DNSSEC Analyzer - zkitzo.one

Domain Name:

Time: 2022-07-01 02:19:39 UTC, NTP stratum 16

Analyzing DNSSEC problems for zkitzo.one

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to m.root-servers.net for ./DNSKEY
	Received 1141 bytes from 202.12.27.33
	;; Response received from 202.12.27.33 (1141 octets) ;; HEADER SECTION ;; id = 26410 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN DNSKEY ( 256 3 8 AwEAAak/ZU9wDNQD7XTAGTDkn32UR8I6auRDekbGky+yyWKdUHmwAJv90YHCUTib8aVBgNgbxkee ZGRx3W4+XhMZbfUr5fMwmD3u9P2yzJpbRtjGNM/XZvzGs9HHNymz3Bp851anHZfNy6pJud265/XM KzFlAY8sMJjum0hvx/DuCDELLyhsvdfOD9rHM93UXO0bcAjvI8tjZsGI+Pfp9KdxF9vS/sAzpFXK sldix+e6xv8rRS6WPg2LAooxF+eO5DgFSilYmnyCK4VPJ7ntjD/8m0bs128ZT1eY3oXCbojDv59l LAgrdGSbcVxQF2KHoUHDmkOC5BzG/1xRtW4v/3y4/H8= ) ; Key ID = 47671 . 172800 IN DNSKEY ( 256 3 8 AwEAAaQVKIqdmeLCaF4lq+IoKpejId9qqoIbZJ6cjB5MfyJYX3KVFXYyJ9rt4jKOwf4m2BoDOY66 V1upRumF+eu502HXzdOdJlioRLA9YiRyLgvfjzyfUYrExYT4/TDTS4XfQX2UcJDN5C7SQ9UxebZk /VjQfPAUU+hZKOcjOVRFbAHom4tIi+Rin0laGlAi8ZY5WUZypYKR0xvprtG0eXeOBMjbUt1EnhmO 2Bs52zC8B0cMjq6fMiYFUqtziALccsQczGngIDR0dIvvL54ky1JNNp19Ldy9ir27s7eRCYGbYI1W zR05/d4/nCmDSHkQS2BiesYufuWZZwm+FsitupCciwE= ) ; Key ID = 20826 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20220711000000 20220620000000 20326 . CpFdBbv0lZXwIPLDhPn959HSJfQ4vp8r97A/rN0SPFlS4fQigB3EDXz0oeg2ENRPMn6HmrZpp0vB KMKfCXf3oC/4tioT7m18+xA05quW5+h/vJaOA0Iw7zOhTpQr1hTVaUwj/d0NV9JaCqZabjtj7ClN E/+aOBaCdVSXpy3re0WUk7FianexlLd5pL09RHGlH5eRyp8hAt5HqwrUvONfm7zgkhtO8RPtJSjN R5ZB9HDrcjDHiYzkbuw300LTphtzryG/XKwnQqv6E0iL+M6d4g7h9IQWpmM1lyjVM2sgZYGDPnBb N9kgNUCiF6HUHV12LmAJteZAQI65qARGFwADYg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAak/ZU9wDNQD7XTAGTDkn32UR8I6auRDekbGky+yyWKdUHmwAJv90YHCUTib8aVBgNgbxkee ZGRx3W4+XhMZbfUr5fMwmD3u9P2yzJpbRtjGNM/XZvzGs9HHNymz3Bp851anHZfNy6pJud265/XM KzFlAY8sMJjum0hvx/DuCDELLyhsvdfOD9rHM93UXO0bcAjvI8tjZsGI+Pfp9KdxF9vS/sAzpFXK sldix+e6xv8rRS6WPg2LAooxF+eO5DgFSilYmnyCK4VPJ7ntjD/8m0bs128ZT1eY3oXCbojDv59l LAgrdGSbcVxQF2KHoUHDmkOC5BzG/1xRtW4v/3y4/H8= ) ; Key ID = 47671`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAaQVKIqdmeLCaF4lq+IoKpejId9qqoIbZJ6cjB5MfyJYX3KVFXYyJ9rt4jKOwf4m2BoDOY66 V1upRumF+eu502HXzdOdJlioRLA9YiRyLgvfjzyfUYrExYT4/TDTS4XfQX2UcJDN5C7SQ9UxebZk /VjQfPAUU+hZKOcjOVRFbAHom4tIi+Rin0laGlAi8ZY5WUZypYKR0xvprtG0eXeOBMjbUt1EnhmO 2Bs52zC8B0cMjq6fMiYFUqtziALccsQczGngIDR0dIvvL54ky1JNNp19Ldy9ir27s7eRCYGbYI1W zR05/d4/nCmDSHkQS2BiesYufuWZZwm+FsitupCciwE= ) ; Key ID = 20826`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20220711000000 20220620000000 20326 . CpFdBbv0lZXwIPLDhPn959HSJfQ4vp8r97A/rN0SPFlS4fQigB3EDXz0oeg2ENRPMn6HmrZpp0vB KMKfCXf3oC/4tioT7m18+xA05quW5+h/vJaOA0Iw7zOhTpQr1hTVaUwj/d0NV9JaCqZabjtj7ClN E/+aOBaCdVSXpy3re0WUk7FianexlLd5pL09RHGlH5eRyp8hAt5HqwrUvONfm7zgkhtO8RPtJSjN R5ZB9HDrcjDHiYzkbuw300LTphtzryG/XKwnQqv6E0iL+M6d4g7h9IQWpmM1lyjVM2sgZYGDPnBb N9kgNUCiF6HUHV12LmAJteZAQI65qARGFwADYg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=47671 is now in the chain-of-trust
	DNSKEY=20826 is now in the chain-of-trust
	Query to j.root-servers.net for zkitzo.one/A
	Received 702 bytes from 192.58.128.30
	;; Response received from 192.58.128.30 (702 octets) ;; HEADER SECTION ;; id = 4806 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; zkitzo.one. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) one. 172800 IN NS c.nic.one. one. 172800 IN NS b.nic.one. one. 172800 IN NS a.nic.one. one. 172800 IN NS d.nic.one. one. 86400 IN DS ( 56899 8 2 c28cde2f5e88289c26584a4e6871b41e0f0c2d5f7f2df2906e8fbb275ac4aa68 ) one. 86400 IN DS 14131 8 1 8c04b443ee763b8b67cdf0db0bbc832e24f560ee one. 86400 IN DS ( 14131 8 2 8d11ff81a0e9bcc2719695cbe4d585b47aa3bde6cd28c5ac6e02bd919ca9b9e0 ) one. 86400 IN RRSIG ( DS 8 1 86400 20220713170000 20220630160000 47671 . TRYI7AV/M6ngXhVK4JYc/ME+FiDgJUmFS0QS1dNavUj465AvnjL8/5CERqzf5NDjwUT/HGClbUnH 5EiVzXJOBn8eoWUVy5fH+jjjbfusNXsJq2V0z3bVaXZlyFTUBH4OJKgLBuRXUWvYDdBQG/Nk4qe6 Q9E97y5mlljYOHN5SNFh1Ss/+yj4JbBLrKfOlyozgI4XT3vKXDHUqwxQj2smhnJPLjysDBHoiFGy mQ0RgVwHLxFzGbyRbguFQasM1LR1OjCrqn5G7hOwWwDitq6MxRMJs5BOGCwXgbbwbqmFrAutbwxZ bosQwZZ/aUSFTSP51e+Xk+zUGV64umZq4lYfIg== ) ;; ADDITIONAL SECTION (9 records) c.nic.one. 172800 IN A 37.209.196.9 c.nic.one. 172800 IN AAAA 2001:dcd:3::9 b.nic.one. 172800 IN A 37.209.194.9 b.nic.one. 172800 IN AAAA 2001:dcd:2::9 a.nic.one. 172800 IN A 37.209.192.9 a.nic.one. 172800 IN AAAA 2001:dcd:1::9 d.nic.one. 172800 IN A 37.209.198.9 d.nic.one. 172800 IN AAAA 2001:dcd:4::9 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to b.root-servers.net for one/DNSKEY
	Received 695 bytes from 199.9.14.201
	;; Response received from 199.9.14.201 (695 octets) ;; HEADER SECTION ;; id = 44538 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; one. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) one. 172800 IN NS a.nic.one. one. 172800 IN NS b.nic.one. one. 172800 IN NS c.nic.one. one. 172800 IN NS d.nic.one. one. 86400 IN DS 14131 8 1 8c04b443ee763b8b67cdf0db0bbc832e24f560ee one. 86400 IN DS ( 14131 8 2 8d11ff81a0e9bcc2719695cbe4d585b47aa3bde6cd28c5ac6e02bd919ca9b9e0 ) one. 86400 IN DS ( 56899 8 2 c28cde2f5e88289c26584a4e6871b41e0f0c2d5f7f2df2906e8fbb275ac4aa68 ) one. 86400 IN RRSIG ( DS 8 1 86400 20220713170000 20220630160000 47671 . TRYI7AV/M6ngXhVK4JYc/ME+FiDgJUmFS0QS1dNavUj465AvnjL8/5CERqzf5NDjwUT/HGClbUnH 5EiVzXJOBn8eoWUVy5fH+jjjbfusNXsJq2V0z3bVaXZlyFTUBH4OJKgLBuRXUWvYDdBQG/Nk4qe6 Q9E97y5mlljYOHN5SNFh1Ss/+yj4JbBLrKfOlyozgI4XT3vKXDHUqwxQj2smhnJPLjysDBHoiFGy mQ0RgVwHLxFzGbyRbguFQasM1LR1OjCrqn5G7hOwWwDitq6MxRMJs5BOGCwXgbbwbqmFrAutbwxZ bosQwZZ/aUSFTSP51e+Xk+zUGV64umZq4lYfIg== ) ;; ADDITIONAL SECTION (9 records) a.nic.one. 172800 IN A 37.209.192.9 a.nic.one. 172800 IN AAAA 2001:dcd:1::9 b.nic.one. 172800 IN A 37.209.194.9 b.nic.one. 172800 IN AAAA 2001:dcd:2::9 c.nic.one. 172800 IN A 37.209.196.9 c.nic.one. 172800 IN AAAA 2001:dcd:3::9 d.nic.one. 172800 IN A 37.209.198.9 d.nic.one. 172800 IN AAAA 2001:dcd:4::9 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found child zone one

one

	Checking DS between . and one
	Query to e.root-servers.net for one/DS
	Received 451 bytes from 192.203.230.10
	;; Response received from 192.203.230.10 (451 octets) ;; HEADER SECTION ;; id = 54710 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; one. IN DS ;; ANSWER SECTION (4 records) one. 86400 IN DS 14131 8 1 8c04b443ee763b8b67cdf0db0bbc832e24f560ee one. 86400 IN DS ( 14131 8 2 8d11ff81a0e9bcc2719695cbe4d585b47aa3bde6cd28c5ac6e02bd919ca9b9e0 ) one. 86400 IN DS ( 56899 8 2 c28cde2f5e88289c26584a4e6871b41e0f0c2d5f7f2df2906e8fbb275ac4aa68 ) one. 86400 IN RRSIG ( DS 8 1 86400 20220713170000 20220630160000 47671 . TRYI7AV/M6ngXhVK4JYc/ME+FiDgJUmFS0QS1dNavUj465AvnjL8/5CERqzf5NDjwUT/HGClbUnH 5EiVzXJOBn8eoWUVy5fH+jjjbfusNXsJq2V0z3bVaXZlyFTUBH4OJKgLBuRXUWvYDdBQG/Nk4qe6 Q9E97y5mlljYOHN5SNFh1Ss/+yj4JbBLrKfOlyozgI4XT3vKXDHUqwxQj2smhnJPLjysDBHoiFGy mQ0RgVwHLxFzGbyRbguFQasM1LR1OjCrqn5G7hOwWwDitq6MxRMJs5BOGCwXgbbwbqmFrAutbwxZ bosQwZZ/aUSFTSP51e+Xk+zUGV64umZq4lYfIg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 3 DS records for one in the . zone
	DS=14131/SHA-1 has algorithm RSASHA256
	DS=14131/SHA-256 has algorithm RSASHA256
	DS=56899/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`one. 86400 IN RRSIG ( DS 8 1 86400 20220713170000 20220630160000 47671 . TRYI7AV/M6ngXhVK4JYc/ME+FiDgJUmFS0QS1dNavUj465AvnjL8/5CERqzf5NDjwUT/HGClbUnH 5EiVzXJOBn8eoWUVy5fH+jjjbfusNXsJq2V0z3bVaXZlyFTUBH4OJKgLBuRXUWvYDdBQG/Nk4qe6 Q9E97y5mlljYOHN5SNFh1Ss/+yj4JbBLrKfOlyozgI4XT3vKXDHUqwxQj2smhnJPLjysDBHoiFGy mQ0RgVwHLxFzGbyRbguFQasM1LR1OjCrqn5G7hOwWwDitq6MxRMJs5BOGCwXgbbwbqmFrAutbwxZ bosQwZZ/aUSFTSP51e+Xk+zUGV64umZq4lYfIg== )`
	RRSIG=47671 and DNSKEY=47671 verifies the DS RRset
	DS=14131/SHA-1 is now in the chain-of-trust
	DS=56899/SHA-256 is now in the chain-of-trust
	`one. 86400 IN DS 14131 8 1 8c04b443ee763b8b67cdf0db0bbc832e24f560ee`
	`one. 86400 IN DS ( 14131 8 2 8d11ff81a0e9bcc2719695cbe4d585b47aa3bde6cd28c5ac6e02bd919ca9b9e0 )`
	`one. 86400 IN DS ( 56899 8 2 c28cde2f5e88289c26584a4e6871b41e0f0c2d5f7f2df2906e8fbb275ac4aa68 )`
	Query to d.nic.one for one/DNSKEY
	Received 1430 bytes from 37.209.198.9
	;; Response received from 37.209.198.9 (1430 octets) ;; HEADER SECTION ;; id = 51322 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 6 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; one. IN DNSKEY ;; ANSWER SECTION (6 records) one. 900 IN DNSKEY ( 257 3 8 AwEAAc0v2mWvG5oxSRdpjhXCBNPqDVJaM0Mc+t/Re+mx+7w+zihbBlMdOphgsJuFEVFS5iDixmdS W3S1UX0csYL7cv3K/ZjpAH/bW2PAc4DAedEHHpIHKEhul43/yZ7W44mPTIQui4r/wtU2bKBuoaF5 SdG2fOE1sACt35QjHVD2QiHWHNg7UwGi8a9EsGaMvoe58e/Ij84ZW1/Zy3xPcJASZEsOzj8mjtA8 mIrD/+SqMvCDmWaubJH0ueJu3+FYduXyzIBL3Atj2sJvqHjlO2xM7JvNxp5Ku5IxJ657xLjfVN6S 8STxLQgU4XJ5kgFS+Na7c50GExJH2UtAh+KIkz2FRJE= ) ; Key ID = 14131 one. 900 IN DNSKEY ( 257 3 8 AwEAAeNbI0gleS1kmYgGiO57onbajkvToVhZ8CNXz6eJSVJrAwGlzWl/h7yjBV8nD8pnjepXO/p7 54KvkK/2AE3RxeXLHDZnflK/TObQquIuC9QDX+fpjby/qs9UFHgQvtHvedba/9Rz+z2iq9fN1T2C syAyZxSqosJptsQbNOH3EAcI640KS7FBu/orCqwzCm2ZfuxOFrvaOA+GL3kTerovD+uFSz9YVb0U miMCoQehLem3zU7TFaS/41MK4byFOaeamZhC2FuCJy2wh+hyNlofrkmZXNpZycnQK52pQxfvfBL/ BL8phsUYv051gf7FExE6xY9uHjQ4LA4b7gpHJoBMAaM= ) ; Key ID = 56899 one. 900 IN DNSKEY ( 256 3 8 AwEAAbPvufcORGMuLVRMZVzbqVCN3GpUJSh7njICa621qdORfnZf2mAsI7feCfdJvf49Z7D2yhpB ziVQ2SPrsQa3Tkkx8TTdu1v+RjXKFM1AcPsMpwuv2otZZ1srZSgqFx/W8kBFaUwduAYEJUDfh7FB akRadIQDTsJSq/JyoqF1uWD4QhaJdWeMeLG+iE6k8A44jK9aHFSRYawdBRfFsMY0lcU= ) ; Key ID = 29100 one. 900 IN DNSKEY ( 256 3 8 AwEAAdTAjRN6dMywlHpHsv7LASNUqu0wd+FAfSLvPbinRnAWd7bGJeyI9Qy5yLPAncDz8Z+DEkS9 oq/1AD9eakpDIMkyHWsR7BcdrJeCH+E/Oyw53urwXNPtVQYcfljvl1eIQ/kz42Vn2Dwft0NX/MJn sZeHRj1ZeGgAZ+xWoc/Rcqad5p4bO563GVFY9m8tqIJwAp0aHJVuvi9fVRaB0alb+bs= ) ; Key ID = 4353 one. 900 IN RRSIG ( DNSKEY 8 1 900 20220727003105 20220626234711 4353 one. PvBoCzZ/2ZkUTI9efFQcI9KBSVnXy8LUgNdYeSPbqobUHpRx3dEZVmmelXpaEFN21A9Qi7gZ2/yG v58TsDMTdFB/E61goifrauyXmpnJE+VBT3TKmfIuBEC7VDZ2wShvwA+6P3DPyNbIgGaUeFSgVwjH UBCMmUb/52hfwn51oIFhBlqz1geBfHeWb69AOXFtzouaWjPkcuRpQM7DvrS1Vw== ) one. 900 IN RRSIG ( DNSKEY 8 1 900 20220727003105 20220626234711 56899 one. jCeywc7HJi+A1Xs8GV+f1udZNLaXGz6e5oz/ZOc1Zm6V40T9Jd3NG390QhF9bC62EVd9R2R/lwUR fXHZu/gbL9xz2ydVPnMfeQJtcx5QnfbaV05kLiUmW3To1HrThRwQuT3OVFYQZSY/IYPTqkKO3qul apXFoJLxpJ9OdWFBHk1i3kUmV29WlIhk2+phhJ8bUp3oHjXZvD/Ho6vpGs9R3ejjdhAda9cd/T/F lPT792LL9RBRIeMkDFJaRHyysT/rTrHn0qNsAahl1FpV8ZHhe+QbrJAT2gJP1lk/ACgRe4/yVy+m 1PlwM3Uufyzi+HdWUMwZYQCsOh8L8tHltGaw9A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 4 DNSKEY records for one
	`one. 900 IN DNSKEY ( 257 3 8 AwEAAc0v2mWvG5oxSRdpjhXCBNPqDVJaM0Mc+t/Re+mx+7w+zihbBlMdOphgsJuFEVFS5iDixmdS W3S1UX0csYL7cv3K/ZjpAH/bW2PAc4DAedEHHpIHKEhul43/yZ7W44mPTIQui4r/wtU2bKBuoaF5 SdG2fOE1sACt35QjHVD2QiHWHNg7UwGi8a9EsGaMvoe58e/Ij84ZW1/Zy3xPcJASZEsOzj8mjtA8 mIrD/+SqMvCDmWaubJH0ueJu3+FYduXyzIBL3Atj2sJvqHjlO2xM7JvNxp5Ku5IxJ657xLjfVN6S 8STxLQgU4XJ5kgFS+Na7c50GExJH2UtAh+KIkz2FRJE= ) ; Key ID = 14131`
	`one. 900 IN DNSKEY ( 257 3 8 AwEAAeNbI0gleS1kmYgGiO57onbajkvToVhZ8CNXz6eJSVJrAwGlzWl/h7yjBV8nD8pnjepXO/p7 54KvkK/2AE3RxeXLHDZnflK/TObQquIuC9QDX+fpjby/qs9UFHgQvtHvedba/9Rz+z2iq9fN1T2C syAyZxSqosJptsQbNOH3EAcI640KS7FBu/orCqwzCm2ZfuxOFrvaOA+GL3kTerovD+uFSz9YVb0U miMCoQehLem3zU7TFaS/41MK4byFOaeamZhC2FuCJy2wh+hyNlofrkmZXNpZycnQK52pQxfvfBL/ BL8phsUYv051gf7FExE6xY9uHjQ4LA4b7gpHJoBMAaM= ) ; Key ID = 56899`
	`one. 900 IN DNSKEY ( 256 3 8 AwEAAbPvufcORGMuLVRMZVzbqVCN3GpUJSh7njICa621qdORfnZf2mAsI7feCfdJvf49Z7D2yhpB ziVQ2SPrsQa3Tkkx8TTdu1v+RjXKFM1AcPsMpwuv2otZZ1srZSgqFx/W8kBFaUwduAYEJUDfh7FB akRadIQDTsJSq/JyoqF1uWD4QhaJdWeMeLG+iE6k8A44jK9aHFSRYawdBRfFsMY0lcU= ) ; Key ID = 29100`
	`one. 900 IN DNSKEY ( 256 3 8 AwEAAdTAjRN6dMywlHpHsv7LASNUqu0wd+FAfSLvPbinRnAWd7bGJeyI9Qy5yLPAncDz8Z+DEkS9 oq/1AD9eakpDIMkyHWsR7BcdrJeCH+E/Oyw53urwXNPtVQYcfljvl1eIQ/kz42Vn2Dwft0NX/MJn sZeHRj1ZeGgAZ+xWoc/Rcqad5p4bO563GVFY9m8tqIJwAp0aHJVuvi9fVRaB0alb+bs= ) ; Key ID = 4353`
	DNSKEY=14131/SEP is now in the chain-of-trust
	DS=14131/SHA-1 verifies DNSKEY=14131/SEP
	DS=14131/SHA-256 verifies DNSKEY=14131/SEP
	DNSKEY=56899/SEP is now in the chain-of-trust
	DS=56899/SHA-256 verifies DNSKEY=56899/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`one. 900 IN RRSIG ( DNSKEY 8 1 900 20220727003105 20220626234711 4353 one. PvBoCzZ/2ZkUTI9efFQcI9KBSVnXy8LUgNdYeSPbqobUHpRx3dEZVmmelXpaEFN21A9Qi7gZ2/yG v58TsDMTdFB/E61goifrauyXmpnJE+VBT3TKmfIuBEC7VDZ2wShvwA+6P3DPyNbIgGaUeFSgVwjH UBCMmUb/52hfwn51oIFhBlqz1geBfHeWb69AOXFtzouaWjPkcuRpQM7DvrS1Vw== )`
	`one. 900 IN RRSIG ( DNSKEY 8 1 900 20220727003105 20220626234711 56899 one. jCeywc7HJi+A1Xs8GV+f1udZNLaXGz6e5oz/ZOc1Zm6V40T9Jd3NG390QhF9bC62EVd9R2R/lwUR fXHZu/gbL9xz2ydVPnMfeQJtcx5QnfbaV05kLiUmW3To1HrThRwQuT3OVFYQZSY/IYPTqkKO3qul apXFoJLxpJ9OdWFBHk1i3kUmV29WlIhk2+phhJ8bUp3oHjXZvD/Ho6vpGs9R3ejjdhAda9cd/T/F lPT792LL9RBRIeMkDFJaRHyysT/rTrHn0qNsAahl1FpV8ZHhe+QbrJAT2gJP1lk/ACgRe4/yVy+m 1PlwM3Uufyzi+HdWUMwZYQCsOh8L8tHltGaw9A== )`
	RRSIG=4353 and DNSKEY=4353 verifies the DNSKEY RRset
	RRSIG=56899 and DNSKEY=56899/SEP verifies the DNSKEY RRset
	DNSKEY=29100 is now in the chain-of-trust
	DNSKEY=4353 is now in the chain-of-trust
	Query to a.nic.one for zkitzo.one/A
	Received 339 bytes from 37.209.192.9
	;; Response received from 37.209.192.9 (339 octets) ;; HEADER SECTION ;; id = 56219 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; zkitzo.one. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) zkitzo.one. 3600 IN NS drew.ns.cloudflare.com. zkitzo.one. 3600 IN NS athena.ns.cloudflare.com. zkitzo.one. 3600 IN DS ( 2371 13 2 3f3193157ce540d07ca9bfa1a6fbd58468622c9d3c40eb781be1d1d70e8ca9be ) zkitzo.one. 3600 IN RRSIG ( DS 8 2 3600 20220727042806 20220627033529 4353 one. iTTlF/RkyTvLj/L6Pn0xBlwOGqvBWvssXrPUMiVtmoA2Wb30X5xFpEfspowmMoL4QRnvKdmR3Ls5 Y56TRVc7cqTR4Qr8uP+yUXLwvx0FuhrSHdCiaVxM1jjuX6jOfnUHyQ5ukGAsCvyOnUE+e/7UyHEL p3EiMa5h5s0T6puca/QfWq+/F+C4dOfb6di6/gVmJbkxD/4AotAozU/GcTV2yA== ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to a.nic.one for zkitzo.one/DNSKEY
	Received 339 bytes from 37.209.192.9
	;; Response received from 37.209.192.9 (339 octets) ;; HEADER SECTION ;; id = 12224 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; zkitzo.one. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) zkitzo.one. 3600 IN NS athena.ns.cloudflare.com. zkitzo.one. 3600 IN NS drew.ns.cloudflare.com. zkitzo.one. 3600 IN DS ( 2371 13 2 3f3193157ce540d07ca9bfa1a6fbd58468622c9d3c40eb781be1d1d70e8ca9be ) zkitzo.one. 3600 IN RRSIG ( DS 8 2 3600 20220727042806 20220627033529 4353 one. iTTlF/RkyTvLj/L6Pn0xBlwOGqvBWvssXrPUMiVtmoA2Wb30X5xFpEfspowmMoL4QRnvKdmR3Ls5 Y56TRVc7cqTR4Qr8uP+yUXLwvx0FuhrSHdCiaVxM1jjuX6jOfnUHyQ5ukGAsCvyOnUE+e/7UyHEL p3EiMa5h5s0T6puca/QfWq+/F+C4dOfb6di6/gVmJbkxD/4AotAozU/GcTV2yA== ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found child zone zkitzo.one

zkitzo.one

	Checking DS between one and zkitzo.one
	Query to d.nic.one for zkitzo.one/DS
	Received 282 bytes from 37.209.198.9
	;; Response received from 37.209.198.9 (282 octets) ;; HEADER SECTION ;; id = 57850 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; zkitzo.one. IN DS ;; ANSWER SECTION (2 records) zkitzo.one. 3600 IN DS ( 2371 13 2 3f3193157ce540d07ca9bfa1a6fbd58468622c9d3c40eb781be1d1d70e8ca9be ) zkitzo.one. 3600 IN RRSIG ( DS 8 2 3600 20220727042806 20220627033529 4353 one. iTTlF/RkyTvLj/L6Pn0xBlwOGqvBWvssXrPUMiVtmoA2Wb30X5xFpEfspowmMoL4QRnvKdmR3Ls5 Y56TRVc7cqTR4Qr8uP+yUXLwvx0FuhrSHdCiaVxM1jjuX6jOfnUHyQ5ukGAsCvyOnUE+e/7UyHEL p3EiMa5h5s0T6puca/QfWq+/F+C4dOfb6di6/gVmJbkxD/4AotAozU/GcTV2yA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 1 DS records for zkitzo.one in the one zone
	DS=2371/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`zkitzo.one. 3600 IN RRSIG ( DS 8 2 3600 20220727042806 20220627033529 4353 one. iTTlF/RkyTvLj/L6Pn0xBlwOGqvBWvssXrPUMiVtmoA2Wb30X5xFpEfspowmMoL4QRnvKdmR3Ls5 Y56TRVc7cqTR4Qr8uP+yUXLwvx0FuhrSHdCiaVxM1jjuX6jOfnUHyQ5ukGAsCvyOnUE+e/7UyHEL p3EiMa5h5s0T6puca/QfWq+/F+C4dOfb6di6/gVmJbkxD/4AotAozU/GcTV2yA== )`
	RRSIG=4353 and DNSKEY=4353 verifies the DS RRset
	DS=2371/SHA-256 is now in the chain-of-trust
	`zkitzo.one. 3600 IN DS ( 2371 13 2 3f3193157ce540d07ca9bfa1a6fbd58468622c9d3c40eb781be1d1d70e8ca9be )`
	Query to athena.ns.cloudflare.com for zkitzo.one/DNSKEY
	Received 305 bytes from 173.245.58.72
	;; Response received from 173.245.58.72 (305 octets) ;; HEADER SECTION ;; id = 15595 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; zkitzo.one. IN DNSKEY ;; ANSWER SECTION (3 records) zkitzo.one. 3600 IN DNSKEY ( 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iU zy1L53eKGQ== ) ; Key ID = 2371 zkitzo.one. 3600 IN DNSKEY ( 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x 8fGAa2XhSA== ) ; Key ID = 34505 zkitzo.one. 3600 IN RRSIG ( DNSKEY 13 2 3600 20220814130105 20220614130105 2371 zkitzo.one. iAxcnXYI/YEg5TfUuy5Eb0zZTQLedSRvX9r38pbG6CRxl/kOWyuebcy9pW59kGNBqemEkguZtxP8 g0E6hGjJBA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 2 DNSKEY records for zkitzo.one
	`zkitzo.one. 3600 IN DNSKEY ( 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iU zy1L53eKGQ== ) ; Key ID = 2371`
	`zkitzo.one. 3600 IN DNSKEY ( 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x 8fGAa2XhSA== ) ; Key ID = 34505`
	DNSKEY=2371/SEP is now in the chain-of-trust
	DS=2371/SHA-256 verifies DNSKEY=2371/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`zkitzo.one. 3600 IN RRSIG ( DNSKEY 13 2 3600 20220814130105 20220614130105 2371 zkitzo.one. iAxcnXYI/YEg5TfUuy5Eb0zZTQLedSRvX9r38pbG6CRxl/kOWyuebcy9pW59kGNBqemEkguZtxP8 g0E6hGjJBA== )`
	RRSIG=2371 and DNSKEY=2371/SEP verifies the DNSKEY RRset
	DNSKEY=34505 is now in the chain-of-trust
	Query to drew.ns.cloudflare.com for zkitzo.one/A
	Received 177 bytes from 172.64.33.160
	;; Response received from 172.64.33.160 (177 octets) ;; HEADER SECTION ;; id = 62114 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; zkitzo.one. IN A ;; ANSWER SECTION (3 records) zkitzo.one. 300 IN A 172.67.133.178 zkitzo.one. 300 IN A 104.21.5.180 zkitzo.one. 300 IN RRSIG ( A 13 2 300 20220702031939 20220630011939 34505 zkitzo.one. 7xTCgMDj8y/4PBLsIMq04l6tyLlihtGMGFf+7G7M8XQdG3mmOL6hMQPZfHQ3y7R9xUV3E6tOk26R wE8LynHBxQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	drew.ns.cloudflare.com is authoritative for zkitzo.one
	Found RRSIG signed by zkitzo.one zone
	Query to athena.ns.cloudflare.com for zkitzo.one/SOA
	Received 209 bytes from 172.64.32.72
	;; Response received from 172.64.32.72 (209 octets) ;; HEADER SECTION ;; id = 42950 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; zkitzo.one. IN SOA ;; ANSWER SECTION (2 records) zkitzo.one. 3600 IN SOA ( athena.ns.cloudflare.com. dns.cloudflare.com. 2281216190 ;serial 10000 ;refresh 2400 ;retry 604800 ;expire 3600 ;minimum ) zkitzo.one. 3600 IN RRSIG ( SOA 13 2 3600 20220702031939 20220630011939 34505 zkitzo.one. rqPqLgc4vUxpvJKVi1yehqNZ5nzj/G57e0xSU94G/K0nR7PXnaSKKIipTmvBjt74H2678YHh2h27 zYquRmskVw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to drew.ns.cloudflare.com for zkitzo.one/A
	Received 177 bytes from 108.162.193.160
	;; Response received from 108.162.193.160 (177 octets) ;; HEADER SECTION ;; id = 35318 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; zkitzo.one. IN A ;; ANSWER SECTION (3 records) zkitzo.one. 300 IN A 172.67.133.178 zkitzo.one. 300 IN A 104.21.5.180 zkitzo.one. 300 IN RRSIG ( A 13 2 300 20220702031939 20220630011939 34505 zkitzo.one. DD4kTelG2rIAlPXMcB/lNF2XEteB+cwlsC6K1e+DiLoLdAcNHrwan87IX+/Yo8e1B3jUQQ1QZxBQ bHxwr0s3ug== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	zkitzo.one A RR has value 172.67.133.178
	zkitzo.one A RR has value 104.21.5.180
	Found 1 RRSIGs over A RRset
	`zkitzo.one. 300 IN RRSIG ( A 13 2 300 20220702031939 20220630011939 34505 zkitzo.one. DD4kTelG2rIAlPXMcB/lNF2XEteB+cwlsC6K1e+DiLoLdAcNHrwan87IX+/Yo8e1B3jUQQ1QZxBQ bHxwr0s3ug== )`
	RRSIG=34505 and DNSKEY=34505 verifies the A RRset

zkitzo.one

	Query to athena.ns.cloudflare.com for zkitzo.one/A
	Received 177 bytes from 108.162.192.72
	;; Response received from 108.162.192.72 (177 octets) ;; HEADER SECTION ;; id = 2913 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; zkitzo.one. IN A ;; ANSWER SECTION (3 records) zkitzo.one. 300 IN A 172.67.133.178 zkitzo.one. 300 IN A 104.21.5.180 zkitzo.one. 300 IN RRSIG ( A 13 2 300 20220702031939 20220630011939 34505 zkitzo.one. ilPYMYUJQZ2wrFCJam+tT+fxxMggUUrykiF1NpUKKFbRehotTgMlqY5SxW9Lw4tFEo/jtGDQgXmv G1rLCZVreA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	athena.ns.cloudflare.com is authoritative for zkitzo.one
	Found RRSIG signed by zkitzo.one zone
	Query to athena.ns.cloudflare.com for zkitzo.one/A
	Received 177 bytes from 108.162.192.72
	;; Response received from 108.162.192.72 (177 octets) ;; HEADER SECTION ;; id = 40910 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; zkitzo.one. IN A ;; ANSWER SECTION (3 records) zkitzo.one. 300 IN A 172.67.133.178 zkitzo.one. 300 IN A 104.21.5.180 zkitzo.one. 300 IN RRSIG ( A 13 2 300 20220702031939 20220630011939 34505 zkitzo.one. 6zsQ/1KmuPElYxoaAhHdDuIHVZjPWWDKpHASBXUnSGwmXtDUFIW3pOwtfB+UCKhDVdJ9D0/Qypce ezv/G5jNkw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	zkitzo.one A RR has value 172.67.133.178
	zkitzo.one A RR has value 104.21.5.180
	Found 1 RRSIGs over A RRset
	`zkitzo.one. 300 IN RRSIG ( A 13 2 300 20220702031939 20220630011939 34505 zkitzo.one. 6zsQ/1KmuPElYxoaAhHdDuIHVZjPWWDKpHASBXUnSGwmXtDUFIW3pOwtfB+UCKhDVdJ9D0/Qypce ezv/G5jNkw== )`
	RRSIG=34505 and DNSKEY=34505 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test zkitzo.one at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: