a.nic.li. 86400 IN AAAA 2001:620:0:ff::57 b.nic.li. 86400 IN AAAA 2001:620:0:ff::59 d.nic.li. 86400 IN AAAA 2001:678:20::40 e.nic.li. 86400 IN AAAA 2001:678:3::1 f.nic.li. 86400 IN AAAA 2001:67c:1010:3::53 a.nic.li. 86400 IN RRSIG ( A 13 3 86400 20261103142550 20261004133006 27194 li. 84rLpYWyrzJx+Oodnqgu/IZgoZsTT6hzJB8h5im7q3BficRzo6qvlqOKRWvnkjP9hLkUUG79blaA hoW5D0rDGw== ) a.nic.li. 86400 IN RRSIG ( AAAA 13 3 86400 20261103002046 20261004093007 27194 li. M4et3brghxaY7ajUDRw0XLmqTuIJy1Hh0vTzP7fvV8aR5UV8FPwbUtNCPpHT3+7nltF5nXhf+Hf7 oj9oaRISAw== ) b.nic.li. 86400 IN RRSIG ( A 13 3 86400 20261109133035 20261010130007 27194 li. gsUbYwcRGP7aHnfVxbLEnsf0U6yXiRRo/ml7r5VddI5S2BATU3wXMHZD00Fq94AoMUIfQDA14nxS S30DBeXv7g== ) b.nic.li. 86400 IN RRSIG ( AAAA 13 3 86400 20261105215204 20261006213008 27194 li. V+tkJw/g/ndmjSuIe/Lv3yd25/GSp0G7AWEawQrW0f9tY8BmXPpO0M6FuvvU7VwE/4hRS7AzTvwj WDBuXL4jAA== ) d.nic.li. 86400 IN RRSIG ( A 13 3 86400 20261106120622 20261007113007 27194 li. EAYBRKVLtcdJUt9H/FMyWYv8BC4fC7t7LFa5hU/7q3Srs71t51g+WPtoRQwz0JtsXrzg9GxOcYuX HQEy7cUS6Q== ) d.nic.li. 86400 IN RRSIG ( AAAA 13 3 86400 20261110061334 20261011060008 27194 li. jTboeDvEVN4+RTmglycWjxUrClXoOpB2GFbGal7Paaf1UNll0cjB4CTsdt9mJgVryYtsaKzHUvkN W1hVu1enTg== ) ;; { "EDNS-VERSION": 0 }
	Query to d.nic.li for li/SOA
	Received 194 bytes from 194.0.25.40
	;; Response received from [194.0.25.40] 194 octets ;; HEADER SECTION ;; id = 38621 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1400, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; li. IN SOA ;; ANSWER SECTION (2 records) li. 900 IN SOA ( a.nic.li. dns-operation.switch.ch. 2026101521 ;serial 900 ;refresh 600 ;retry 1209600 ;expire 900 ;minimum ) li. 900 IN RRSIG ( SOA 13 1 900 20261114073258 20261015073008 27194 li. +fZWglBnkaGbP1CvfuIDZkMaZWslDWYBRW516h+oyVYMIXFbmzZJEBUr7TT0rtPfpJCn1Cy9dWZh iXGiP6likg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to b.nic.li for li/SOA
	Received 194 bytes from 130.59.31.44
	;; Response received from [130.59.31.44] 194 octets ;; HEADER SECTION ;; id = 62376 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; li. IN SOA ;; ANSWER SECTION (2 records) li. 900 IN SOA ( a.nic.li. dns-operation.switch.ch. 2026101521 ;serial 900 ;refresh 600 ;retry 1209600 ;expire 900 ;minimum ) li. 900 IN RRSIG ( SOA 13 1 900 20261114073258 20261015073008 27194 li. +fZWglBnkaGbP1CvfuIDZkMaZWslDWYBRW516h+oyVYMIXFbmzZJEBUr7TT0rtPfpJCn1Cy9dWZh iXGiP6likg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a.nic.li for li/SOA
	Received 194 bytes from 130.59.31.42
	;; Response received from [130.59.31.42] 194 octets ;; HEADER SECTION ;; id = 64810 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; li. IN SOA ;; ANSWER SECTION (2 records) li. 900 IN SOA ( a.nic.li. dns-operation.switch.ch. 2026101521 ;serial 900 ;refresh 600 ;retry 1209600 ;expire 900 ;minimum ) li. 900 IN RRSIG ( SOA 13 1 900 20261114073258 20261015073008 27194 li. +fZWglBnkaGbP1CvfuIDZkMaZWslDWYBRW516h+oyVYMIXFbmzZJEBUr7TT0rtPfpJCn1Cy9dWZh iXGiP6likg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to f.nic.li for nic.li/A
	nic.li A RR has value 130.59.31.80
	Found 1 RRSIGs over A RRset
	`nic.li. 3600 IN RRSIG ( A 13 2 3600 20261109194843 20261010190008 27194 li. 3V2dIIw6nZ8vOKK1iMmS7Y/tXeKYB2Oe2t8eafA8bxtTdG05M9aAt7zyfYEQaILoRHpFpvTkMr4r EZ0fVcWrXA== )`
	RRSIG=27194 and DNSKEY=27194 verifies the A RRset

	Query to d.nic.li for nic.li/A
	Received 149 bytes from 194.0.25.40
	;; Response received from [194.0.25.40] 149 octets ;; HEADER SECTION ;; id = 57744 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1400, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nic.li. IN A ;; ANSWER SECTION (2 records) nic.li. 3600 IN A 130.59.31.80 nic.li. 3600 IN RRSIG ( A 13 2 3600 20261109194843 20261010190008 27194 li. 3V2dIIw6nZ8vOKK1iMmS7Y/tXeKYB2Oe2t8eafA8bxtTdG05M9aAt7zyfYEQaILoRHpFpvTkMr4r EZ0fVcWrXA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	d.nic.li is authoritative for nic.li
	Query to d.nic.li for nic.li/DNSKEY
	Received 330 bytes from 194.0.25.40
	;; Response received from [194.0.25.40] 330 octets ;; HEADER SECTION ;; id = 41791 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1400, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nic.li. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) li. 900 IN SOA ( a.nic.li. dns-operation.switch.ch. 2026101521 ;serial 900 ;refresh 600 ;retry 1209600 ;expire 900 ;minimum ) li. 900 IN RRSIG ( SOA 13 1 900 20261114073258 20261015073008 27194 li. +fZWglBnkaGbP1CvfuIDZkMaZWslDWYBRW516h+oyVYMIXFbmzZJEBUr7TT0rtPfpJCn1Cy9dWZh iXGiP6likg== ) nic.li. 900 IN NSEC _dmarc.nic.li. A MX TXT AAAA RRSIG NSEC CAA nic.li. 900 IN RRSIG ( NSEC 13 2 900 20261103125005 20261004120007 27194 li. HfaXCh5MnUf6QftPp4BN28dO15dKbHOFc0DwU/64V2hCDsA+EgUWn2cibNemiyp07MoL/3YDtYpQ QUkytxMwLQ== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found RRSIG signed by li zone
	Query to d.nic.li for nic.li/A
	nic.li A RR has value 130.59.31.80
	Found 1 RRSIGs over A RRset
	`nic.li. 3600 IN RRSIG ( A 13 2 3600 20261109194843 20261010190008 27194 li. 3V2dIIw6nZ8vOKK1iMmS7Y/tXeKYB2Oe2t8eafA8bxtTdG05M9aAt7zyfYEQaILoRHpFpvTkMr4r EZ0fVcWrXA== )`
	RRSIG=27194 and DNSKEY=27194 verifies the A RRset

	Query to b.nic.li for nic.li/A
	Received 149 bytes from 130.59.31.44
	;; Response received from [130.59.31.44] 149 octets ;; HEADER SECTION ;; id = 1237 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nic.li. IN A ;; ANSWER SECTION (2 records) nic.li. 3600 IN A 130.59.31.80 nic.li. 3600 IN RRSIG ( A 13 2 3600 20261109194843 20261010190008 27194 li. 3V2dIIw6nZ8vOKK1iMmS7Y/tXeKYB2Oe2t8eafA8bxtTdG05M9aAt7zyfYEQaILoRHpFpvTkMr4r EZ0fVcWrXA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	b.nic.li is authoritative for nic.li
	Query to a.nic.li for nic.li/DNSKEY
	Found RRSIG signed by li zone
	Query to b.nic.li for nic.li/A
	nic.li A RR has value 130.59.31.80
	Found 1 RRSIGs over A RRset
	`nic.li. 3600 IN RRSIG ( A 13 2 3600 20261109194843 20261010190008 27194 li. 3V2dIIw6nZ8vOKK1iMmS7Y/tXeKYB2Oe2t8eafA8bxtTdG05M9aAt7zyfYEQaILoRHpFpvTkMr4r EZ0fVcWrXA== )`
	RRSIG=27194 and DNSKEY=27194 verifies the A RRset

	Query to a.nic.li for nic.li/A
	Received 149 bytes from 130.59.31.42
	;; Response received from [130.59.31.42] 149 octets ;; HEADER SECTION ;; id = 18422 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nic.li. IN A ;; ANSWER SECTION (2 records) nic.li. 3600 IN A 130.59.31.80 nic.li. 3600 IN RRSIG ( A 13 2 3600 20261109194843 20261010190008 27194 li. 3V2dIIw6nZ8vOKK1iMmS7Y/tXeKYB2Oe2t8eafA8bxtTdG05M9aAt7zyfYEQaILoRHpFpvTkMr4r EZ0fVcWrXA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a.nic.li is authoritative for nic.li
	Query to e.nic.li for nic.li/DNSKEY
	Received 330 bytes from 194.0.17.1
	;; Response received from [194.0.17.1] 330 octets ;; HEADER SECTION ;; id = 55195 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nic.li. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) li. 900 IN SOA ( a.nic.li. dns-operation.switch.ch. 2026101521 ;serial 900 ;refresh 600 ;retry 1209600 ;expire 900 ;minimum ) li. 900 IN RRSIG ( SOA 13 1 900 20261114073258 20261015073008 27194 li. +fZWglBnkaGbP1CvfuIDZkMaZWslDWYBRW516h+oyVYMIXFbmzZJEBUr7TT0rtPfpJCn1Cy9dWZh iXGiP6likg== ) nic.li. 900 IN NSEC _dmarc.nic.li. A MX TXT AAAA RRSIG NSEC CAA nic.li. 900 IN RRSIG ( NSEC 13 2 900 20261103125005 20261004120007 27194 li. HfaXCh5MnUf6QftPp4BN28dO15dKbHOFc0DwU/64V2hCDsA+EgUWn2cibNemiyp07MoL/3YDtYpQ QUkytxMwLQ== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found RRSIG signed by li zone
	Query to a.nic.li for nic.li/A
	nic.li A RR has value 130.59.31.80
	Found 1 RRSIGs over A RRset
	`nic.li. 3600 IN RRSIG ( A 13 2 3600 20261109194843 20261010190008 27194 li. 3V2dIIw6nZ8vOKK1iMmS7Y/tXeKYB2Oe2t8eafA8bxtTdG05M9aAt7zyfYEQaILoRHpFpvTkMr4r EZ0fVcWrXA== )`
	RRSIG=27194 and DNSKEY=27194 verifies the A RRset

	Query to e.nic.li for nic.li/A
	Received 1135 bytes from 194.0.17.1
	;; Response received from [194.0.17.1] 1135 octets ;; HEADER SECTION ;; id = 29443 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 6 arcount = 17 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nic.li. IN A ;; ANSWER SECTION (2 records) nic.li. 3600 IN A 130.59.31.80 nic.li. 3600 IN RRSIG ( A 13 2 3600 20261109194843 20261010190008 27194 li. 3V2dIIw6nZ8vOKK1iMmS7Y/tXeKYB2Oe2t8eafA8bxtTdG05M9aAt7zyfYEQaILoRHpFpvTkMr4r EZ0fVcWrXA== ) ;; AUTHORITY SECTION (6 records) li. 86400 IN NS a.nic.li. li. 86400 IN NS d.nic.li. li. 86400 IN NS f.nic.li. li. 86400 IN NS b.nic.li. li. 86400 IN NS e.nic.li. li. 86400 IN RRSIG ( NS 13 1 86400 20261110171253 20261011163007 27194 li. +gYoZ2o5a5aBlU1QQrrYplYENiO00gG10HQ9o9mB8/XOm3yQd9gYMgAocAOOQqKMvBIZVES8b5PO aAxu4/FPzg== ) ;; ADDITIONAL SECTION (17 records) a.nic.li. 86400 IN A 130.59.31.42 b.nic.li. 86400 IN A 130.59.31.44 d.nic.li. 86400 IN A 194.0.25.40 e.nic.li. 86400 IN A 194.0.17.1 f.nic.li. 86400 IN A 194.146.106.14 a.nic.li. 86400 IN AAAA 2001:620:0:ff::57 b.nic.li. 86400 IN AAAA 2001:620:0:ff::59 d.nic.li. 86400 IN AAAA 2001:678:20::40 e.nic.li. 86400 IN AAAA 2001:678:3::1 f.nic.li. 86400 IN AAAA 2001:67c:1010:3::53 a.nic.li. 86400 IN RRSIG ( A 13 3 86400 20261103142550 20261004133006 27194 li. 84rLpYWyrzJx+Oodnqgu/IZgoZsTT6hzJB8h5im7q3BficRzo6qvlqOKRWvnkjP9hLkUUG79blaA hoW5D0rDGw== ) a.nic.li. 86400 IN RRSIG ( AAAA 13 3 86400 20261103002046 20261004093007 27194 li. M4et3brghxaY7ajUDRw0XLmqTuIJy1Hh0vTzP7fvV8aR5UV8FPwbUtNCPpHT3+7nltF5nXhf+Hf7 oj9oaRISAw== ) b.nic.li. 86400 IN RRSIG ( A 13 3 86400 20261109133035 20261010130007 27194 li. gsUbYwcRGP7aHnfVxbLEnsf0U6yXiRRo/ml7r5VddI5S2BATU3wXMHZD00Fq94AoMUIfQDA14nxS S30DBeXv7g== ) b.nic.li. 86400 IN RRSIG ( AAAA 13 3 86400 20261105215204 20261006213008 27194 li. V+tkJw/g/ndmjSuIe/Lv3yd25/GSp0G7AWEawQrW0f9tY8BmXPpO0M6FuvvU7VwE/4hRS7AzTvwj WDBuXL4jAA== ) d.nic.li. 86400 IN RRSIG ( A 13 3 86400 20261106120622 20261007113007 27194 li. EAYBRKVLtcdJUt9H/FMyWYv8BC4fC7t7LFa5hU/7q3Srs71t51g+WPtoRQwz0JtsXrzg9GxOcYuX HQEy7cUS6Q== ) d.nic.li. 86400 IN RRSIG ( AAAA 13 3 86400 20261110061334 20261011060008 27194 li. jTboeDvEVN4+RTmglycWjxUrClXoOpB2GFbGal7Paaf1UNll0cjB4CTsdt9mJgVryYtsaKzHUvkN W1hVu1enTg== ) ;; { "EDNS-VERSION": 0 }
	e.nic.li is authoritative for nic.li
	Query to e.nic.li for nic.li/DNSKEY
	Found RRSIG signed by li zone
	Query to e.nic.li for nic.li/A
	nic.li A RR has value 130.59.31.80
	Found 1 RRSIGs over A RRset
	`nic.li. 3600 IN RRSIG ( A 13 2 3600 20261109194843 20261010190008 27194 li. 3V2dIIw6nZ8vOKK1iMmS7Y/tXeKYB2Oe2t8eafA8bxtTdG05M9aAt7zyfYEQaILoRHpFpvTkMr4r EZ0fVcWrXA== )`
	RRSIG=27194 and DNSKEY=27194 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test nic.li at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: