DNSSEC Debugger - dotat.at

Domain Name:

Time: 2024-05-21 23:23:09 UTC

Analyzing DNSSEC problems for dotat.at

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to e.root-servers.net for ./DNSKEY
	Received 864 bytes from 192.203.230.10
	;; Response received from [192.203.230.10] 864 octets ;; HEADER SECTION ;; id = 13841 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20240611000000 20240521000000 20326 . W/Hsuxwei6HE8IzojCIwmIP/lrqd6TZmm1cv7VEm7bjqgUyc5FBDUSNxWfIQiwLTn+Xqk8ZVG/68 0XZptzkT2ZxyXwK7AGFAvGrKiFBertupXxU7I5uYs27GPOnnKwlA5ZrUJW0AK66XIKMb+qVMHa7C 2agO1VOsAUSDeZtR8XJmJbzIMZN2GBlSowjWe90CX0jU+ncr58MOYEiI6N2JsWJi4gU546OrmhJd hEnPGDX/gPF5OjrgDZER2+PyjSEGdxdP0nbqlBcC39aLm3lfHNNJDzC+dxgL04qt1RiTTPhDbuMp hE2l6WxjC9N8wWzM+h0IKgDMc2oVSc4B+U5Kjw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20240611000000 20240521000000 20326 . W/Hsuxwei6HE8IzojCIwmIP/lrqd6TZmm1cv7VEm7bjqgUyc5FBDUSNxWfIQiwLTn+Xqk8ZVG/68 0XZptzkT2ZxyXwK7AGFAvGrKiFBertupXxU7I5uYs27GPOnnKwlA5ZrUJW0AK66XIKMb+qVMHa7C 2agO1VOsAUSDeZtR8XJmJbzIMZN2GBlSowjWe90CX0jU+ncr58MOYEiI6N2JsWJi4gU546OrmhJd hEnPGDX/gPF5OjrgDZER2+PyjSEGdxdP0nbqlBcC39aLm3lfHNNJDzC+dxgL04qt1RiTTPhDbuMp hE2l6WxjC9N8wWzM+h0IKgDMc2oVSc4B+U5Kjw== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=5613 is now in the chain-of-trust
	Query to l.root-servers.net for dotat.at/A
	Received 919 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 919 octets ;; HEADER SECTION ;; id = 42985 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 11 arcount = 17 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (11 records) at. 172800 IN NS d.ns.at. at. 172800 IN NS j.ns.at. at. 172800 IN NS n.ns.at. at. 172800 IN NS r.ns.at. at. 172800 IN NS u.ns.at. at. 172800 IN NS ns1.univie.ac.at. at. 172800 IN NS ns2.univie.ac.at. at. 172800 IN NS ns9.univie.ac.at. at. 86400 IN DS ( 1253 13 2 ba17c1bacb3fb49f7760ad1f7e71e17ab39ee0df3e9d3bf23fd3d70d6cf1719e ) at. 86400 IN DS ( 18942 13 2 ae5f0bd73c8f48f3d55cdc4070f9407873176c364de4bc92bf96887685e6e55f ) at. 86400 IN RRSIG ( DS 8 1 86400 20240603210000 20240521200000 5613 . O9p2P2bAYT+7IuYWQ69/R4XiwoJ3QZQPrmaUvBdFVibj/srh+XaDeJSxN0ESEgc1eUi7eStDUXRA TyrTUEvAnkbiiBAjJJD8WiOaCt8lyjoLCAFM7WnRz+rz5g12KA9MuVddGESv3SQjV7CXBRYbk25S iQqz6J7tFBPJlw4dYKDsEl5D9+IEdpn6hL1SBayTR1oG2LIdUp8dHGog19BGTl+0q2iUT5QQ77+u I7/V0IR5w882POSMVxVRPexDbGWktiszgK09X9ubF6N7os1IVXlyHZJeKfFoQt9VWs4Apcc2FEbt /OE2cA3z85tuUNSXMJelEulX2x3ayEnxHNw6uA== ) ;; ADDITIONAL SECTION (17 records) d.ns.at. 172800 IN A 81.91.161.98 j.ns.at. 172800 IN A 194.146.106.50 n.ns.at. 172800 IN A 81.91.173.130 r.ns.at. 172800 IN A 194.0.25.10 u.ns.at. 172800 IN A 185.102.12.2 ns1.univie.ac.at. 172800 IN A 78.104.144.2 ns2.univie.ac.at. 172800 IN A 192.92.125.2 ns9.univie.ac.at. 172800 IN A 194.0.10.100 d.ns.at. 172800 IN AAAA 2a02:568:20:1::d j.ns.at. 172800 IN AAAA 2001:67c:1010:12::53 n.ns.at. 172800 IN AAAA 2a02:568:281::130 r.ns.at. 172800 IN AAAA 2001:678:20::10 u.ns.at. 172800 IN AAAA 2a02:850:ffff::2 ns1.univie.ac.at. 172800 IN AAAA 2001:628:2030:4301::2 ns2.univie.ac.at. 172800 IN AAAA 2001:678:1c::2 ns9.univie.ac.at. 172800 IN AAAA 2001:678:d::cafe ;; { "EDNS-VERSION": 0 }
	Query to g.root-servers.net for at/DNSKEY
	Received 917 bytes from 192.112.36.4
	;; Response received from [192.112.36.4] 917 octets ;; HEADER SECTION ;; id = 21407 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 11 arcount = 17 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; at. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (11 records) at. 172800 IN NS ns1.univie.ac.at. at. 172800 IN NS u.ns.at. at. 172800 IN NS d.ns.at. at. 172800 IN NS j.ns.at. at. 172800 IN NS n.ns.at. at. 172800 IN NS r.ns.at. at. 172800 IN NS ns9.univie.ac.at. at. 172800 IN NS ns2.univie.ac.at. at. 86400 IN DS ( 1253 13 2 ba17c1bacb3fb49f7760ad1f7e71e17ab39ee0df3e9d3bf23fd3d70d6cf1719e ) at. 86400 IN DS ( 18942 13 2 ae5f0bd73c8f48f3d55cdc4070f9407873176c364de4bc92bf96887685e6e55f ) at. 86400 IN RRSIG ( DS 8 1 86400 20240603210000 20240521200000 5613 . O9p2P2bAYT+7IuYWQ69/R4XiwoJ3QZQPrmaUvBdFVibj/srh+XaDeJSxN0ESEgc1eUi7eStDUXRA TyrTUEvAnkbiiBAjJJD8WiOaCt8lyjoLCAFM7WnRz+rz5g12KA9MuVddGESv3SQjV7CXBRYbk25S iQqz6J7tFBPJlw4dYKDsEl5D9+IEdpn6hL1SBayTR1oG2LIdUp8dHGog19BGTl+0q2iUT5QQ77+u I7/V0IR5w882POSMVxVRPexDbGWktiszgK09X9ubF6N7os1IVXlyHZJeKfFoQt9VWs4Apcc2FEbt /OE2cA3z85tuUNSXMJelEulX2x3ayEnxHNw6uA== ) ;; ADDITIONAL SECTION (17 records) ns9.univie.ac.at. 172800 IN A 194.0.10.100 ns2.univie.ac.at. 172800 IN A 192.92.125.2 ns1.univie.ac.at. 172800 IN A 78.104.144.2 u.ns.at. 172800 IN A 185.102.12.2 r.ns.at. 172800 IN A 194.0.25.10 n.ns.at. 172800 IN A 81.91.173.130 j.ns.at. 172800 IN A 194.146.106.50 d.ns.at. 172800 IN A 81.91.161.98 ns9.univie.ac.at. 172800 IN AAAA 2001:678:d::cafe ns2.univie.ac.at. 172800 IN AAAA 2001:678:1c::2 ns1.univie.ac.at. 172800 IN AAAA 2001:628:2030:4301::2 u.ns.at. 172800 IN AAAA 2a02:850:ffff::2 r.ns.at. 172800 IN AAAA 2001:678:20::10 n.ns.at. 172800 IN AAAA 2a02:568:281::130 j.ns.at. 172800 IN AAAA 2001:67c:1010:12::53 d.ns.at. 172800 IN AAAA 2a02:568:20:1::d ;; { "EDNS-VERSION": 0 }
	Found child zone at

	Checking DS between . and at
	Query to l.root-servers.net for at/DS
	Received 414 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 414 octets ;; HEADER SECTION ;; id = 60467 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; at. IN DS ;; ANSWER SECTION (3 records) at. 86400 IN DS ( 1253 13 2 ba17c1bacb3fb49f7760ad1f7e71e17ab39ee0df3e9d3bf23fd3d70d6cf1719e ) at. 86400 IN DS ( 18942 13 2 ae5f0bd73c8f48f3d55cdc4070f9407873176c364de4bc92bf96887685e6e55f ) at. 86400 IN RRSIG ( DS 8 1 86400 20240603210000 20240521200000 5613 . O9p2P2bAYT+7IuYWQ69/R4XiwoJ3QZQPrmaUvBdFVibj/srh+XaDeJSxN0ESEgc1eUi7eStDUXRA TyrTUEvAnkbiiBAjJJD8WiOaCt8lyjoLCAFM7WnRz+rz5g12KA9MuVddGESv3SQjV7CXBRYbk25S iQqz6J7tFBPJlw4dYKDsEl5D9+IEdpn6hL1SBayTR1oG2LIdUp8dHGog19BGTl+0q2iUT5QQ77+u I7/V0IR5w882POSMVxVRPexDbGWktiszgK09X9ubF6N7os1IVXlyHZJeKfFoQt9VWs4Apcc2FEbt /OE2cA3z85tuUNSXMJelEulX2x3ayEnxHNw6uA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DS records for at in the . zone
	DS=1253/SHA-256 has algorithm ECDSAP256SHA256
	DS=18942/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`at. 86400 IN RRSIG ( DS 8 1 86400 20240603210000 20240521200000 5613 . O9p2P2bAYT+7IuYWQ69/R4XiwoJ3QZQPrmaUvBdFVibj/srh+XaDeJSxN0ESEgc1eUi7eStDUXRA TyrTUEvAnkbiiBAjJJD8WiOaCt8lyjoLCAFM7WnRz+rz5g12KA9MuVddGESv3SQjV7CXBRYbk25S iQqz6J7tFBPJlw4dYKDsEl5D9+IEdpn6hL1SBayTR1oG2LIdUp8dHGog19BGTl+0q2iUT5QQ77+u I7/V0IR5w882POSMVxVRPexDbGWktiszgK09X9ubF6N7os1IVXlyHZJeKfFoQt9VWs4Apcc2FEbt /OE2cA3z85tuUNSXMJelEulX2x3ayEnxHNw6uA== )`
	RRSIG=5613 and DNSKEY=5613 verifies the DS RRset
	DS=1253/SHA-256 is now in the chain-of-trust
	DS=18942/SHA-256 is now in the chain-of-trust
	`at. 86400 IN DS ( 1253 13 2 ba17c1bacb3fb49f7760ad1f7e71e17ab39ee0df3e9d3bf23fd3d70d6cf1719e )`
	`at. 86400 IN DS ( 18942 13 2 ae5f0bd73c8f48f3d55cdc4070f9407873176c364de4bc92bf96887685e6e55f )`
	Query to ns2.univie.ac.at for at/DNSKEY
	Received 449 bytes from 192.92.125.2
	;; Response received from [192.92.125.2] 449 octets ;; HEADER SECTION ;; id = 37488 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 5 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1400, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; at. IN DNSKEY ;; ANSWER SECTION (5 records) at. 3600 IN DNSKEY ( 257 3 13 2JRF0JhWxU1FWmhF7eY9oPu4XkUdqPDVNi3tm6uXJ9DxltWjAS2JMBdAmm6ehsMdlsvsMV+cz+7D ZGMzNhbX1g== ) ; Key ID = 1253 at. 3600 IN DNSKEY ( 257 3 13 F4hxGBIycDfw7ZIeJ1bkOjeGibnoNdlJ9siahr/GPYh9sIftAPCNOSiypWUnNeKu9zHpFY+HtzzP gbZmLO1VRQ== ) ; Key ID = 18942 at. 3600 IN DNSKEY ( 256 3 13 Yye3yFQfyzze/CB9a+89JY/Zyf7L9gEXx9dI72oHyNU1mrMXdKU69LXiNAl9xnW+7BEFjO2NaxoI +h3F4tsF/A== ) ; Key ID = 8460 at. 3600 IN DNSKEY ( 256 3 13 afqJ2CAlm26vL9vdgWZlvBp1BhCXAvXGPDf96ykT8cf7i7uir4QQA5mLi9wikE4WnvD6Y8S9mU4f 3SUgmaQOEA== ) ; Key ID = 6345 at. 3600 IN RRSIG ( DNSKEY 13 1 3600 20240528074710 20240514030154 18942 at. 8Hf8sZ6P2CEkDq7267Wz+lUSp+qG14CqEZaa17J2Wxcjc3O/fY4jdHu0U2PgHVqw/u2crw3pXXzd ubupWfgBcg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 4 DNSKEY records for at
	`at. 3600 IN DNSKEY ( 257 3 13 2JRF0JhWxU1FWmhF7eY9oPu4XkUdqPDVNi3tm6uXJ9DxltWjAS2JMBdAmm6ehsMdlsvsMV+cz+7D ZGMzNhbX1g== ) ; Key ID = 1253`
	`at. 3600 IN DNSKEY ( 257 3 13 F4hxGBIycDfw7ZIeJ1bkOjeGibnoNdlJ9siahr/GPYh9sIftAPCNOSiypWUnNeKu9zHpFY+HtzzP gbZmLO1VRQ== ) ; Key ID = 18942`
	`at. 3600 IN DNSKEY ( 256 3 13 Yye3yFQfyzze/CB9a+89JY/Zyf7L9gEXx9dI72oHyNU1mrMXdKU69LXiNAl9xnW+7BEFjO2NaxoI +h3F4tsF/A== ) ; Key ID = 8460`
	`at. 3600 IN DNSKEY ( 256 3 13 afqJ2CAlm26vL9vdgWZlvBp1BhCXAvXGPDf96ykT8cf7i7uir4QQA5mLi9wikE4WnvD6Y8S9mU4f 3SUgmaQOEA== ) ; Key ID = 6345`
	DNSKEY=1253/SEP is now in the chain-of-trust
	DS=1253/SHA-256 verifies DNSKEY=1253/SEP
	DNSKEY=18942/SEP is now in the chain-of-trust
	DS=18942/SHA-256 verifies DNSKEY=18942/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`at. 3600 IN RRSIG ( DNSKEY 13 1 3600 20240528074710 20240514030154 18942 at. 8Hf8sZ6P2CEkDq7267Wz+lUSp+qG14CqEZaa17J2Wxcjc3O/fY4jdHu0U2PgHVqw/u2crw3pXXzd ubupWfgBcg== )`
	RRSIG=18942 and DNSKEY=18942/SEP verifies the DNSKEY RRset
	DNSKEY=8460 is now in the chain-of-trust
	DNSKEY=6345 is now in the chain-of-trust
	Query to u.ns.at for dotat.at/A
	Received 329 bytes from 185.102.12.2
	;; Response received from [185.102.12.2] 329 octets ;; HEADER SECTION ;; id = 57192 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 3 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1400, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) dotat.at. 10800 IN NS ns1.mythic-beasts.com. dotat.at. 10800 IN NS ns2.mythic-beasts.com. dotat.at. 10800 IN NS puck.nether.net. dotat.at. 10800 IN NS shale.dotat.at. dotat.at. 10800 IN DS ( 30212 13 2 a6624af402902c6cbc558a2b006c4f9348c91c5b86eea8a755d67d2063c60f96 ) dotat.at. 10800 IN RRSIG ( DS 13 2 10800 20240603195124 20240520100158 6345 at. y9UoMPWAG0H7fsLQUgY8m6a8aKfLGQSyrtHhZ0KEGhpjrd+dZ38m/eibwjGGVdRuN7OeGceBYAmD Cvpwewd8VQ== ) ;; ADDITIONAL SECTION (3 records) shale.dotat.at. 10800 IN A 93.93.130.7 shale.dotat.at. 10800 IN AAAA 2a00:1098:82:e0::1 ;; { "EDNS-VERSION": 0 }
	Query to ns2.univie.ac.at for dotat.at/DNSKEY
	Received 329 bytes from 192.92.125.2
	;; Response received from [192.92.125.2] 329 octets ;; HEADER SECTION ;; id = 5506 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 3 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1400, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) dotat.at. 10800 IN NS puck.nether.net. dotat.at. 10800 IN NS ns2.mythic-beasts.com. dotat.at. 10800 IN NS ns1.mythic-beasts.com. dotat.at. 10800 IN NS shale.dotat.at. dotat.at. 10800 IN DS ( 30212 13 2 a6624af402902c6cbc558a2b006c4f9348c91c5b86eea8a755d67d2063c60f96 ) dotat.at. 10800 IN RRSIG ( DS 13 2 10800 20240603195124 20240520100158 6345 at. y9UoMPWAG0H7fsLQUgY8m6a8aKfLGQSyrtHhZ0KEGhpjrd+dZ38m/eibwjGGVdRuN7OeGceBYAmD Cvpwewd8VQ== ) ;; ADDITIONAL SECTION (3 records) shale.dotat.at. 10800 IN A 93.93.130.7 shale.dotat.at. 10800 IN AAAA 2a00:1098:82:e0::1 ;; { "EDNS-VERSION": 0 }
	Found child zone dotat.at

dotat.at

	Checking DS between at and dotat.at
	Query to j.ns.at for dotat.at/DS
	Received 183 bytes from 194.146.106.50
	;; Response received from [194.146.106.50] 183 octets ;; HEADER SECTION ;; id = 2293 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN DS ;; ANSWER SECTION (2 records) dotat.at. 10800 IN DS ( 30212 13 2 a6624af402902c6cbc558a2b006c4f9348c91c5b86eea8a755d67d2063c60f96 ) dotat.at. 10800 IN RRSIG ( DS 13 2 10800 20240603195124 20240520100158 6345 at. y9UoMPWAG0H7fsLQUgY8m6a8aKfLGQSyrtHhZ0KEGhpjrd+dZ38m/eibwjGGVdRuN7OeGceBYAmD Cvpwewd8VQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for dotat.at in the at zone
	DS=30212/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`dotat.at. 10800 IN RRSIG ( DS 13 2 10800 20240603195124 20240520100158 6345 at. y9UoMPWAG0H7fsLQUgY8m6a8aKfLGQSyrtHhZ0KEGhpjrd+dZ38m/eibwjGGVdRuN7OeGceBYAmD Cvpwewd8VQ== )`
	RRSIG=6345 and DNSKEY=6345 verifies the DS RRset
	DS=30212/SHA-256 is now in the chain-of-trust
	`dotat.at. 10800 IN DS ( 30212 13 2 a6624af402902c6cbc558a2b006c4f9348c91c5b86eea8a755d67d2063c60f96 )`
	Query to ns2.mythic-beasts.com for dotat.at/DNSKEY
	Received 301 bytes from 93.93.128.67
	;; Response received from [93.93.128.67] 301 octets ;; HEADER SECTION ;; id = 56328 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN DNSKEY ;; ANSWER SECTION (3 records) dotat.at. 86400 IN DNSKEY ( 256 3 13 UQyviyYLsuoT2JmXtan0N5wYuVE4YrytdSWvwaI0Ky6UXbORB2IcjT2jZmpSV7vpMekHf6yxraj9 7N0o82TgCw== ) ; Key ID = 53798 dotat.at. 86400 IN DNSKEY ( 257 3 13 e6LidwEglekS0U2PEVlzbwzQ1/6tukK7LilO2qbJb32YQd/GjPRrhf4W8WcXsOySmyAOIviszeLX k+uXR8hQDw== ) ; Key ID = 30212 dotat.at. 86400 IN RRSIG ( DNSKEY 13 2 86400 20240531113141 20240521110144 30212 dotat.at. FvPIgQR96yJG8f7EPPo4PxQof062O0B/0jp7PnRcEEq6+H2R+VXeBiWtjTFR01aySHwOB1re7SP9 JUyof4BzrQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for dotat.at
	`dotat.at. 86400 IN DNSKEY ( 256 3 13 UQyviyYLsuoT2JmXtan0N5wYuVE4YrytdSWvwaI0Ky6UXbORB2IcjT2jZmpSV7vpMekHf6yxraj9 7N0o82TgCw== ) ; Key ID = 53798`
	`dotat.at. 86400 IN DNSKEY ( 257 3 13 e6LidwEglekS0U2PEVlzbwzQ1/6tukK7LilO2qbJb32YQd/GjPRrhf4W8WcXsOySmyAOIviszeLX k+uXR8hQDw== ) ; Key ID = 30212`
	DNSKEY=30212/SEP is now in the chain-of-trust
	DS=30212/SHA-256 verifies DNSKEY=30212/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`dotat.at. 86400 IN RRSIG ( DNSKEY 13 2 86400 20240531113141 20240521110144 30212 dotat.at. FvPIgQR96yJG8f7EPPo4PxQof062O0B/0jp7PnRcEEq6+H2R+VXeBiWtjTFR01aySHwOB1re7SP9 JUyof4BzrQ== )`
	RRSIG=30212 and DNSKEY=30212/SEP verifies the DNSKEY RRset
	DNSKEY=53798 is now in the chain-of-trust
	Query to puck.nether.net for dotat.at/A
	Received 157 bytes from 204.42.254.5
	;; Response received from [204.42.254.5] 157 octets ;; HEADER SECTION ;; id = 13454 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN A ;; ANSWER SECTION (2 records) dotat.at. 3600 IN A 93.93.131.173 dotat.at. 3600 IN RRSIG ( A 13 2 3600 20240531113141 20240521110144 53798 dotat.at. bCLqDWTJCyVcWD30UngEEcUndz5tttWqnKNaoIyMq2H0gmc7vCE8cHlcg5Ou0yP8eoI9n/glBhCy Sv3voJrHpg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	puck.nether.net is authoritative for dotat.at
	Found RRSIG signed by dotat.at zone
	Query to ns2.mythic-beasts.com for dotat.at/SOA
	Received 187 bytes from 93.93.128.67
	;; Response received from [93.93.128.67] 187 octets ;; HEADER SECTION ;; id = 2532 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN SOA ;; ANSWER SECTION (2 records) dotat.at. 3600 IN SOA ( shale.dotat.at. dot.dotat.at. 1716295557 ;serial 3600 ;refresh 3600 ;retry 604800 ;expire 3600 ;minimum ) dotat.at. 3600 IN RRSIG ( SOA 13 2 3600 20240531124557 20240521114557 53798 dotat.at. QNGSyhh5clHc2IaJjWiBE5E5KkMunR0xk6HOMYApHt+qwtxP+G+uhURi9KL+RyJ6m3OZhhKKYzZ1 qc06EImjpA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns1.mythic-beasts.com for dotat.at/SOA
	Received 187 bytes from 45.33.127.156
	;; Response received from [45.33.127.156] 187 octets ;; HEADER SECTION ;; id = 13374 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN SOA ;; ANSWER SECTION (2 records) dotat.at. 3600 IN SOA ( shale.dotat.at. dot.dotat.at. 1716295557 ;serial 3600 ;refresh 3600 ;retry 604800 ;expire 3600 ;minimum ) dotat.at. 3600 IN RRSIG ( SOA 13 2 3600 20240531124557 20240521114557 53798 dotat.at. QNGSyhh5clHc2IaJjWiBE5E5KkMunR0xk6HOMYApHt+qwtxP+G+uhURi9KL+RyJ6m3OZhhKKYzZ1 qc06EImjpA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to shale.dotat.at for dotat.at/SOA
	Received 187 bytes from 93.93.130.7
	;; Response received from [93.93.130.7] 187 octets ;; HEADER SECTION ;; id = 46401 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1420, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN SOA ;; ANSWER SECTION (2 records) dotat.at. 3600 IN SOA ( shale.dotat.at. dot.dotat.at. 1716295557 ;serial 3600 ;refresh 3600 ;retry 604800 ;expire 3600 ;minimum ) dotat.at. 3600 IN RRSIG ( SOA 13 2 3600 20240531124557 20240521114557 53798 dotat.at. QNGSyhh5clHc2IaJjWiBE5E5KkMunR0xk6HOMYApHt+qwtxP+G+uhURi9KL+RyJ6m3OZhhKKYzZ1 qc06EImjpA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to puck.nether.net for dotat.at/A
	Received 157 bytes from 204.42.254.5
	;; Response received from [204.42.254.5] 157 octets ;; HEADER SECTION ;; id = 35850 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN A ;; ANSWER SECTION (2 records) dotat.at. 3600 IN A 93.93.131.173 dotat.at. 3600 IN RRSIG ( A 13 2 3600 20240531113141 20240521110144 53798 dotat.at. bCLqDWTJCyVcWD30UngEEcUndz5tttWqnKNaoIyMq2H0gmc7vCE8cHlcg5Ou0yP8eoI9n/glBhCy Sv3voJrHpg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	dotat.at A RR has value 93.93.131.173
	Found 1 RRSIGs over A RRset
	`dotat.at. 3600 IN RRSIG ( A 13 2 3600 20240531113141 20240521110144 53798 dotat.at. bCLqDWTJCyVcWD30UngEEcUndz5tttWqnKNaoIyMq2H0gmc7vCE8cHlcg5Ou0yP8eoI9n/glBhCy Sv3voJrHpg== )`
	RRSIG=53798 and DNSKEY=53798 verifies the A RRset

dotat.at

	Query to ns1.mythic-beasts.com for dotat.at/A
	Received 157 bytes from 45.33.127.156
	;; Response received from [45.33.127.156] 157 octets ;; HEADER SECTION ;; id = 57127 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN A ;; ANSWER SECTION (2 records) dotat.at. 3600 IN A 93.93.131.173 dotat.at. 3600 IN RRSIG ( A 13 2 3600 20240531113141 20240521110144 53798 dotat.at. bCLqDWTJCyVcWD30UngEEcUndz5tttWqnKNaoIyMq2H0gmc7vCE8cHlcg5Ou0yP8eoI9n/glBhCy Sv3voJrHpg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns1.mythic-beasts.com is authoritative for dotat.at
	Found RRSIG signed by dotat.at zone
	Query to ns1.mythic-beasts.com for dotat.at/A
	Received 157 bytes from 45.33.127.156
	;; Response received from [45.33.127.156] 157 octets ;; HEADER SECTION ;; id = 56900 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN A ;; ANSWER SECTION (2 records) dotat.at. 3600 IN A 93.93.131.173 dotat.at. 3600 IN RRSIG ( A 13 2 3600 20240531113141 20240521110144 53798 dotat.at. bCLqDWTJCyVcWD30UngEEcUndz5tttWqnKNaoIyMq2H0gmc7vCE8cHlcg5Ou0yP8eoI9n/glBhCy Sv3voJrHpg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	dotat.at A RR has value 93.93.131.173
	Found 1 RRSIGs over A RRset
	`dotat.at. 3600 IN RRSIG ( A 13 2 3600 20240531113141 20240521110144 53798 dotat.at. bCLqDWTJCyVcWD30UngEEcUndz5tttWqnKNaoIyMq2H0gmc7vCE8cHlcg5Ou0yP8eoI9n/glBhCy Sv3voJrHpg== )`
	RRSIG=53798 and DNSKEY=53798 verifies the A RRset

dotat.at

	Query to shale.dotat.at for dotat.at/A
	Received 157 bytes from 93.93.130.7
	;; Response received from [93.93.130.7] 157 octets ;; HEADER SECTION ;; id = 42739 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1420, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN A ;; ANSWER SECTION (2 records) dotat.at. 3600 IN A 93.93.131.173 dotat.at. 3600 IN RRSIG ( A 13 2 3600 20240531113141 20240521110144 53798 dotat.at. bCLqDWTJCyVcWD30UngEEcUndz5tttWqnKNaoIyMq2H0gmc7vCE8cHlcg5Ou0yP8eoI9n/glBhCy Sv3voJrHpg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	shale.dotat.at is authoritative for dotat.at
	Found RRSIG signed by dotat.at zone
	Query to shale.dotat.at for dotat.at/A
	Received 157 bytes from 93.93.130.7
	;; Response received from [93.93.130.7] 157 octets ;; HEADER SECTION ;; id = 52148 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1420, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN A ;; ANSWER SECTION (2 records) dotat.at. 3600 IN A 93.93.131.173 dotat.at. 3600 IN RRSIG ( A 13 2 3600 20240531113141 20240521110144 53798 dotat.at. bCLqDWTJCyVcWD30UngEEcUndz5tttWqnKNaoIyMq2H0gmc7vCE8cHlcg5Ou0yP8eoI9n/glBhCy Sv3voJrHpg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	dotat.at A RR has value 93.93.131.173
	Found 1 RRSIGs over A RRset
	`dotat.at. 3600 IN RRSIG ( A 13 2 3600 20240531113141 20240521110144 53798 dotat.at. bCLqDWTJCyVcWD30UngEEcUndz5tttWqnKNaoIyMq2H0gmc7vCE8cHlcg5Ou0yP8eoI9n/glBhCy Sv3voJrHpg== )`
	RRSIG=53798 and DNSKEY=53798 verifies the A RRset

dotat.at

	Query to ns2.mythic-beasts.com for dotat.at/A
	Received 157 bytes from 93.93.128.67
	;; Response received from [93.93.128.67] 157 octets ;; HEADER SECTION ;; id = 2359 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN A ;; ANSWER SECTION (2 records) dotat.at. 3600 IN A 93.93.131.173 dotat.at. 3600 IN RRSIG ( A 13 2 3600 20240531113141 20240521110144 53798 dotat.at. bCLqDWTJCyVcWD30UngEEcUndz5tttWqnKNaoIyMq2H0gmc7vCE8cHlcg5Ou0yP8eoI9n/glBhCy Sv3voJrHpg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns2.mythic-beasts.com is authoritative for dotat.at
	Found RRSIG signed by dotat.at zone
	Query to ns2.mythic-beasts.com for dotat.at/A
	Received 157 bytes from 93.93.128.67
	;; Response received from [93.93.128.67] 157 octets ;; HEADER SECTION ;; id = 45005 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; dotat.at. IN A ;; ANSWER SECTION (2 records) dotat.at. 3600 IN A 93.93.131.173 dotat.at. 3600 IN RRSIG ( A 13 2 3600 20240531113141 20240521110144 53798 dotat.at. bCLqDWTJCyVcWD30UngEEcUndz5tttWqnKNaoIyMq2H0gmc7vCE8cHlcg5Ou0yP8eoI9n/glBhCy Sv3voJrHpg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	dotat.at A RR has value 93.93.131.173
	Found 1 RRSIGs over A RRset
	`dotat.at. 3600 IN RRSIG ( A 13 2 3600 20240531113141 20240521110144 53798 dotat.at. bCLqDWTJCyVcWD30UngEEcUndz5tttWqnKNaoIyMq2H0gmc7vCE8cHlcg5Ou0yP8eoI9n/glBhCy Sv3voJrHpg== )`
	RRSIG=53798 and DNSKEY=53798 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test dotat.at at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: