DNSSEC Analyzer

Domain Name:

Time: 2023-01-30 00:59:25 UTC, NTP stratum 4

Analyzing DNSSEC problems for nsa.gov

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to l.root-servers.net for ./DNSKEY
	Received 864 bytes from 199.7.83.42
	;; Response received from 199.7.83.42 (864 octets) ;; HEADER SECTION ;; id = 7645 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAcVnO2jZFx4756Rb/yAhJnsl72eemsObU43nclmXwqdJlp+kC5WQjGYkqLT5xkaUCPhkr4NK LLrIBZXeSGazc6gx/yrrMtUpXcQvax6kfDJPTu974OmeEbtjyyP7ZG5tUfSwNWt/4EuxDNmZTESG 8jU0ZLjYIB11pK0gSXQbMVPyIyGtFGHMPx6UxWn6zUzpECWRFbqEvkA6Y13zeJ1jG2Rki/zs7a/o 13FTl/kI9013Eh6l6Kc2zxbc14GS8fpM0/xQIrZZyeiXj/2C4RcsPeqWuNj9m0qSQrbrCZtLHb20 U8x1uue4iwSX9y7LpwZd6vjYd1d6dgBa1Xxgc/TC+m8= ) ; Key ID = 951 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20230211000000 20230121000000 20326 . UTKe6Ir/OYc+YxQKtVtll09sl7Iirz0ajr6Wtu6KZjDoXg0hSze1NKIlth7kqvXY0q1lBub5Biyk SeACSmjDUZKJ3JK4tSgMg/UqWi/Se6v8fRfv120nJZKWmUg4Iy8GXJGDLmbghz4hHW62pZ2KKDaN Fm2+u7AcRFPmyCDGCxouTFZUfjQGiO8p3+T1BESqbq+zwMF78Mls/e5qtTqSF9mQBJNGJ99FIbPc p006e5KFaP5DoL9dtbUOvmLZVzmtBiEpQUUxD/FXWQwZckKbebF8/Ja8FdctXYngrJOwaYyxnVkc 8julOAEtzRlmJOzFHVyau1QESCOfT5F1SlYrpg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAcVnO2jZFx4756Rb/yAhJnsl72eemsObU43nclmXwqdJlp+kC5WQjGYkqLT5xkaUCPhkr4NK LLrIBZXeSGazc6gx/yrrMtUpXcQvax6kfDJPTu974OmeEbtjyyP7ZG5tUfSwNWt/4EuxDNmZTESG 8jU0ZLjYIB11pK0gSXQbMVPyIyGtFGHMPx6UxWn6zUzpECWRFbqEvkA6Y13zeJ1jG2Rki/zs7a/o 13FTl/kI9013Eh6l6Kc2zxbc14GS8fpM0/xQIrZZyeiXj/2C4RcsPeqWuNj9m0qSQrbrCZtLHb20 U8x1uue4iwSX9y7LpwZd6vjYd1d6dgBa1Xxgc/TC+m8= ) ; Key ID = 951`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20230211000000 20230121000000 20326 . UTKe6Ir/OYc+YxQKtVtll09sl7Iirz0ajr6Wtu6KZjDoXg0hSze1NKIlth7kqvXY0q1lBub5Biyk SeACSmjDUZKJ3JK4tSgMg/UqWi/Se6v8fRfv120nJZKWmUg4Iy8GXJGDLmbghz4hHW62pZ2KKDaN Fm2+u7AcRFPmyCDGCxouTFZUfjQGiO8p3+T1BESqbq+zwMF78Mls/e5qtTqSF9mQBJNGJ99FIbPc p006e5KFaP5DoL9dtbUOvmLZVzmtBiEpQUUxD/FXWQwZckKbebF8/Ja8FdctXYngrJOwaYyxnVkc 8julOAEtzRlmJOzFHVyau1QESCOfT5F1SlYrpg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=951 is now in the chain-of-trust
	Query to i.root-servers.net for nsa.gov/A
	Received 626 bytes from 192.36.148.17
	;; Response received from 192.36.148.17 (626 octets) ;; HEADER SECTION ;; id = 31567 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS c.gov-servers.net. gov. 172800 IN NS a.gov-servers.net. gov. 172800 IN NS b.gov-servers.net. gov. 172800 IN NS d.gov-servers.net. gov. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20230211170000 20230129160000 951 . qcxxPaHmjYjMF3NkVoVWDvkWc4F3bOrKApHsubtVPyedpWsr5ZZei/fkMaG1sMq/Ut7i7PEGSAtq IVoSnz/KmiCCDasgzUOPrbWNQA9Vrnd+JOJ2KNJGMWf7upLA+Y1db9ZDwU5vGLXUzLQqAwWKaoBP HJH1VXsJYzdUy7Krra9ifj8iP36RNN4OTllk41YGbnpycEugDEYFZ8vK+NOl8pp+UiB0/SVXdAdi Y5gNWYexZnE/0NxLh8f/MQ28bhCVoLdwfpdFDqYBC1yALZNASjkLlk5nClmuRagqqxwxSDZedyx3 3V0vEeLwJvvMvPtQbsN3pX2ZC2WS48bNz7VRxQ== ) ;; ADDITIONAL SECTION (9 records) d.gov-servers.net. 172800 IN A 81.19.194.30 c.gov-servers.net. 172800 IN A 69.36.153.30 b.gov-servers.net. 172800 IN A 209.112.123.30 a.gov-servers.net. 172800 IN A 69.36.157.30 d.gov-servers.net. 172800 IN AAAA 2620:74:29::2:30 c.gov-servers.net. 172800 IN AAAA 2620:74:28::2:30 b.gov-servers.net. 172800 IN AAAA 2620:74:27::2:30 a.gov-servers.net. 172800 IN AAAA 2001:500:4431::2:30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to b.root-servers.net for gov/DNSKEY
	Received 622 bytes from 199.9.14.201
	;; Response received from 199.9.14.201 (622 octets) ;; HEADER SECTION ;; id = 53163 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.gov-servers.net. gov. 172800 IN NS b.gov-servers.net. gov. 172800 IN NS c.gov-servers.net. gov. 172800 IN NS d.gov-servers.net. gov. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20230211170000 20230129160000 951 . qcxxPaHmjYjMF3NkVoVWDvkWc4F3bOrKApHsubtVPyedpWsr5ZZei/fkMaG1sMq/Ut7i7PEGSAtq IVoSnz/KmiCCDasgzUOPrbWNQA9Vrnd+JOJ2KNJGMWf7upLA+Y1db9ZDwU5vGLXUzLQqAwWKaoBP HJH1VXsJYzdUy7Krra9ifj8iP36RNN4OTllk41YGbnpycEugDEYFZ8vK+NOl8pp+UiB0/SVXdAdi Y5gNWYexZnE/0NxLh8f/MQ28bhCVoLdwfpdFDqYBC1yALZNASjkLlk5nClmuRagqqxwxSDZedyx3 3V0vEeLwJvvMvPtQbsN3pX2ZC2WS48bNz7VRxQ== ) ;; ADDITIONAL SECTION (9 records) a.gov-servers.net. 172800 IN A 69.36.157.30 a.gov-servers.net. 172800 IN AAAA 2001:500:4431::2:30 b.gov-servers.net. 172800 IN A 209.112.123.30 b.gov-servers.net. 172800 IN AAAA 2620:74:27::2:30 c.gov-servers.net. 172800 IN A 69.36.153.30 c.gov-servers.net. 172800 IN AAAA 2620:74:28::2:30 d.gov-servers.net. 172800 IN A 81.19.194.30 d.gov-servers.net. 172800 IN AAAA 2620:74:29::2:30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found child zone gov

gov

	Checking DS between . and gov
	Query to f.root-servers.net for gov/DS
	Received 367 bytes from 192.5.5.241
	;; Response received from 192.5.5.241 (367 octets) ;; HEADER SECTION ;; id = 49629 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option: ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20230211170000 20230129160000 951 . qcxxPaHmjYjMF3NkVoVWDvkWc4F3bOrKApHsubtVPyedpWsr5ZZei/fkMaG1sMq/Ut7i7PEGSAtq IVoSnz/KmiCCDasgzUOPrbWNQA9Vrnd+JOJ2KNJGMWf7upLA+Y1db9ZDwU5vGLXUzLQqAwWKaoBP HJH1VXsJYzdUy7Krra9ifj8iP36RNN4OTllk41YGbnpycEugDEYFZ8vK+NOl8pp+UiB0/SVXdAdi Y5gNWYexZnE/0NxLh8f/MQ28bhCVoLdwfpdFDqYBC1yALZNASjkLlk5nClmuRagqqxwxSDZedyx3 3V0vEeLwJvvMvPtQbsN3pX2ZC2WS48bNz7VRxQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option:
	Found 1 DS records for gov in the . zone
	DS=7698/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20230211170000 20230129160000 951 . qcxxPaHmjYjMF3NkVoVWDvkWc4F3bOrKApHsubtVPyedpWsr5ZZei/fkMaG1sMq/Ut7i7PEGSAtq IVoSnz/KmiCCDasgzUOPrbWNQA9Vrnd+JOJ2KNJGMWf7upLA+Y1db9ZDwU5vGLXUzLQqAwWKaoBP HJH1VXsJYzdUy7Krra9ifj8iP36RNN4OTllk41YGbnpycEugDEYFZ8vK+NOl8pp+UiB0/SVXdAdi Y5gNWYexZnE/0NxLh8f/MQ28bhCVoLdwfpdFDqYBC1yALZNASjkLlk5nClmuRagqqxwxSDZedyx3 3V0vEeLwJvvMvPtQbsN3pX2ZC2WS48bNz7VRxQ== )`
	RRSIG=951 and DNSKEY=951 verifies the DS RRset
	DS=7698/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 )`
	Query to d.gov-servers.net for gov/DNSKEY
	Received 777 bytes from 81.19.194.30
	;; Response received from 81.19.194.30 (777 octets) ;; HEADER SECTION ;; id = 5706 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 86400 IN DNSKEY ( 257 3 8 AQO8daaz7B+yshOfL60rytKd9aOSujgponEw3fwBMEC3/+e9XzHw2k+VKnbJTZ+QaVtpfUd1q9HK ZIv/ck83Gl5TjYKE5jtUZ2kpEDZfVNGv6yx0smtWAXv1nCJS9ohnyOTd397eMojGDHqkEC+uojES cZheEkMxzgCZwDAs+/CSU7mSuHtCRZn19xlZUd5Gv7yDQ3mbOUwuy30oSk0z1Q5UUPpoihOugIZH FX6Jk7NLiW2wlqfq9qhV4zj7TiBiJY0mCc4zHN8/aq2VKDHp2Na7mWzvKyTy+SYQkBQ/08LbPwj9 YMc+uCzKL6sU/ObHv17EFhD8aPDftTHZvV9L+OZr ) ; Key ID = 7698 gov. 86400 IN DNSKEY ( 256 3 8 AwEAAZvxD/dRxa63REw/dsgJRPBzJDRXCZvGa06axqtIXHgasIi6wFd/Axk6Bpb92enCEIUffOLr i3mEsi0q9DjsJqS7tI+Im1P5RWVN+gZY3b4PQ8Sa2BWAe55FGgDcH+YcO3QGIYGqPEj576CVj4eH HcWY0UpzyvcZo6ZHbciukZ01Xu0NT9bVCAbUc9F16O7T+8In3wZShbBGQOan5QYEkxU= ) ; Key ID = 24250 gov. 86400 IN RRSIG ( DNSKEY 8 1 86400 20230213200254 20230129195754 7698 gov. itHoobdG3yH4Bi2C+Nt4vBkHzikW4jIjpuqQNZUe0pvQgWySGfuWabp7wIk3vDqaiRrXuKq7A8rb Dc1YGB+Ep0BMbXH0GJe8QW6+LWYMqwaUbupZ8136n0V9ai+H7VAn/WHKlbM5y0KpBZR47AjywHVx 9nXJnF8XFh0NFpTX4a/EYTr4QMzZ0wHcqlIvKdmCNMfoenhB+TnzBqdaN40msAJ3yoTnVdGv8+Cm qfGYdMhBaXgQKzGYLZ/DqpzXRsotpuFrpWR8Yrw1ZzoSAAEZv5cAjoAVFXaWfxy2WWFq6vrP5SyV kgfOHKAgRWorVQCftW+cFBhPcGR712GOOvPkug== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DNSKEY records for gov
	`gov. 86400 IN DNSKEY ( 257 3 8 AQO8daaz7B+yshOfL60rytKd9aOSujgponEw3fwBMEC3/+e9XzHw2k+VKnbJTZ+QaVtpfUd1q9HK ZIv/ck83Gl5TjYKE5jtUZ2kpEDZfVNGv6yx0smtWAXv1nCJS9ohnyOTd397eMojGDHqkEC+uojES cZheEkMxzgCZwDAs+/CSU7mSuHtCRZn19xlZUd5Gv7yDQ3mbOUwuy30oSk0z1Q5UUPpoihOugIZH FX6Jk7NLiW2wlqfq9qhV4zj7TiBiJY0mCc4zHN8/aq2VKDHp2Na7mWzvKyTy+SYQkBQ/08LbPwj9 YMc+uCzKL6sU/ObHv17EFhD8aPDftTHZvV9L+OZr ) ; Key ID = 7698`
	`gov. 86400 IN DNSKEY ( 256 3 8 AwEAAZvxD/dRxa63REw/dsgJRPBzJDRXCZvGa06axqtIXHgasIi6wFd/Axk6Bpb92enCEIUffOLr i3mEsi0q9DjsJqS7tI+Im1P5RWVN+gZY3b4PQ8Sa2BWAe55FGgDcH+YcO3QGIYGqPEj576CVj4eH HcWY0UpzyvcZo6ZHbciukZ01Xu0NT9bVCAbUc9F16O7T+8In3wZShbBGQOan5QYEkxU= ) ; Key ID = 24250`
	DNSKEY=7698/SEP is now in the chain-of-trust
	DS=7698/SHA-256 verifies DNSKEY=7698/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 86400 IN RRSIG ( DNSKEY 8 1 86400 20230213200254 20230129195754 7698 gov. itHoobdG3yH4Bi2C+Nt4vBkHzikW4jIjpuqQNZUe0pvQgWySGfuWabp7wIk3vDqaiRrXuKq7A8rb Dc1YGB+Ep0BMbXH0GJe8QW6+LWYMqwaUbupZ8136n0V9ai+H7VAn/WHKlbM5y0KpBZR47AjywHVx 9nXJnF8XFh0NFpTX4a/EYTr4QMzZ0wHcqlIvKdmCNMfoenhB+TnzBqdaN40msAJ3yoTnVdGv8+Cm qfGYdMhBaXgQKzGYLZ/DqpzXRsotpuFrpWR8Yrw1ZzoSAAEZv5cAjoAVFXaWfxy2WWFq6vrP5SyV kgfOHKAgRWorVQCftW+cFBhPcGR712GOOvPkug== )`
	RRSIG=7698 and DNSKEY=7698/SEP verifies the DNSKEY RRset
	DNSKEY=24250 is now in the chain-of-trust
	Query to c.gov-servers.net for nsa.gov/A
	Received 447 bytes from 69.36.153.30
	;; Response received from 69.36.153.30 (447 octets) ;; HEADER SECTION ;; id = 6499 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 9 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) nsa.gov. 86400 IN NS a24-65.akam.net. nsa.gov. 86400 IN NS a11-66.akam.net. nsa.gov. 86400 IN NS a12-67.akam.net. nsa.gov. 86400 IN NS a1-107.akam.net. nsa.gov. 86400 IN NS a2-64.akam.net. nsa.gov. 86400 IN NS a5-66.akam.net. nsa.gov. 3600 IN DS 15753 7 1 b2a95adb4e4561a19f8c36e3ab1fbf5d425c185b nsa.gov. 3600 IN DS ( 15753 7 2 4db869572b3e0e8e9bb4939dfc31c998de77a7700923f6a93d89ea55399582a9 ) nsa.gov. 3600 IN RRSIG ( DS 8 2 3600 20230205124112 20230129124112 24250 gov. Us9MSdc32AruZL5svAj8YEFJ/BBWtd4ly12LXEkxZNa49YCQmCys22R/LbMXCv92aE6V8e+cLj8U OXwfecQVEL7otZGWQCiBeXkZET17nh4RrqRxq1bqzkdvNNuRemwPasRGIfm7i77PZbfoK1Guyx1A olzquaHHzVLYMFHde9M5v7m/yyZTosKV+nhS/XvOQ7HeUpNX42itPEkzHY/UrA== ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to d.gov-servers.net for nsa.gov/DNSKEY
	Received 447 bytes from 81.19.194.30
	;; Response received from 81.19.194.30 (447 octets) ;; HEADER SECTION ;; id = 39792 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 9 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) nsa.gov. 86400 IN NS a11-66.akam.net. nsa.gov. 86400 IN NS a5-66.akam.net. nsa.gov. 86400 IN NS a12-67.akam.net. nsa.gov. 86400 IN NS a24-65.akam.net. nsa.gov. 86400 IN NS a1-107.akam.net. nsa.gov. 86400 IN NS a2-64.akam.net. nsa.gov. 3600 IN DS 15753 7 1 b2a95adb4e4561a19f8c36e3ab1fbf5d425c185b nsa.gov. 3600 IN DS ( 15753 7 2 4db869572b3e0e8e9bb4939dfc31c998de77a7700923f6a93d89ea55399582a9 ) nsa.gov. 3600 IN RRSIG ( DS 8 2 3600 20230205124112 20230129124112 24250 gov. Us9MSdc32AruZL5svAj8YEFJ/BBWtd4ly12LXEkxZNa49YCQmCys22R/LbMXCv92aE6V8e+cLj8U OXwfecQVEL7otZGWQCiBeXkZET17nh4RrqRxq1bqzkdvNNuRemwPasRGIfm7i77PZbfoK1Guyx1A olzquaHHzVLYMFHde9M5v7m/yyZTosKV+nhS/XvOQ7HeUpNX42itPEkzHY/UrA== ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone nsa.gov

nsa.gov

	Checking DS between gov and nsa.gov
	Query to a.gov-servers.net for nsa.gov/DS
	Received 315 bytes from 69.36.157.30
	;; Response received from 69.36.157.30 (315 octets) ;; HEADER SECTION ;; id = 27875 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN DS ;; ANSWER SECTION (3 records) nsa.gov. 3600 IN DS 15753 7 1 b2a95adb4e4561a19f8c36e3ab1fbf5d425c185b nsa.gov. 3600 IN DS ( 15753 7 2 4db869572b3e0e8e9bb4939dfc31c998de77a7700923f6a93d89ea55399582a9 ) nsa.gov. 3600 IN RRSIG ( DS 8 2 3600 20230205124112 20230129124112 24250 gov. Us9MSdc32AruZL5svAj8YEFJ/BBWtd4ly12LXEkxZNa49YCQmCys22R/LbMXCv92aE6V8e+cLj8U OXwfecQVEL7otZGWQCiBeXkZET17nh4RrqRxq1bqzkdvNNuRemwPasRGIfm7i77PZbfoK1Guyx1A olzquaHHzVLYMFHde9M5v7m/yyZTosKV+nhS/XvOQ7HeUpNX42itPEkzHY/UrA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DS records for nsa.gov in the gov zone
	DS=15753/SHA-1 has algorithm RSASHA1-NSEC3-SHA1
	DS=15753/SHA-256 has algorithm RSASHA1-NSEC3-SHA1
	Found 1 RRSIGs over DS RRset
	`nsa.gov. 3600 IN RRSIG ( DS 8 2 3600 20230205124112 20230129124112 24250 gov. Us9MSdc32AruZL5svAj8YEFJ/BBWtd4ly12LXEkxZNa49YCQmCys22R/LbMXCv92aE6V8e+cLj8U OXwfecQVEL7otZGWQCiBeXkZET17nh4RrqRxq1bqzkdvNNuRemwPasRGIfm7i77PZbfoK1Guyx1A olzquaHHzVLYMFHde9M5v7m/yyZTosKV+nhS/XvOQ7HeUpNX42itPEkzHY/UrA== )`
	RRSIG=24250 and DNSKEY=24250 verifies the DS RRset
	DS=15753/SHA-1 is now in the chain-of-trust
	`nsa.gov. 3600 IN DS 15753 7 1 b2a95adb4e4561a19f8c36e3ab1fbf5d425c185b`
	`nsa.gov. 3600 IN DS ( 15753 7 2 4db869572b3e0e8e9bb4939dfc31c998de77a7700923f6a93d89ea55399582a9 )`
	Query to a12-67.akam.net for nsa.gov/DNSKEY
	Received 903 bytes from 184.26.160.67
	;; Response received from 184.26.160.67 (903 octets) ;; HEADER SECTION ;; id = 59393 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN DNSKEY ;; ANSWER SECTION (4 records) nsa.gov. 7200 IN DNSKEY ( 257 3 7 AwEAAc4d+FTiChC1NgrL78K9tuR1qNq/Z/k/W3M5G0GoNo8MjuOLjNZMjkm58Iu/Ch2W+6qlw9eD xdqx3L5J4GznzZSNHko1tVtGTbv0+C1UV/iFjowvq0iDSEijNqSEQ2OgImTRcoe2MbORuC7ttdVY hu/rxdDI6KdCXLUvAFCkpPEf2YwUnBljPo0hcqZFwGOFz5aqa4+5mty4LQAdZx9Ldj9fafL5eyoQ 0u4CBt+wOSQuFZWa8xFzDW/Z1BZnoaWuruqIV0sw09FyFKncUCkZ0UQqD9fK3FfdRoWz1c1Ta9Iy ZjfyPt1DgROLziJMYlBRAy2o+3FRSVkejKT6/60E21k= ) ; Key ID = 15753 nsa.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAeWJO0hwkNTBFayw5xc/tlMMTZb78LIdhBOhHhFX+NcVgplGxW3SK6XyqG/AzcL5CfoSHiXq lhm3ScwdVoPTTWhv6xf103CSDO/5ut4FRaGvxeJ//wbJpv7KEpv2xoy+aUFi62VyRRxr6ZQ4s6vD 0Q91vDA8r9neeK4+I4Ss7ta9 ) ; Key ID = 63144 nsa.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAbpdAzeLCT7aBnPpuvt69vd8/mAVy7YgTEuM/0zFRhvxRaSrCq9Yg5rt5EYij/RJxYULGPvj zSmd7GCkVIfWw5R2QlCpiMZvdMP0wB78mxFY/KHJHHS/h8Y3RH8J4LNtUivmYNWdKVfxqkX7nvgT WdANuJx8smryobozh8iYhXkV ) ; Key ID = 21375 nsa.gov. 7200 IN RRSIG ( DNSKEY 7 2 7200 20230201074207 20230129064207 15753 nsa.gov. bmBxfGWA+MOsWepdU7YwPDxw9zmqIm3YS8awTCA8RYy4wbIVdCCTqAU+5eknCYLtjCw5DgVMrHJg fK/PwEaLQwm2fA6H8gWRjkAdieCt2uYvwm7XoOD4r8P0u8opgXctdVjdPI49xBKTMXSaz7MZgpu5 4qa6A/KKJ9sfx+/VYlTu1Ft3EuVGxpiP0GT5f9Qf5qKeyLXWHWj012WAzvFBerJsOKg8LKGcaaoB xe/iaFO0Khn2duwWOlGuwwLcvq4A2h3kbcI8k88qTPBcLGdI1vD+hyYryJ6TTVddrhgl+c5E3zux mok+IITi3gk79ijRT0IHMKPwu7UNWgAMGmqvIw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 3 DNSKEY records for nsa.gov
	`nsa.gov. 7200 IN DNSKEY ( 257 3 7 AwEAAc4d+FTiChC1NgrL78K9tuR1qNq/Z/k/W3M5G0GoNo8MjuOLjNZMjkm58Iu/Ch2W+6qlw9eD xdqx3L5J4GznzZSNHko1tVtGTbv0+C1UV/iFjowvq0iDSEijNqSEQ2OgImTRcoe2MbORuC7ttdVY hu/rxdDI6KdCXLUvAFCkpPEf2YwUnBljPo0hcqZFwGOFz5aqa4+5mty4LQAdZx9Ldj9fafL5eyoQ 0u4CBt+wOSQuFZWa8xFzDW/Z1BZnoaWuruqIV0sw09FyFKncUCkZ0UQqD9fK3FfdRoWz1c1Ta9Iy ZjfyPt1DgROLziJMYlBRAy2o+3FRSVkejKT6/60E21k= ) ; Key ID = 15753`
	`nsa.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAeWJO0hwkNTBFayw5xc/tlMMTZb78LIdhBOhHhFX+NcVgplGxW3SK6XyqG/AzcL5CfoSHiXq lhm3ScwdVoPTTWhv6xf103CSDO/5ut4FRaGvxeJ//wbJpv7KEpv2xoy+aUFi62VyRRxr6ZQ4s6vD 0Q91vDA8r9neeK4+I4Ss7ta9 ) ; Key ID = 63144`
	`nsa.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAbpdAzeLCT7aBnPpuvt69vd8/mAVy7YgTEuM/0zFRhvxRaSrCq9Yg5rt5EYij/RJxYULGPvj zSmd7GCkVIfWw5R2QlCpiMZvdMP0wB78mxFY/KHJHHS/h8Y3RH8J4LNtUivmYNWdKVfxqkX7nvgT WdANuJx8smryobozh8iYhXkV ) ; Key ID = 21375`
	DNSKEY=15753/SEP is now in the chain-of-trust
	DS=15753/SHA-1 verifies DNSKEY=15753/SEP
	DS=15753/SHA-256 verifies DNSKEY=15753/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`nsa.gov. 7200 IN RRSIG ( DNSKEY 7 2 7200 20230201074207 20230129064207 15753 nsa.gov. bmBxfGWA+MOsWepdU7YwPDxw9zmqIm3YS8awTCA8RYy4wbIVdCCTqAU+5eknCYLtjCw5DgVMrHJg fK/PwEaLQwm2fA6H8gWRjkAdieCt2uYvwm7XoOD4r8P0u8opgXctdVjdPI49xBKTMXSaz7MZgpu5 4qa6A/KKJ9sfx+/VYlTu1Ft3EuVGxpiP0GT5f9Qf5qKeyLXWHWj012WAzvFBerJsOKg8LKGcaaoB xe/iaFO0Khn2duwWOlGuwwLcvq4A2h3kbcI8k88qTPBcLGdI1vD+hyYryJ6TTVddrhgl+c5E3zux mok+IITi3gk79ijRT0IHMKPwu7UNWgAMGmqvIw== )`
	RRSIG=15753 and DNSKEY=15753/SEP verifies the DNSKEY RRset
	DNSKEY=63144 is now in the chain-of-trust
	DNSKEY=21375 is now in the chain-of-trust
	Query to a11-66.akam.net for nsa.gov/A
	Received 219 bytes from 84.53.139.66
	;; Response received from 84.53.139.66 (219 octets) ;; HEADER SECTION ;; id = 6291 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 104.90.241.7 nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. u/B0QC2VWXmepTADci4IPhq47+BtDylM2FppomOBHhNEt5G065fNXJwJ/Yl4YoIfUFsmjYOAUzAK /qMUvMsH6E1nBszBgH/kloBwf+7PETw9cQwFfMfnnvPu8hhuHhRPqHERnnVtAiYwd7HBMurt6yQw LD4vEL3C1wICAaI+/Zo= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	a11-66.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a2-64.akam.net for nsa.gov/SOA
	Received 564 bytes from 95.100.174.64
	;; Response received from 95.100.174.64 (564 octets) ;; HEADER SECTION ;; id = 47818 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( dsdn-gh1-uea05.nsa.gov. hostmaster.nsa.gov. 2020120190 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20230201074207 20230129064207 63144 nsa.gov. fvZoD8GAjLE9KEOY7KLWj7iRV+8zvvy0ciR88I8g/H3akeFbWGr2Wbx83WilD5R6LiP67e5QY5f0 fmCwbCd8bF7icpihgt76mTdjyKeg8fpObDc6M8zHZkSJ7sc6ul30Z1CDc3CQ/G6QTW81U2n6U10c nMmtKLOeulMYNWCrdFU= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20230201074207 20230129064207 63144 nsa.gov. 0Ej+8Bybbl1UwGWxS3+xBgVACg+GwzLTK4KFzBFdnjxnvj60BNlzMH530qFCkQKpUc5tnqHvXfjJ 3UKOhRtu7eRpn5qJkvG5IM2MN/FItSiSGfsXmRZ5Y0XDTDnP56YyCNc3MfsvsaKpossjpknKZqsF c5CdqzJomrO03CDxD54= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to a24-65.akam.net for nsa.gov/SOA
	Received 564 bytes from 2.16.130.65
	;; Response received from 2.16.130.65 (564 octets) ;; HEADER SECTION ;; id = 35760 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( dsdn-gh1-uea05.nsa.gov. hostmaster.nsa.gov. 2020120190 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20230201074207 20230129064207 63144 nsa.gov. fvZoD8GAjLE9KEOY7KLWj7iRV+8zvvy0ciR88I8g/H3akeFbWGr2Wbx83WilD5R6LiP67e5QY5f0 fmCwbCd8bF7icpihgt76mTdjyKeg8fpObDc6M8zHZkSJ7sc6ul30Z1CDc3CQ/G6QTW81U2n6U10c nMmtKLOeulMYNWCrdFU= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20230201074207 20230129064207 63144 nsa.gov. 0Ej+8Bybbl1UwGWxS3+xBgVACg+GwzLTK4KFzBFdnjxnvj60BNlzMH530qFCkQKpUc5tnqHvXfjJ 3UKOhRtu7eRpn5qJkvG5IM2MN/FItSiSGfsXmRZ5Y0XDTDnP56YyCNc3MfsvsaKpossjpknKZqsF c5CdqzJomrO03CDxD54= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to a5-66.akam.net for nsa.gov/SOA
	Received 564 bytes from 95.100.168.66
	;; Response received from 95.100.168.66 (564 octets) ;; HEADER SECTION ;; id = 64299 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( dsdn-gh1-uea05.nsa.gov. hostmaster.nsa.gov. 2020120190 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20230201074207 20230129064207 63144 nsa.gov. fvZoD8GAjLE9KEOY7KLWj7iRV+8zvvy0ciR88I8g/H3akeFbWGr2Wbx83WilD5R6LiP67e5QY5f0 fmCwbCd8bF7icpihgt76mTdjyKeg8fpObDc6M8zHZkSJ7sc6ul30Z1CDc3CQ/G6QTW81U2n6U10c nMmtKLOeulMYNWCrdFU= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20230201074207 20230129064207 63144 nsa.gov. 0Ej+8Bybbl1UwGWxS3+xBgVACg+GwzLTK4KFzBFdnjxnvj60BNlzMH530qFCkQKpUc5tnqHvXfjJ 3UKOhRtu7eRpn5qJkvG5IM2MN/FItSiSGfsXmRZ5Y0XDTDnP56YyCNc3MfsvsaKpossjpknKZqsF c5CdqzJomrO03CDxD54= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to a12-67.akam.net for nsa.gov/SOA
	Received 564 bytes from 184.26.160.67
	;; Response received from 184.26.160.67 (564 octets) ;; HEADER SECTION ;; id = 31919 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( dsdn-gh1-uea05.nsa.gov. hostmaster.nsa.gov. 2020120190 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20230201074207 20230129064207 63144 nsa.gov. fvZoD8GAjLE9KEOY7KLWj7iRV+8zvvy0ciR88I8g/H3akeFbWGr2Wbx83WilD5R6LiP67e5QY5f0 fmCwbCd8bF7icpihgt76mTdjyKeg8fpObDc6M8zHZkSJ7sc6ul30Z1CDc3CQ/G6QTW81U2n6U10c nMmtKLOeulMYNWCrdFU= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20230201074207 20230129064207 63144 nsa.gov. 0Ej+8Bybbl1UwGWxS3+xBgVACg+GwzLTK4KFzBFdnjxnvj60BNlzMH530qFCkQKpUc5tnqHvXfjJ 3UKOhRtu7eRpn5qJkvG5IM2MN/FItSiSGfsXmRZ5Y0XDTDnP56YyCNc3MfsvsaKpossjpknKZqsF c5CdqzJomrO03CDxD54= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to a1-107.akam.net for nsa.gov/SOA
	Received 564 bytes from 193.108.91.107
	;; Response received from 193.108.91.107 (564 octets) ;; HEADER SECTION ;; id = 64212 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( dsdn-gh1-uea05.nsa.gov. hostmaster.nsa.gov. 2020120190 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20230201074207 20230129064207 63144 nsa.gov. fvZoD8GAjLE9KEOY7KLWj7iRV+8zvvy0ciR88I8g/H3akeFbWGr2Wbx83WilD5R6LiP67e5QY5f0 fmCwbCd8bF7icpihgt76mTdjyKeg8fpObDc6M8zHZkSJ7sc6ul30Z1CDc3CQ/G6QTW81U2n6U10c nMmtKLOeulMYNWCrdFU= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20230201074207 20230129064207 63144 nsa.gov. 0Ej+8Bybbl1UwGWxS3+xBgVACg+GwzLTK4KFzBFdnjxnvj60BNlzMH530qFCkQKpUc5tnqHvXfjJ 3UKOhRtu7eRpn5qJkvG5IM2MN/FItSiSGfsXmRZ5Y0XDTDnP56YyCNc3MfsvsaKpossjpknKZqsF c5CdqzJomrO03CDxD54= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to a11-66.akam.net for nsa.gov/A
	Received 219 bytes from 84.53.139.66
	;; Response received from 84.53.139.66 (219 octets) ;; HEADER SECTION ;; id = 20752 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 104.90.241.7 nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. u/B0QC2VWXmepTADci4IPhq47+BtDylM2FppomOBHhNEt5G065fNXJwJ/Yl4YoIfUFsmjYOAUzAK /qMUvMsH6E1nBszBgH/kloBwf+7PETw9cQwFfMfnnvPu8hhuHhRPqHERnnVtAiYwd7HBMurt6yQw LD4vEL3C1wICAaI+/Zo= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	nsa.gov A RR has value 104.90.241.7
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. u/B0QC2VWXmepTADci4IPhq47+BtDylM2FppomOBHhNEt5G065fNXJwJ/Yl4YoIfUFsmjYOAUzAK /qMUvMsH6E1nBszBgH/kloBwf+7PETw9cQwFfMfnnvPu8hhuHhRPqHERnnVtAiYwd7HBMurt6yQw LD4vEL3C1wICAaI+/Zo= )`
	RRSIG=63144 and DNSKEY=63144 verifies the A RRset

nsa.gov

	Query to a24-65.akam.net for nsa.gov/A
	Received 219 bytes from 2.16.130.65
	;; Response received from 2.16.130.65 (219 octets) ;; HEADER SECTION ;; id = 3858 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.61.221.116 nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. Gwh/YdGLFZZtvjR5MTzoxNm8AccsNm35aG0kpHSsfUjNuUcUtT2+Y+YILazBt3PwtF3hLU5oMZxB 1GemfBV7tj4fLSSknm2sXmMt8g9ZfAbrEhD2R/3ojSB157mZKyXuRszU3GiNGtR7CqEq1fhw2Pkh Terzwe7d33lJufQhsKM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	a24-65.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a24-65.akam.net for nsa.gov/A
	Received 219 bytes from 2.16.130.65
	;; Response received from 2.16.130.65 (219 octets) ;; HEADER SECTION ;; id = 11207 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.61.221.116 nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. Gwh/YdGLFZZtvjR5MTzoxNm8AccsNm35aG0kpHSsfUjNuUcUtT2+Y+YILazBt3PwtF3hLU5oMZxB 1GemfBV7tj4fLSSknm2sXmMt8g9ZfAbrEhD2R/3ojSB157mZKyXuRszU3GiNGtR7CqEq1fhw2Pkh Terzwe7d33lJufQhsKM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	nsa.gov A RR has value 23.61.221.116
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. Gwh/YdGLFZZtvjR5MTzoxNm8AccsNm35aG0kpHSsfUjNuUcUtT2+Y+YILazBt3PwtF3hLU5oMZxB 1GemfBV7tj4fLSSknm2sXmMt8g9ZfAbrEhD2R/3ojSB157mZKyXuRszU3GiNGtR7CqEq1fhw2Pkh Terzwe7d33lJufQhsKM= )`
	RRSIG=63144 and DNSKEY=63144 verifies the A RRset

nsa.gov

	Query to a12-67.akam.net for nsa.gov/A
	Received 219 bytes from 184.26.160.67
	;; Response received from 184.26.160.67 (219 octets) ;; HEADER SECTION ;; id = 40159 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 104.72.121.91 nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. sz/hAYEJ0AGzmJl1pY8jhkrb6bJaysTE1WkZE7RvY6PmWO1yCRNvqz2NtztSeDiV5iskctWt4XTe 0To4We4Np0kBvOxL+bcrrrRAVbTTbhqAjSVayfuaIc7m9Tz8ks1Cy+OA1dx+NW96NrY63k4ucBqB EGxkC5tbDYbt7DPHzwc= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	a12-67.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a12-67.akam.net for nsa.gov/A
	Received 219 bytes from 184.26.160.67
	;; Response received from 184.26.160.67 (219 octets) ;; HEADER SECTION ;; id = 37695 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 104.72.121.91 nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. sz/hAYEJ0AGzmJl1pY8jhkrb6bJaysTE1WkZE7RvY6PmWO1yCRNvqz2NtztSeDiV5iskctWt4XTe 0To4We4Np0kBvOxL+bcrrrRAVbTTbhqAjSVayfuaIc7m9Tz8ks1Cy+OA1dx+NW96NrY63k4ucBqB EGxkC5tbDYbt7DPHzwc= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	nsa.gov A RR has value 104.72.121.91
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. sz/hAYEJ0AGzmJl1pY8jhkrb6bJaysTE1WkZE7RvY6PmWO1yCRNvqz2NtztSeDiV5iskctWt4XTe 0To4We4Np0kBvOxL+bcrrrRAVbTTbhqAjSVayfuaIc7m9Tz8ks1Cy+OA1dx+NW96NrY63k4ucBqB EGxkC5tbDYbt7DPHzwc= )`
	RRSIG=63144 and DNSKEY=63144 verifies the A RRset

nsa.gov

	Query to a2-64.akam.net for nsa.gov/A
	Received 219 bytes from 95.100.174.64
	;; Response received from 95.100.174.64 (219 octets) ;; HEADER SECTION ;; id = 34600 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 104.81.81.147 nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. PjnHespCt0kZt2vTFQjj1pnOk6Z5r34ws/aP3zEn96kGKpb/qHuwhqRjcHyH/AgF0/HXMq8d1WyE ps6IeOjMUbWOxNlloqcRm4FMGBPNJ6sF7lhjxz+Lc8CBdfhN9abgP2EtHZhso+YzrcjWrpDkUquw 8ETmeY8pZBeN1ANlXTA= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	a2-64.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a2-64.akam.net for nsa.gov/A
	Received 219 bytes from 95.100.174.64
	;; Response received from 95.100.174.64 (219 octets) ;; HEADER SECTION ;; id = 21629 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 104.81.81.147 nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. PjnHespCt0kZt2vTFQjj1pnOk6Z5r34ws/aP3zEn96kGKpb/qHuwhqRjcHyH/AgF0/HXMq8d1WyE ps6IeOjMUbWOxNlloqcRm4FMGBPNJ6sF7lhjxz+Lc8CBdfhN9abgP2EtHZhso+YzrcjWrpDkUquw 8ETmeY8pZBeN1ANlXTA= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	nsa.gov A RR has value 104.81.81.147
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. PjnHespCt0kZt2vTFQjj1pnOk6Z5r34ws/aP3zEn96kGKpb/qHuwhqRjcHyH/AgF0/HXMq8d1WyE ps6IeOjMUbWOxNlloqcRm4FMGBPNJ6sF7lhjxz+Lc8CBdfhN9abgP2EtHZhso+YzrcjWrpDkUquw 8ETmeY8pZBeN1ANlXTA= )`
	RRSIG=63144 and DNSKEY=63144 verifies the A RRset

nsa.gov

	Query to a5-66.akam.net for nsa.gov/A
	Received 219 bytes from 95.100.168.66
	;; Response received from 95.100.168.66 (219 octets) ;; HEADER SECTION ;; id = 34857 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.79.214.214 nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. 5T4MerSGvzpmkCvhqHDY8NAo9OzR/+vgKeMMdU6pki2dO5Asvudg+wz8i5JzoFSIhEFhXPyEmsdI C4iQPiAzbx2zHmsGrGXGXmWAHSAwzcHRe+RWPdgkzk+hWGnWZlEOxcmeC2w9qV64b6bt/BfRMZhK zvzlhUctvRN4DDrVrbo= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	a5-66.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a5-66.akam.net for nsa.gov/A
	Received 219 bytes from 95.100.168.66
	;; Response received from 95.100.168.66 (219 octets) ;; HEADER SECTION ;; id = 54135 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.79.214.214 nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. 5T4MerSGvzpmkCvhqHDY8NAo9OzR/+vgKeMMdU6pki2dO5Asvudg+wz8i5JzoFSIhEFhXPyEmsdI C4iQPiAzbx2zHmsGrGXGXmWAHSAwzcHRe+RWPdgkzk+hWGnWZlEOxcmeC2w9qV64b6bt/BfRMZhK zvzlhUctvRN4DDrVrbo= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	nsa.gov A RR has value 23.79.214.214
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. 5T4MerSGvzpmkCvhqHDY8NAo9OzR/+vgKeMMdU6pki2dO5Asvudg+wz8i5JzoFSIhEFhXPyEmsdI C4iQPiAzbx2zHmsGrGXGXmWAHSAwzcHRe+RWPdgkzk+hWGnWZlEOxcmeC2w9qV64b6bt/BfRMZhK zvzlhUctvRN4DDrVrbo= )`
	RRSIG=63144 and DNSKEY=63144 verifies the A RRset

nsa.gov

	Query to a1-107.akam.net for nsa.gov/A
	Received 219 bytes from 193.108.91.107
	;; Response received from 193.108.91.107 (219 octets) ;; HEADER SECTION ;; id = 9516 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 125.56.151.39 nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. qPQEV1mjscQr3V9K3TliJjQjziFp26axlB7/nvci76a2uAmdiM8pRt7mWg99khGmnIkalKiC1Lqu 5HOHzf7tGe+SvFqWGrJSMeK3MVFN5vKOY+eAqkx83y/D8ZkThVkh7N7GLpeaJg6FAW+HpwHLLz95 V30B5nhyqtyTDiGBvo0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	a1-107.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a1-107.akam.net for nsa.gov/A
	Received 219 bytes from 193.108.91.107
	;; Response received from 193.108.91.107 (219 octets) ;; HEADER SECTION ;; id = 14197 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 184.28.197.135 nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. iUIy3pGjUethQM9bruYdCcuzuhj8oK0yKw92rmXMm3AxDJYlKFkPfbcQB0bO13EdcSJC5ZvbQVlR LIpXvmPP9+bjnVNQK5OSW3bPXl0iffYNEijidd+jKmsae9W/5XQLMVyCe4is2yVnP93+bOzoWER9 tnu5YsEI20oElxyaEJ0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	nsa.gov A RR has value 184.28.197.135
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20230201074207 20230129064207 63144 nsa.gov. iUIy3pGjUethQM9bruYdCcuzuhj8oK0yKw92rmXMm3AxDJYlKFkPfbcQB0bO13EdcSJC5ZvbQVlR LIpXvmPP9+bjnVNQK5OSW3bPXl0iffYNEijidd+jKmsae9W/5XQLMVyCe4is2yVnP93+bOzoWER9 tnu5YsEI20oElxyaEJ0= )`
	RRSIG=63144 and DNSKEY=63144 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test nsa.gov at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: