DNSSEC Debugger

Domain Name:

Time: 2025-12-29 22:39:43 UTC

Analyzing DNSSEC problems for nsa.gov

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to a.root-servers.net for ./DNSKEY
	Received 1414 bytes from 198.41.0.4
	;; Response received from [198.41.0.4] 1414 octets ;; HEADER SECTION ;; id = 17555 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 5 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (5 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAeuS7hMRZ7muj1c/ew2DoavxkBw3jUG5R79pKVDI39fxvlD1HfJYGJERnXuV4SrQfUPzWw/l t5Axb0EqXL/sQ2ZyntVmwQwoSXi2l9smlIKh2UrkTmmozRCPe7GS4fZTE4Ew7AV4YprTLgVmxiGP 4unRuXkYOgQJXCIBpVCmEdUli6X2sm0i5ZilU/Q+rX3RDw+eYPP7K0cJnJ+ZnvQDy14+BFtreWl9 enNQljgGpBp26lEp1z7AbvUfzkQNVCVGaM8jEaCSALXiROlwCQMOdj+tpLXFf99kdJnTQw2cpEr1 uGs/yENAJpoGhbjZAoIkXzDUBSlfFeYz7FWzH6gIe7M= ) ; keytag 61809 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 256 3 8 AwEAAbNTVC2+pry4pc37pZI9Oj6b8FHxT3VGrvSPKLE1Tjyfe2kUZUtVX5xrv6AV4BVO+ygrYjGZ MNgEnbLU4zknnlnhI2e0g6iTza1aZh0dRZXGH16C1NUNq1CxBkUhIYQhQDeIOtLacx+RmFTc+hSH JJ2MJ79IS00kA7eKi6mofQ7SPJmdJVjI+JAx791y0f5QaB+iHGANU53FwiYXNUQjfAzCrtOaSevG sx8SO8BTaXLAjFq5eewOtwScVwfVDhEXlvpE6e+mIncwhNKaMRD9IPuHENqCNPI5MjxfAMVS6cEY 8eEozIkv/vHc+0Auu3n+Fcx6F2Js4KPXaHEShAXugfU= ) ; keytag 21831 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20260110000000 20251220000000 20326 . RZO5FQjtg6Yk0Dara521nCUfYnQxCLAVdbC+buKQVAKlHsZ6srxXHNAL8DMoHohT+PyIlPFAQMb5 fBZatrDaqxpZZ/YbC0A2zxGxOwuOPb1xRbqi6E3zSKfilTRuAux5jN0KYbZZhFxda62e9Hv+2GJs MLixTpiV3RVXtxENI2GPRA8mRRJPBDR7XVQF/2Pz+vjcAW07dp27CrNmQPyZtVjSgw49Jz1rSsAm +EEKO6C7KLG5hmENQr165D3YjMWCs93YhTY8bhWYVqeDtsB1BwoEWkMqSFs4I4+uMd14BHvO6mlq zOZyWC+3kXYTpoAlE0kFhKNv1i54wgHRB+paqw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 4 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAeuS7hMRZ7muj1c/ew2DoavxkBw3jUG5R79pKVDI39fxvlD1HfJYGJERnXuV4SrQfUPzWw/l t5Axb0EqXL/sQ2ZyntVmwQwoSXi2l9smlIKh2UrkTmmozRCPe7GS4fZTE4Ew7AV4YprTLgVmxiGP 4unRuXkYOgQJXCIBpVCmEdUli6X2sm0i5ZilU/Q+rX3RDw+eYPP7K0cJnJ+ZnvQDy14+BFtreWl9 enNQljgGpBp26lEp1z7AbvUfzkQNVCVGaM8jEaCSALXiROlwCQMOdj+tpLXFf99kdJnTQw2cpEr1 uGs/yENAJpoGhbjZAoIkXzDUBSlfFeYz7FWzH6gIe7M= ) ; keytag 61809`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbNTVC2+pry4pc37pZI9Oj6b8FHxT3VGrvSPKLE1Tjyfe2kUZUtVX5xrv6AV4BVO+ygrYjGZ MNgEnbLU4zknnlnhI2e0g6iTza1aZh0dRZXGH16C1NUNq1CxBkUhIYQhQDeIOtLacx+RmFTc+hSH JJ2MJ79IS00kA7eKi6mofQ7SPJmdJVjI+JAx791y0f5QaB+iHGANU53FwiYXNUQjfAzCrtOaSevG sx8SO8BTaXLAjFq5eewOtwScVwfVDhEXlvpE6e+mIncwhNKaMRD9IPuHENqCNPI5MjxfAMVS6cEY 8eEozIkv/vHc+0Auu3n+Fcx6F2Js4KPXaHEShAXugfU= ) ; keytag 21831`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20260110000000 20251220000000 20326 . RZO5FQjtg6Yk0Dara521nCUfYnQxCLAVdbC+buKQVAKlHsZ6srxXHNAL8DMoHohT+PyIlPFAQMb5 fBZatrDaqxpZZ/YbC0A2zxGxOwuOPb1xRbqi6E3zSKfilTRuAux5jN0KYbZZhFxda62e9Hv+2GJs MLixTpiV3RVXtxENI2GPRA8mRRJPBDR7XVQF/2Pz+vjcAW07dp27CrNmQPyZtVjSgw49Jz1rSsAm +EEKO6C7KLG5hmENQr165D3YjMWCs93YhTY8bhWYVqeDtsB1BwoEWkMqSFs4I4+uMd14BHvO6mlq zOZyWC+3kXYTpoAlE0kFhKNv1i54wgHRB+paqw== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=61809 is now in the chain-of-trust
	DNSKEY=21831 is now in the chain-of-trust
	DNSKEY=38696/SEP is now in the chain-of-trust
	Query to f.root-servers.net for nsa.gov/A
	Received 614 bytes from 192.5.5.241
	;; Response received from [192.5.5.241] 614 octets ;; HEADER SECTION ;; id = 19862 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20260111170000 20251229160000 61809 . t6SuunQAdUk8996nvNS88eN4Io3/8U8v3n5hLSTYmAme2s/cvOWz0heR8mXCtSwUEcyO56zE3BMq VhQYcPWatb9pnfdtTZUJ+ttnPFa0BkQSuPr2MtOVaOFV6UYhsPNiRIV0fBSyrQ56JOepo6dLh8or KnbmkhF/7Bnq/Y23XvtNmLV7jTc08IASj6uID7AcI9nmL/KtUJ5+VSpagGP9euKg1x904oQNOCey qCMrJnxl3b2CeyLXSWgdXLn9fdLjp+Sr6FAIwch/SOcNAjZcsxgUdOgeZ9UsogJhH2cp7dQpdpAK a1jvTTOVS8qJRBZDFgrsEK1RLzt9OKw7yeV/Ig== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN A 199.33.231.1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN A 199.33.232.1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN A 199.33.233.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Query to j.root-servers.net for gov/DNSKEY
	Received 610 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 610 octets ;; HEADER SECTION ;; id = 12254 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20260111170000 20251229160000 61809 . t6SuunQAdUk8996nvNS88eN4Io3/8U8v3n5hLSTYmAme2s/cvOWz0heR8mXCtSwUEcyO56zE3BMq VhQYcPWatb9pnfdtTZUJ+ttnPFa0BkQSuPr2MtOVaOFV6UYhsPNiRIV0fBSyrQ56JOepo6dLh8or KnbmkhF/7Bnq/Y23XvtNmLV7jTc08IASj6uID7AcI9nmL/KtUJ5+VSpagGP9euKg1x904oQNOCey qCMrJnxl3b2CeyLXSWgdXLn9fdLjp+Sr6FAIwch/SOcNAjZcsxgUdOgeZ9UsogJhH2cp7dQpdpAK a1jvTTOVS8qJRBZDFgrsEK1RLzt9OKw7yeV/Ig== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 b.ns.gov. 172800 IN A 199.33.231.1 c.ns.gov. 172800 IN A 199.33.232.1 d.ns.gov. 172800 IN A 199.33.233.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Found child zone gov

gov

	Checking DS between . and gov
	Query to g.root-servers.net for gov/DS
	Received 367 bytes from 192.112.36.4
	;; Response received from [192.112.36.4] 367 octets ;; HEADER SECTION ;; id = 18808 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20260111170000 20251229160000 61809 . t6SuunQAdUk8996nvNS88eN4Io3/8U8v3n5hLSTYmAme2s/cvOWz0heR8mXCtSwUEcyO56zE3BMq VhQYcPWatb9pnfdtTZUJ+ttnPFa0BkQSuPr2MtOVaOFV6UYhsPNiRIV0fBSyrQ56JOepo6dLh8or KnbmkhF/7Bnq/Y23XvtNmLV7jTc08IASj6uID7AcI9nmL/KtUJ5+VSpagGP9euKg1x904oQNOCey qCMrJnxl3b2CeyLXSWgdXLn9fdLjp+Sr6FAIwch/SOcNAjZcsxgUdOgeZ9UsogJhH2cp7dQpdpAK a1jvTTOVS8qJRBZDFgrsEK1RLzt9OKw7yeV/Ig== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for gov in the . zone
	DS=2536/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20260111170000 20251229160000 61809 . t6SuunQAdUk8996nvNS88eN4Io3/8U8v3n5hLSTYmAme2s/cvOWz0heR8mXCtSwUEcyO56zE3BMq VhQYcPWatb9pnfdtTZUJ+ttnPFa0BkQSuPr2MtOVaOFV6UYhsPNiRIV0fBSyrQ56JOepo6dLh8or KnbmkhF/7Bnq/Y23XvtNmLV7jTc08IASj6uID7AcI9nmL/KtUJ5+VSpagGP9euKg1x904oQNOCey qCMrJnxl3b2CeyLXSWgdXLn9fdLjp+Sr6FAIwch/SOcNAjZcsxgUdOgeZ9UsogJhH2cp7dQpdpAK a1jvTTOVS8qJRBZDFgrsEK1RLzt9OKw7yeV/Ig== )`
	RRSIG=61809 and DNSKEY=61809 verifies the DS RRset
	DS=2536/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 )`
	Query to d.ns.gov for gov/DNSKEY
	Received 291 bytes from 199.33.233.1
	;; Response received from [199.33.233.1] 291 octets ;; HEADER SECTION ;; id = 35571 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536 gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496 gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20260205110617 20251206110617 2536 gov. nZHIPZZ3z80AAkg8IDRVDprfpie4C0q93y05w0bzGd/fdwD8ocNWH6iMFuJ1B13pIaERw0TJTBOo cbM9gLWhNQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for gov
	`gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536`
	`gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496`
	DNSKEY=2536/SEP is now in the chain-of-trust
	DS=2536/SHA-256 verifies DNSKEY=2536/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20260205110617 20251206110617 2536 gov. nZHIPZZ3z80AAkg8IDRVDprfpie4C0q93y05w0bzGd/fdwD8ocNWH6iMFuJ1B13pIaERw0TJTBOo cbM9gLWhNQ== )`
	RRSIG=2536 and DNSKEY=2536/SEP verifies the DNSKEY RRset
	DNSKEY=35496 is now in the chain-of-trust
	Query to c.ns.gov for nsa.gov/A
	Received 315 bytes from 199.33.232.1
	;; Response received from [199.33.232.1] 315 octets ;; HEADER SECTION ;; id = 13693 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) nsa.gov. 10800 IN NS a1-107.akam.net. nsa.gov. 10800 IN NS a11-66.akam.net. nsa.gov. 10800 IN NS a12-67.akam.net. nsa.gov. 10800 IN NS a2-64.akam.net. nsa.gov. 10800 IN NS a24-65.akam.net. nsa.gov. 10800 IN NS a5-66.akam.net. nsa.gov. 3600 IN DS ( 29356 7 2 17c346b94be3bda883bc22d195b3a8aa4ccdadfc43b26b5c659d70af58e8fd5c ) nsa.gov. 3600 IN RRSIG ( DS 13 2 3600 20251230233944 20251228213944 35496 gov. CGbCpCyAKHHZqpR7K8ZjNHrvKHNjRPOtgpyyio0KT777vcMY0W3iuFiz+xky2WXm04lcgFjeVVYT kPhixnY8eQ== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a.ns.gov for nsa.gov/DNSKEY
	Received 315 bytes from 199.33.230.1
	;; Response received from [199.33.230.1] 315 octets ;; HEADER SECTION ;; id = 41079 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) nsa.gov. 10800 IN NS a1-107.akam.net. nsa.gov. 10800 IN NS a11-66.akam.net. nsa.gov. 10800 IN NS a12-67.akam.net. nsa.gov. 10800 IN NS a2-64.akam.net. nsa.gov. 10800 IN NS a24-65.akam.net. nsa.gov. 10800 IN NS a5-66.akam.net. nsa.gov. 3600 IN DS ( 29356 7 2 17c346b94be3bda883bc22d195b3a8aa4ccdadfc43b26b5c659d70af58e8fd5c ) nsa.gov. 3600 IN RRSIG ( DS 13 2 3600 20251230233944 20251228213944 35496 gov. Eo0YlpD05ierIrYwdc2Af5nRwl2rP3MYhZseBr+qzsE7YdpDZOcPh1p33eJ1AIbinlk0fYowMFq5 9gbciOYcqw== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone nsa.gov

nsa.gov

	Checking DS between gov and nsa.gov
	Query to a.ns.gov for nsa.gov/DS
	Received 183 bytes from 199.33.230.1
	;; Response received from [199.33.230.1] 183 octets ;; HEADER SECTION ;; id = 27805 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN DS ;; ANSWER SECTION (2 records) nsa.gov. 3600 IN DS ( 29356 7 2 17c346b94be3bda883bc22d195b3a8aa4ccdadfc43b26b5c659d70af58e8fd5c ) nsa.gov. 3600 IN RRSIG ( DS 13 2 3600 20251230233944 20251228213944 35496 gov. E6KQOB6KiCGXzRsQrRYDD0SICW70LLKUNWJ38t4AMRQcJ8J/Hnuk8TFjPT0oxf3SnhvprS60vtyf T/WvYBMTzQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for nsa.gov in the gov zone
	DS=29356/SHA-256 has algorithm RSASHA1-NSEC3-SHA1
	Found 1 RRSIGs over DS RRset
	`nsa.gov. 3600 IN RRSIG ( DS 13 2 3600 20251230233944 20251228213944 35496 gov. E6KQOB6KiCGXzRsQrRYDD0SICW70LLKUNWJ38t4AMRQcJ8J/Hnuk8TFjPT0oxf3SnhvprS60vtyf T/WvYBMTzQ== )`
	RRSIG=35496 and DNSKEY=35496 verifies the DS RRset
	DS=29356/SHA-256 is now in the chain-of-trust
	`nsa.gov. 3600 IN DS ( 29356 7 2 17c346b94be3bda883bc22d195b3a8aa4ccdadfc43b26b5c659d70af58e8fd5c )`
	Query to a5-66.akam.net for nsa.gov/DNSKEY
	Received 1474 bytes from 95.100.168.66
	;; Response received from [95.100.168.66] 1474 octets ;; HEADER SECTION ;; id = 24325 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 6 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN DNSKEY ;; ANSWER SECTION (6 records) nsa.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAcPVTXOhFOgCQ4JIXQdqDfXM00WmkRLVx6hQgBvXVOlpItVIrhxNXApgOWpfSKI+/3/Ylbqy 3T+z0zArccTWvvjPL/zyObKdqwcR3a03wNFcjNkarslYVhNNuHTcmtjTiG1iL4MFV3TJJpcy1Gkh wsddSL8VxrLy55jVztbg9Mmr ) ; keytag 29625 nsa.gov. 7200 IN DNSKEY ( 257 3 7 AwEAAa0pWI7x1Fx3GA/XHkPWANn22SvPfuk7Zl2AN4jiRGx/U43iC9RxGZ6xjnNKNnjFLaiXKQIr MVqvOZ+/E82db+jpSQo+NCY1EHobZw8s8lJJkS8ialfpTxIicRv9DAhQpdj+npsJFTS2aP+4xrHt Z4hrlfdd8xcOQhFzBmKHlZAQ+HpKC5u1rZ3q5jzAFCItz+zvNdh4GJ1ACtwAlx8dyH0e7xP4kWbe qyVfONYhUT48GGWBI7y7mSE+ikeb/2sftGzBWNR8Nv/qbNSR3/2l/aHQoBwZ6aemaCNyPWPPl8Qa UiCnMaIQL1zHuxrF2vqaZuZeTQua6XTUTB/UQQe5S5c= ) ; keytag 62806 nsa.gov. 7200 IN DNSKEY ( 257 3 7 AwEAAaPv7ik8k0CD/1j0ODb4jdOMXVXyX6BJdXnIISp+LZPXrTdRgGSNzKIoF8sSvEuVvI1W3fCG Z/l0EpVbIEVOMUEduZ7St+wTW1jPpda9VsB8rrsacc6/nZTTEWy+GNzjB1GL02GrwV3ENYUAZZWR fgXikZmYlOFWtz46Li25a1xDZgTAfdIy7T26suRiauyonWeQ9NtVNJ3xuV2uwV24/4osxAzxw7yB d5eJ1CMVGuZkt7+umA2zJVCfdWL9ywQwszazF6mEDdj6SA79XdepdiLs9RLMOUuGeh1rjNUgM4jI PrqN6k9K/OVvApDZlQj4hOC82c/iN5Q7sCFm6KOHQY0= ) ; keytag 29356 nsa.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAaAbpLUdHDn4fE4poa+vBcucL7lH34uUhZIamndIuM7HacfKBjhsBJN2kNGal+bx8zEeiO+f R4mgr5Q2Z6EuTBU/bsFPTIeXo0Qaqko/FFzNehnBHi1nur2k9cw9to1stwIuHTnLUoh3RUx4CyfN TdlYK8HsjSF/nXJQb0Y7Btf/ ) ; keytag 60837 nsa.gov. 7200 IN RRSIG ( DNSKEY 7 2 7200 20260101074711 20251229064711 29356 nsa.gov. UQ2IGu3LerggGjiuLF4Aa4U2CTsMbhL+LsC1hmPcg4RiVDGEE5x/l/vojNnHYVuYhvM3zZAhkc8H 2N9KKjDIbLv5v1ZDMiMvyMPkPutiePDnOrI761r7K4LaUI1TKJ/vQZflDzzuBNIcyneWnh/vJFTA Nr/WWe16gXojeUx9To5rCWiUfwFL3hojYgNnKqrPbn1Bl9+JcmvI97BMonxMwdFDL5QI+nhDRc+i g0unIxiIpi6BIhhJdHShOtfraFbgbQrWH36kUA189LIxjPY/ur5ZkkAPctoWo9X8jzCUfIpJ6OTt zyic2F3fUxLt9NLUxg5/2VNlNd+AdJ39Sd9u5A== ) nsa.gov. 7200 IN RRSIG ( DNSKEY 7 2 7200 20260101074711 20251229064711 62806 nsa.gov. L+rfoxxRMLpLUmeGylKZrkSbMkam7ZQMcoyCt/pRzWfSt4G5MzEDtypOhXARhEpaweEsqISseISF BU2Iw4y955EeetlLCehzB4PS2Yux9+gufQxxyAWbKuud2fMjGUP5ZUE48392v4cdif/YQPRdVBmP mmRN7SMLxNwqoWTdFGMH681Hm8yFTYbXhncdtQIIGfYmQB0Cqgd/4W7Tp64aAYSb60bmCHRP39tV SbaleTTs6F4tiZjWe73Gw0hKp7slBLBdDEUUxJN0dxweJTRZTbExZbA0vmCKlm7BFPujRJ4pMrVA Nd6ubcEmBI7z86Mee4eLzyqRkavOcbgYyoMHYw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 4 DNSKEY records for nsa.gov
	`nsa.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAcPVTXOhFOgCQ4JIXQdqDfXM00WmkRLVx6hQgBvXVOlpItVIrhxNXApgOWpfSKI+/3/Ylbqy 3T+z0zArccTWvvjPL/zyObKdqwcR3a03wNFcjNkarslYVhNNuHTcmtjTiG1iL4MFV3TJJpcy1Gkh wsddSL8VxrLy55jVztbg9Mmr ) ; keytag 29625`
	`nsa.gov. 7200 IN DNSKEY ( 257 3 7 AwEAAa0pWI7x1Fx3GA/XHkPWANn22SvPfuk7Zl2AN4jiRGx/U43iC9RxGZ6xjnNKNnjFLaiXKQIr MVqvOZ+/E82db+jpSQo+NCY1EHobZw8s8lJJkS8ialfpTxIicRv9DAhQpdj+npsJFTS2aP+4xrHt Z4hrlfdd8xcOQhFzBmKHlZAQ+HpKC5u1rZ3q5jzAFCItz+zvNdh4GJ1ACtwAlx8dyH0e7xP4kWbe qyVfONYhUT48GGWBI7y7mSE+ikeb/2sftGzBWNR8Nv/qbNSR3/2l/aHQoBwZ6aemaCNyPWPPl8Qa UiCnMaIQL1zHuxrF2vqaZuZeTQua6XTUTB/UQQe5S5c= ) ; keytag 62806`
	`nsa.gov. 7200 IN DNSKEY ( 257 3 7 AwEAAaPv7ik8k0CD/1j0ODb4jdOMXVXyX6BJdXnIISp+LZPXrTdRgGSNzKIoF8sSvEuVvI1W3fCG Z/l0EpVbIEVOMUEduZ7St+wTW1jPpda9VsB8rrsacc6/nZTTEWy+GNzjB1GL02GrwV3ENYUAZZWR fgXikZmYlOFWtz46Li25a1xDZgTAfdIy7T26suRiauyonWeQ9NtVNJ3xuV2uwV24/4osxAzxw7yB d5eJ1CMVGuZkt7+umA2zJVCfdWL9ywQwszazF6mEDdj6SA79XdepdiLs9RLMOUuGeh1rjNUgM4jI PrqN6k9K/OVvApDZlQj4hOC82c/iN5Q7sCFm6KOHQY0= ) ; keytag 29356`
	`nsa.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAaAbpLUdHDn4fE4poa+vBcucL7lH34uUhZIamndIuM7HacfKBjhsBJN2kNGal+bx8zEeiO+f R4mgr5Q2Z6EuTBU/bsFPTIeXo0Qaqko/FFzNehnBHi1nur2k9cw9to1stwIuHTnLUoh3RUx4CyfN TdlYK8HsjSF/nXJQb0Y7Btf/ ) ; keytag 60837`
	DNSKEY=29356/SEP is now in the chain-of-trust
	DS=29356/SHA-256 verifies DNSKEY=29356/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`nsa.gov. 7200 IN RRSIG ( DNSKEY 7 2 7200 20260101074711 20251229064711 29356 nsa.gov. UQ2IGu3LerggGjiuLF4Aa4U2CTsMbhL+LsC1hmPcg4RiVDGEE5x/l/vojNnHYVuYhvM3zZAhkc8H 2N9KKjDIbLv5v1ZDMiMvyMPkPutiePDnOrI761r7K4LaUI1TKJ/vQZflDzzuBNIcyneWnh/vJFTA Nr/WWe16gXojeUx9To5rCWiUfwFL3hojYgNnKqrPbn1Bl9+JcmvI97BMonxMwdFDL5QI+nhDRc+i g0unIxiIpi6BIhhJdHShOtfraFbgbQrWH36kUA189LIxjPY/ur5ZkkAPctoWo9X8jzCUfIpJ6OTt zyic2F3fUxLt9NLUxg5/2VNlNd+AdJ39Sd9u5A== )`
	`nsa.gov. 7200 IN RRSIG ( DNSKEY 7 2 7200 20260101074711 20251229064711 62806 nsa.gov. L+rfoxxRMLpLUmeGylKZrkSbMkam7ZQMcoyCt/pRzWfSt4G5MzEDtypOhXARhEpaweEsqISseISF BU2Iw4y955EeetlLCehzB4PS2Yux9+gufQxxyAWbKuud2fMjGUP5ZUE48392v4cdif/YQPRdVBmP mmRN7SMLxNwqoWTdFGMH681Hm8yFTYbXhncdtQIIGfYmQB0Cqgd/4W7Tp64aAYSb60bmCHRP39tV SbaleTTs6F4tiZjWe73Gw0hKp7slBLBdDEUUxJN0dxweJTRZTbExZbA0vmCKlm7BFPujRJ4pMrVA Nd6ubcEmBI7z86Mee4eLzyqRkavOcbgYyoMHYw== )`
	RRSIG=29356 and DNSKEY=29356/SEP verifies the DNSKEY RRset
	RRSIG=62806 and DNSKEY=62806/SEP verifies the DNSKEY RRset
	DNSKEY=29625 is now in the chain-of-trust
	DNSKEY=62806/SEP is now in the chain-of-trust
	DNSKEY=60837 is now in the chain-of-trust
	Query to a11-66.akam.net for nsa.gov/A
	Received 219 bytes from 84.53.139.66
	;; Response received from [84.53.139.66] 219 octets ;; HEADER SECTION ;; id = 17278 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.221.109.153 nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. KhcQoXSA/WQ28GDNMy4qnqoUguCZyAtRRPFdUCYKB/zmT0HCSYl4lnyL2l1GCgryl8b7ecL7bYUm XXCIUdUrKDcfKLesPBsJU2cRwSkwhnBEfAcCTL0JijBSCNHiU8oDyHlPv56RQK/vgmFROyL0Jg+D wY71ZWGpbpMFToV73uk= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a11-66.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a1-107.akam.net for nsa.gov/SOA
	Received 563 bytes from 193.108.91.107
	;; Response received from [193.108.91.107] 563 octets ;; HEADER SECTION ;; id = 24624 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( w000-dsid-u05.nsa.gov. hostmaster.nsa.gov. 2025050615 ;serial 3600 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20260101074711 20251229064711 60837 nsa.gov. kEWmCcO2eeyreEJ8URJpQiEvkTTs51mGeQ4jY6M/6sJS/crweUyW3jRUJuM/HvsliWsLYNWGfs/8 8jXSOoYekFyjcMY/GMk2fGhDORsL5XIw5Pz0x7HQTI8ohEEjcik3QkeLu1rsKdBb/xjQEdVvntVX WKN2YhJ8T+Q5ROrfTWA= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20260101074711 20251229064711 60837 nsa.gov. Q9l5D6EAHB1LcxAJlsWIHGuh+5oZ6dkevBqNQ0ILZVAf4pUfMEUrfW/yPrqUZ8iynk+O8r/IPszC GPzs9r/lEwIXLgvl5cy2wErQ5BX8jTFOEfN3+jRZIR1pxhp5AlvsEQ2FcTxj0IyeX6umGkVlmx4+ 81QG9Y7LKbyKe9dugW4= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a24-65.akam.net for nsa.gov/SOA
	Received 563 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 563 octets ;; HEADER SECTION ;; id = 20545 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( w000-dsid-u05.nsa.gov. hostmaster.nsa.gov. 2025050615 ;serial 3600 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20260101074711 20251229064711 60837 nsa.gov. kEWmCcO2eeyreEJ8URJpQiEvkTTs51mGeQ4jY6M/6sJS/crweUyW3jRUJuM/HvsliWsLYNWGfs/8 8jXSOoYekFyjcMY/GMk2fGhDORsL5XIw5Pz0x7HQTI8ohEEjcik3QkeLu1rsKdBb/xjQEdVvntVX WKN2YhJ8T+Q5ROrfTWA= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20260101074711 20251229064711 60837 nsa.gov. Q9l5D6EAHB1LcxAJlsWIHGuh+5oZ6dkevBqNQ0ILZVAf4pUfMEUrfW/yPrqUZ8iynk+O8r/IPszC GPzs9r/lEwIXLgvl5cy2wErQ5BX8jTFOEfN3+jRZIR1pxhp5AlvsEQ2FcTxj0IyeX6umGkVlmx4+ 81QG9Y7LKbyKe9dugW4= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a12-67.akam.net for nsa.gov/SOA
	Received 563 bytes from 184.26.160.67
	;; Response received from [184.26.160.67] 563 octets ;; HEADER SECTION ;; id = 42482 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( w000-dsid-u05.nsa.gov. hostmaster.nsa.gov. 2025050615 ;serial 3600 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20260101074711 20251229064711 60837 nsa.gov. kEWmCcO2eeyreEJ8URJpQiEvkTTs51mGeQ4jY6M/6sJS/crweUyW3jRUJuM/HvsliWsLYNWGfs/8 8jXSOoYekFyjcMY/GMk2fGhDORsL5XIw5Pz0x7HQTI8ohEEjcik3QkeLu1rsKdBb/xjQEdVvntVX WKN2YhJ8T+Q5ROrfTWA= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20260101074711 20251229064711 60837 nsa.gov. Q9l5D6EAHB1LcxAJlsWIHGuh+5oZ6dkevBqNQ0ILZVAf4pUfMEUrfW/yPrqUZ8iynk+O8r/IPszC GPzs9r/lEwIXLgvl5cy2wErQ5BX8jTFOEfN3+jRZIR1pxhp5AlvsEQ2FcTxj0IyeX6umGkVlmx4+ 81QG9Y7LKbyKe9dugW4= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a2-64.akam.net for nsa.gov/SOA
	Received 563 bytes from 95.100.174.64
	;; Response received from [95.100.174.64] 563 octets ;; HEADER SECTION ;; id = 14963 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( w000-dsid-u05.nsa.gov. hostmaster.nsa.gov. 2025050615 ;serial 3600 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20260101074711 20251229064711 60837 nsa.gov. kEWmCcO2eeyreEJ8URJpQiEvkTTs51mGeQ4jY6M/6sJS/crweUyW3jRUJuM/HvsliWsLYNWGfs/8 8jXSOoYekFyjcMY/GMk2fGhDORsL5XIw5Pz0x7HQTI8ohEEjcik3QkeLu1rsKdBb/xjQEdVvntVX WKN2YhJ8T+Q5ROrfTWA= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20260101074711 20251229064711 60837 nsa.gov. Q9l5D6EAHB1LcxAJlsWIHGuh+5oZ6dkevBqNQ0ILZVAf4pUfMEUrfW/yPrqUZ8iynk+O8r/IPszC GPzs9r/lEwIXLgvl5cy2wErQ5BX8jTFOEfN3+jRZIR1pxhp5AlvsEQ2FcTxj0IyeX6umGkVlmx4+ 81QG9Y7LKbyKe9dugW4= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a5-66.akam.net for nsa.gov/SOA
	Received 563 bytes from 95.100.168.66
	;; Response received from [95.100.168.66] 563 octets ;; HEADER SECTION ;; id = 49437 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( w000-dsid-u05.nsa.gov. hostmaster.nsa.gov. 2025050615 ;serial 3600 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20260101074711 20251229064711 60837 nsa.gov. kEWmCcO2eeyreEJ8URJpQiEvkTTs51mGeQ4jY6M/6sJS/crweUyW3jRUJuM/HvsliWsLYNWGfs/8 8jXSOoYekFyjcMY/GMk2fGhDORsL5XIw5Pz0x7HQTI8ohEEjcik3QkeLu1rsKdBb/xjQEdVvntVX WKN2YhJ8T+Q5ROrfTWA= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20260101074711 20251229064711 60837 nsa.gov. Q9l5D6EAHB1LcxAJlsWIHGuh+5oZ6dkevBqNQ0ILZVAf4pUfMEUrfW/yPrqUZ8iynk+O8r/IPszC GPzs9r/lEwIXLgvl5cy2wErQ5BX8jTFOEfN3+jRZIR1pxhp5AlvsEQ2FcTxj0IyeX6umGkVlmx4+ 81QG9Y7LKbyKe9dugW4= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a11-66.akam.net for nsa.gov/A
	Received 219 bytes from 84.53.139.66
	;; Response received from [84.53.139.66] 219 octets ;; HEADER SECTION ;; id = 48504 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.221.109.153 nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. KhcQoXSA/WQ28GDNMy4qnqoUguCZyAtRRPFdUCYKB/zmT0HCSYl4lnyL2l1GCgryl8b7ecL7bYUm XXCIUdUrKDcfKLesPBsJU2cRwSkwhnBEfAcCTL0JijBSCNHiU8oDyHlPv56RQK/vgmFROyL0Jg+D wY71ZWGpbpMFToV73uk= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nsa.gov A RR has value 23.221.109.153
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. KhcQoXSA/WQ28GDNMy4qnqoUguCZyAtRRPFdUCYKB/zmT0HCSYl4lnyL2l1GCgryl8b7ecL7bYUm XXCIUdUrKDcfKLesPBsJU2cRwSkwhnBEfAcCTL0JijBSCNHiU8oDyHlPv56RQK/vgmFROyL0Jg+D wY71ZWGpbpMFToV73uk= )`
	RRSIG=60837 and DNSKEY=60837 verifies the A RRset

nsa.gov

	Query to a24-65.akam.net for nsa.gov/A
	Received 219 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 219 octets ;; HEADER SECTION ;; id = 39298 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 104.66.124.119 nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. ZLRe9UGeduguhGpVWaIei2IRpizbUl5C+Ctw4OHBA2qeHpOVTxCnMo24bD7sMyajQ8UwUbF0r/X5 vr1Z1aEs/kac3Q+m05iDY7+XRTrWL/lLxbhaRVfRdnAffUBqMaVLYgiV/+Hy4Z9RQJcVWZ4+ttZd Y9HMWb8xKEUO1KGau80= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a24-65.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a24-65.akam.net for nsa.gov/A
	Received 219 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 219 octets ;; HEADER SECTION ;; id = 24673 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 104.66.124.119 nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. ZLRe9UGeduguhGpVWaIei2IRpizbUl5C+Ctw4OHBA2qeHpOVTxCnMo24bD7sMyajQ8UwUbF0r/X5 vr1Z1aEs/kac3Q+m05iDY7+XRTrWL/lLxbhaRVfRdnAffUBqMaVLYgiV/+Hy4Z9RQJcVWZ4+ttZd Y9HMWb8xKEUO1KGau80= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nsa.gov A RR has value 104.66.124.119
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. ZLRe9UGeduguhGpVWaIei2IRpizbUl5C+Ctw4OHBA2qeHpOVTxCnMo24bD7sMyajQ8UwUbF0r/X5 vr1Z1aEs/kac3Q+m05iDY7+XRTrWL/lLxbhaRVfRdnAffUBqMaVLYgiV/+Hy4Z9RQJcVWZ4+ttZd Y9HMWb8xKEUO1KGau80= )`
	RRSIG=60837 and DNSKEY=60837 verifies the A RRset

nsa.gov

	Query to a2-64.akam.net for nsa.gov/A
	Received 219 bytes from 95.100.174.64
	;; Response received from [95.100.174.64] 219 octets ;; HEADER SECTION ;; id = 9358 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.202.75.119 nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. CAsGrw7163sQdWtNWa+qGQIzAtsmedTFTp2iy8Z1EKd3ccaTtwD9eGeYs+nYkjWhJ0CklreIDtkg wP2jjPJT7JA0DgT5INrjeKuAM37A34eH+D/Ul3N9wL85S8xlI3ijghe7IyIH8N7EoSm+iu3lq7fM mEbPMcqa7IODEUKUhOc= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a2-64.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a2-64.akam.net for nsa.gov/A
	Received 219 bytes from 95.100.174.64
	;; Response received from [95.100.174.64] 219 octets ;; HEADER SECTION ;; id = 29205 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.202.75.119 nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. CAsGrw7163sQdWtNWa+qGQIzAtsmedTFTp2iy8Z1EKd3ccaTtwD9eGeYs+nYkjWhJ0CklreIDtkg wP2jjPJT7JA0DgT5INrjeKuAM37A34eH+D/Ul3N9wL85S8xlI3ijghe7IyIH8N7EoSm+iu3lq7fM mEbPMcqa7IODEUKUhOc= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nsa.gov A RR has value 23.202.75.119
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. CAsGrw7163sQdWtNWa+qGQIzAtsmedTFTp2iy8Z1EKd3ccaTtwD9eGeYs+nYkjWhJ0CklreIDtkg wP2jjPJT7JA0DgT5INrjeKuAM37A34eH+D/Ul3N9wL85S8xlI3ijghe7IyIH8N7EoSm+iu3lq7fM mEbPMcqa7IODEUKUhOc= )`
	RRSIG=60837 and DNSKEY=60837 verifies the A RRset

nsa.gov

	Query to a1-107.akam.net for nsa.gov/A
	Received 219 bytes from 193.108.91.107
	;; Response received from [193.108.91.107] 219 octets ;; HEADER SECTION ;; id = 16995 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.203.237.187 nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. bVpFgrYSR/kDvoDvEW5afaSyJQ8jFc9HSbKXt7+elOcsBwU3Fho8EBi8qduVspTgrhACevpfBn6U yx9MadH3Tz5uwpLIMVDbWfRNKoJpYbnR/sXGTDnSfmWVDoNH+eV7h23AdsoRSpFzdEAlAwFJCB5o UkZlsY4/KlmPl8dVp7k= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a1-107.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a1-107.akam.net for nsa.gov/A
	Received 219 bytes from 193.108.91.107
	;; Response received from [193.108.91.107] 219 octets ;; HEADER SECTION ;; id = 46380 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.203.237.187 nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. bVpFgrYSR/kDvoDvEW5afaSyJQ8jFc9HSbKXt7+elOcsBwU3Fho8EBi8qduVspTgrhACevpfBn6U yx9MadH3Tz5uwpLIMVDbWfRNKoJpYbnR/sXGTDnSfmWVDoNH+eV7h23AdsoRSpFzdEAlAwFJCB5o UkZlsY4/KlmPl8dVp7k= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nsa.gov A RR has value 23.203.237.187
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. bVpFgrYSR/kDvoDvEW5afaSyJQ8jFc9HSbKXt7+elOcsBwU3Fho8EBi8qduVspTgrhACevpfBn6U yx9MadH3Tz5uwpLIMVDbWfRNKoJpYbnR/sXGTDnSfmWVDoNH+eV7h23AdsoRSpFzdEAlAwFJCB5o UkZlsY4/KlmPl8dVp7k= )`
	RRSIG=60837 and DNSKEY=60837 verifies the A RRset

nsa.gov

	Query to a5-66.akam.net for nsa.gov/A
	Received 219 bytes from 95.100.168.66
	;; Response received from [95.100.168.66] 219 octets ;; HEADER SECTION ;; id = 51355 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.214.246.3 nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. G0N2CfKIWLCqwyDl4zF9gMaOEGkiLqEMbcw7Fvam4/xbMDNF0wsXfrxU9bbNop+2b7jPbtql97j3 SPHnAS0BFgqXueMyaXoyL6soDlvQtYxo0lHFcUxwOyKEPSuEhlRbCdXx3Qz6zteCtlnCW5/owv1c UkxenKPsu8VhFkNv9e8= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a5-66.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a5-66.akam.net for nsa.gov/A
	Received 219 bytes from 95.100.168.66
	;; Response received from [95.100.168.66] 219 octets ;; HEADER SECTION ;; id = 51958 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.214.246.3 nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. G0N2CfKIWLCqwyDl4zF9gMaOEGkiLqEMbcw7Fvam4/xbMDNF0wsXfrxU9bbNop+2b7jPbtql97j3 SPHnAS0BFgqXueMyaXoyL6soDlvQtYxo0lHFcUxwOyKEPSuEhlRbCdXx3Qz6zteCtlnCW5/owv1c UkxenKPsu8VhFkNv9e8= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nsa.gov A RR has value 23.214.246.3
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. G0N2CfKIWLCqwyDl4zF9gMaOEGkiLqEMbcw7Fvam4/xbMDNF0wsXfrxU9bbNop+2b7jPbtql97j3 SPHnAS0BFgqXueMyaXoyL6soDlvQtYxo0lHFcUxwOyKEPSuEhlRbCdXx3Qz6zteCtlnCW5/owv1c UkxenKPsu8VhFkNv9e8= )`
	RRSIG=60837 and DNSKEY=60837 verifies the A RRset

nsa.gov

	Query to a12-67.akam.net for nsa.gov/A
	Received 219 bytes from 184.26.160.67
	;; Response received from [184.26.160.67] 219 octets ;; HEADER SECTION ;; id = 49474 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 184.27.230.2 nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. UVX1G3z9Nm3LZc5cUCjLQJwT6TM0dj1h7tVjXQ8BzrtaXTfZqaD3BTW9oJBUIm8xCHHRwD0x/MP1 uA+1tI1oX1YGGl6SBdxQxL7JWCbBt/8s+1KUeeT8TVfj3dOc1me1LzVCoJhAqkLAMrzumddszGFQ 4zcIVqDMm++qBA+A4z4= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a12-67.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a12-67.akam.net for nsa.gov/A
	Received 219 bytes from 184.26.160.67
	;; Response received from [184.26.160.67] 219 octets ;; HEADER SECTION ;; id = 4744 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 184.27.230.2 nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. UVX1G3z9Nm3LZc5cUCjLQJwT6TM0dj1h7tVjXQ8BzrtaXTfZqaD3BTW9oJBUIm8xCHHRwD0x/MP1 uA+1tI1oX1YGGl6SBdxQxL7JWCbBt/8s+1KUeeT8TVfj3dOc1me1LzVCoJhAqkLAMrzumddszGFQ 4zcIVqDMm++qBA+A4z4= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nsa.gov A RR has value 184.27.230.2
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20260101074711 20251229064711 60837 nsa.gov. UVX1G3z9Nm3LZc5cUCjLQJwT6TM0dj1h7tVjXQ8BzrtaXTfZqaD3BTW9oJBUIm8xCHHRwD0x/MP1 uA+1tI1oX1YGGl6SBdxQxL7JWCbBt/8s+1KUeeT8TVfj3dOc1me1LzVCoJhAqkLAMrzumddszGFQ 4zcIVqDMm++qBA+A4z4= )`
	RRSIG=60837 and DNSKEY=60837 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test nsa.gov at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: