DNSSEC Debugger - foo.eng.br

Domain Name:

Time: 2024-05-13 17:37:42 UTC

Analyzing DNSSEC problems for foo.eng.br

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to j.root-servers.net for ./DNSKEY
	Received 864 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 864 octets ;; HEADER SECTION ;; id = 7240 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20240601000000 20240511000000 20326 . OgCibhptSNJS9XS2WD2CXYw0HsdjPXn82iYAtzkE7ma1H2BfchG8nRnFZJ9fbrCjXAhDPnKCkuId 8cuJ2PGuLzy9Q3d4zIt7Ow5o8YkpKGEJB6uVi1BRauxVzKgH7u5QnKf8d1AlKFikFdBHHLaZ97XG ci02qRRm1jpe+aY4sLnKHx1kTJozHJp+Xaml/nCiS4AXrCxNyc4EH2/oraODfaewFIOQjpsAMeAw tPrccpst4ZL/9jmZUdRSs3IHwMk9gvSwpZI0YVBWZocKg96CmQQgq9NNNGhpI5gXXdbP++bu4myT GIx8wR1vjK7nau9GJK+76Bt4bc+1FIfpq4mbSg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20240601000000 20240511000000 20326 . OgCibhptSNJS9XS2WD2CXYw0HsdjPXn82iYAtzkE7ma1H2BfchG8nRnFZJ9fbrCjXAhDPnKCkuId 8cuJ2PGuLzy9Q3d4zIt7Ow5o8YkpKGEJB6uVi1BRauxVzKgH7u5QnKf8d1AlKFikFdBHHLaZ97XG ci02qRRm1jpe+aY4sLnKHx1kTJozHJp+Xaml/nCiS4AXrCxNyc4EH2/oraODfaewFIOQjpsAMeAw tPrccpst4ZL/9jmZUdRSs3IHwMk9gvSwpZI0YVBWZocKg96CmQQgq9NNNGhpI5gXXdbP++bu4myT GIx8wR1vjK7nau9GJK+76Bt4bc+1FIfpq4mbSg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=5613 is now in the chain-of-trust
	Query to h.root-servers.net for foo.eng.br/A
	Received 738 bytes from 198.97.190.53
	;; Response received from [198.97.190.53] 738 octets ;; HEADER SECTION ;; id = 21437 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 13 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; foo.eng.br. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) br. 172800 IN NS a.dns.br. br. 172800 IN NS b.dns.br. br. 172800 IN NS c.dns.br. br. 172800 IN NS d.dns.br. br. 172800 IN NS e.dns.br. br. 172800 IN NS f.dns.br. br. 86400 IN DS ( 38298 13 2 9f2d4993f47b0f2751de0007d70a2754ee532fe373761154d9ea7a8cb9d8ea18 ) br. 86400 IN RRSIG ( DS 8 1 86400 20240526050000 20240513040000 5613 . I1jY6WFmvVY3hfdgUZW3843Qg/EETebJC5n3kzQ2/3Wo4nIzqrcxHbywVX5TmcQlx1aj5ClBhRFK b2WQHhbx2bUk0DjEM4v8qLadhxi4SnJM1gyp4yIlTnGGqLKCNOvmYvzlGralnZYM/k3IPCS3vGgd a0spPYykxgVipl9wf4kBg8XWN3N5M+3sLMPUABmtSxXGagKT/p51bHoQmmK63FF07UI2/M6+OG07 +kH9FQGOa9iYmbSRPdUpC8ERKI/r4Tr1lI7MsbJMbiyxKwUAgj8BhR2HuHuelTjXXQ+ReAqTiL9A pTUoSzuR90zs9JhEx3C9gfXWYlFkF/P/vq+ZTw== ) ;; ADDITIONAL SECTION (13 records) a.dns.br. 172800 IN A 200.219.148.10 b.dns.br. 172800 IN A 200.189.41.10 c.dns.br. 172800 IN A 200.192.233.10 d.dns.br. 172800 IN A 200.219.154.10 e.dns.br. 172800 IN A 200.229.248.10 f.dns.br. 172800 IN A 200.219.159.10 a.dns.br. 172800 IN AAAA 2001:12f8:6::10 b.dns.br. 172800 IN AAAA 2001:12f8:8::10 c.dns.br. 172800 IN AAAA 2001:12f8:a::10 d.dns.br. 172800 IN AAAA 2001:12f8:4::10 e.dns.br. 172800 IN AAAA 2001:12f8:2::10 f.dns.br. 172800 IN AAAA 2001:12f8:c::10 ;; { "EDNS-VERSION": 0 }
	Query to j.root-servers.net for br/DNSKEY
	Received 730 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 730 octets ;; HEADER SECTION ;; id = 2344 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 13 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; br. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) br. 172800 IN NS a.dns.br. br. 172800 IN NS b.dns.br. br. 172800 IN NS c.dns.br. br. 172800 IN NS d.dns.br. br. 172800 IN NS e.dns.br. br. 172800 IN NS f.dns.br. br. 86400 IN DS ( 38298 13 2 9f2d4993f47b0f2751de0007d70a2754ee532fe373761154d9ea7a8cb9d8ea18 ) br. 86400 IN RRSIG ( DS 8 1 86400 20240526050000 20240513040000 5613 . I1jY6WFmvVY3hfdgUZW3843Qg/EETebJC5n3kzQ2/3Wo4nIzqrcxHbywVX5TmcQlx1aj5ClBhRFK b2WQHhbx2bUk0DjEM4v8qLadhxi4SnJM1gyp4yIlTnGGqLKCNOvmYvzlGralnZYM/k3IPCS3vGgd a0spPYykxgVipl9wf4kBg8XWN3N5M+3sLMPUABmtSxXGagKT/p51bHoQmmK63FF07UI2/M6+OG07 +kH9FQGOa9iYmbSRPdUpC8ERKI/r4Tr1lI7MsbJMbiyxKwUAgj8BhR2HuHuelTjXXQ+ReAqTiL9A pTUoSzuR90zs9JhEx3C9gfXWYlFkF/P/vq+ZTw== ) ;; ADDITIONAL SECTION (13 records) a.dns.br. 172800 IN A 200.219.148.10 b.dns.br. 172800 IN A 200.189.41.10 c.dns.br. 172800 IN A 200.192.233.10 d.dns.br. 172800 IN A 200.219.154.10 e.dns.br. 172800 IN A 200.229.248.10 f.dns.br. 172800 IN A 200.219.159.10 a.dns.br. 172800 IN AAAA 2001:12f8:6::10 b.dns.br. 172800 IN AAAA 2001:12f8:8::10 c.dns.br. 172800 IN AAAA 2001:12f8:a::10 d.dns.br. 172800 IN AAAA 2001:12f8:4::10 e.dns.br. 172800 IN AAAA 2001:12f8:2::10 f.dns.br. 172800 IN AAAA 2001:12f8:c::10 ;; { "EDNS-VERSION": 0 }
	Found child zone br

	Checking DS between . and br
	Query to l.root-servers.net for br/DS
	Received 366 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 366 octets ;; HEADER SECTION ;; id = 47217 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; br. IN DS ;; ANSWER SECTION (2 records) br. 86400 IN DS ( 38298 13 2 9f2d4993f47b0f2751de0007d70a2754ee532fe373761154d9ea7a8cb9d8ea18 ) br. 86400 IN RRSIG ( DS 8 1 86400 20240526050000 20240513040000 5613 . I1jY6WFmvVY3hfdgUZW3843Qg/EETebJC5n3kzQ2/3Wo4nIzqrcxHbywVX5TmcQlx1aj5ClBhRFK b2WQHhbx2bUk0DjEM4v8qLadhxi4SnJM1gyp4yIlTnGGqLKCNOvmYvzlGralnZYM/k3IPCS3vGgd a0spPYykxgVipl9wf4kBg8XWN3N5M+3sLMPUABmtSxXGagKT/p51bHoQmmK63FF07UI2/M6+OG07 +kH9FQGOa9iYmbSRPdUpC8ERKI/r4Tr1lI7MsbJMbiyxKwUAgj8BhR2HuHuelTjXXQ+ReAqTiL9A pTUoSzuR90zs9JhEx3C9gfXWYlFkF/P/vq+ZTw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for br in the . zone
	DS=38298/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`br. 86400 IN RRSIG ( DS 8 1 86400 20240526050000 20240513040000 5613 . I1jY6WFmvVY3hfdgUZW3843Qg/EETebJC5n3kzQ2/3Wo4nIzqrcxHbywVX5TmcQlx1aj5ClBhRFK b2WQHhbx2bUk0DjEM4v8qLadhxi4SnJM1gyp4yIlTnGGqLKCNOvmYvzlGralnZYM/k3IPCS3vGgd a0spPYykxgVipl9wf4kBg8XWN3N5M+3sLMPUABmtSxXGagKT/p51bHoQmmK63FF07UI2/M6+OG07 +kH9FQGOa9iYmbSRPdUpC8ERKI/r4Tr1lI7MsbJMbiyxKwUAgj8BhR2HuHuelTjXXQ+ReAqTiL9A pTUoSzuR90zs9JhEx3C9gfXWYlFkF/P/vq+ZTw== )`
	RRSIG=5613 and DNSKEY=5613 verifies the DS RRset
	DS=38298/SHA-256 is now in the chain-of-trust
	`br. 86400 IN DS ( 38298 13 2 9f2d4993f47b0f2751de0007d70a2754ee532fe373761154d9ea7a8cb9d8ea18 )`
	Query to e.dns.br for br/DNSKEY
	Received 289 bytes from 200.229.248.10
	;; Response received from [200.229.248.10] 289 octets ;; HEADER SECTION ;; id = 830 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; br. IN DNSKEY ;; ANSWER SECTION (3 records) br. 21600 IN DNSKEY ( 257 3 13 VWbLmSaCrrQ0Z4ohG46qa5DCVTx/z6fFU560Rv8JRTKH/CzNGFpqE7F5KCxT9hnduoDJEi0Z5kgH 66j1ePF9pQ== ) ; Key ID = 38298 br. 21600 IN DNSKEY ( 256 3 13 rkwnkBv/lnZEMb1ClLhBaqKkBvmiCvv2L591UkwfzZu/gZDD5Ko1ISuVR0U9sAl1c/RtCFLbBE8P C5iEGM5xYw== ) ; Key ID = 63547 br. 21600 IN RRSIG ( DNSKEY 13 1 21600 20240526120000 20240505120000 38298 br. QqAjvil+voxAHzYovbfy/hJscRyYEzcSky6QIGz6NaXWPJbfpnDZ5DFXJT4r5CWHfJZqxPWY+PCo 6jgJYJHPdQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for br
	`br. 21600 IN DNSKEY ( 257 3 13 VWbLmSaCrrQ0Z4ohG46qa5DCVTx/z6fFU560Rv8JRTKH/CzNGFpqE7F5KCxT9hnduoDJEi0Z5kgH 66j1ePF9pQ== ) ; Key ID = 38298`
	`br. 21600 IN DNSKEY ( 256 3 13 rkwnkBv/lnZEMb1ClLhBaqKkBvmiCvv2L591UkwfzZu/gZDD5Ko1ISuVR0U9sAl1c/RtCFLbBE8P C5iEGM5xYw== ) ; Key ID = 63547`
	DNSKEY=38298/SEP is now in the chain-of-trust
	DS=38298/SHA-256 verifies DNSKEY=38298/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`br. 21600 IN RRSIG ( DNSKEY 13 1 21600 20240526120000 20240505120000 38298 br. QqAjvil+voxAHzYovbfy/hJscRyYEzcSky6QIGz6NaXWPJbfpnDZ5DFXJT4r5CWHfJZqxPWY+PCo 6jgJYJHPdQ== )`
	RRSIG=38298 and DNSKEY=38298/SEP verifies the DNSKEY RRset
	DNSKEY=63547 is now in the chain-of-trust
	Query to c.dns.br for foo.eng.br/A
	Received 229 bytes from 200.192.233.10
	;; Response received from [200.192.233.10] 229 octets ;; HEADER SECTION ;; id = 64044 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; foo.eng.br. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) foo.eng.br. 3600 IN NS a.sec.dns.br. foo.eng.br. 3600 IN NS b.sec.dns.br. foo.eng.br. 3600 IN DS ( 40273 13 2 f7500ffd14814ef322cc521b83a6bdce245236df5172dc0041f0c6490f6ba5a0 ) foo.eng.br. 3600 IN RRSIG ( DS 13 3 3600 20240522190010 20240508180010 29363 eng.br. Fys3RmhzSrfSNyKoV4P5EaUbzM4+GozywV+aYY0hbMJ3BT8eCjzhMQhBILDKeokjgIeTUDfx5/iM KHLeoQDmsg== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to c.dns.br for eng.br/DNSKEY
	Received 297 bytes from 200.192.233.10
	;; Response received from [200.192.233.10] 297 octets ;; HEADER SECTION ;; id = 58139 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; eng.br. IN DNSKEY ;; ANSWER SECTION (3 records) eng.br. 21600 IN DNSKEY ( 257 3 13 yOIsAkzr2+9CW2K06n4049fZkJC3hi70YTzd7tCyiQMKvGFWds5iSk/hDgOG3q9AmrP0yKnDkoNy Hq9Zt5smpg== ) ; Key ID = 29363 eng.br. 21600 IN DNSKEY ( 257 3 13 JceM8hKiVEv8NeFh66mtaiZTrQQFgC3MciUiiIH1hU7PIPHX6L03v5GIsxKrVeAkyJdvAGvQhEOw pXS0DkJFgg== ) ; Key ID = 35149 eng.br. 21600 IN RRSIG ( DNSKEY 13 2 21600 20240527173512 20240513163512 29363 eng.br. GY1w1vbnoy3aOnDYFs09hgkOYM1eAHFzHpNUJFmZwvLCkkLPHB0l1aRV2A1gKEGJgPR64ygg56ev Q546Spcrqw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone eng.br
	Attempting to learn nameservers for eng.br
	Query to f.dns.br for eng.br/NS
	Received 239 bytes from 200.219.159.10
	;; Response received from [200.219.159.10] 239 octets ;; HEADER SECTION ;; id = 52497 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 7 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; eng.br. IN NS ;; ANSWER SECTION (7 records) eng.br. 172800 IN NS c.dns.br. eng.br. 172800 IN NS f.dns.br. eng.br. 172800 IN NS a.dns.br. eng.br. 172800 IN NS b.dns.br. eng.br. 172800 IN NS e.dns.br. eng.br. 172800 IN NS d.dns.br. eng.br. 172800 IN RRSIG ( NS 13 2 172800 20240527173512 20240513163512 29363 eng.br. WU0dmNRTZQ6WibyJ2K+SfxNc5sC59bDjnXOqywtQ8u0lPGIa+WwLUfP5X0M10hhjWQfRA7m0fsAo VlbLof9l4w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found eng.br nameservers: c.dns.br, f.dns.br, a.dns.br, b.dns.br, e.dns.br, d.dns.br

eng.br

	Checking DS between br and eng.br
	Query to e.dns.br for eng.br/DS
	Received 229 bytes from 200.229.248.10
	;; Response received from [200.229.248.10] 229 octets ;; HEADER SECTION ;; id = 63156 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; eng.br. IN DS ;; ANSWER SECTION (3 records) eng.br. 21600 IN DS ( 29363 13 2 10fc17937c5229b92d05452a7d9be15a9b830174ed56e12df80d7798e91f826a ) eng.br. 21600 IN DS ( 35149 13 2 7fea6ca18022eac38d31d6ca301f409ce9b8e5eec24b11acacd80a1e497eb0dc ) eng.br. 21600 IN RRSIG ( DS 13 2 21600 20240527120009 20240513110009 63547 br. MQ0XWKgWrHB4CguEi6BAffXVdSkwA+Aro+5Gn/5gc9PJwM1igw+lnJAhgF4rOk//vx5+QSjhH963 RQHecjdv3g== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DS records for eng.br in the br zone
	DS=29363/SHA-256 has algorithm ECDSAP256SHA256
	DS=35149/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`eng.br. 21600 IN RRSIG ( DS 13 2 21600 20240527120009 20240513110009 63547 br. MQ0XWKgWrHB4CguEi6BAffXVdSkwA+Aro+5Gn/5gc9PJwM1igw+lnJAhgF4rOk//vx5+QSjhH963 RQHecjdv3g== )`
	RRSIG=63547 and DNSKEY=63547 verifies the DS RRset
	DS=29363/SHA-256 is now in the chain-of-trust
	DS=35149/SHA-256 is now in the chain-of-trust
	`eng.br. 21600 IN DS ( 29363 13 2 10fc17937c5229b92d05452a7d9be15a9b830174ed56e12df80d7798e91f826a )`
	`eng.br. 21600 IN DS ( 35149 13 2 7fea6ca18022eac38d31d6ca301f409ce9b8e5eec24b11acacd80a1e497eb0dc )`
	Query to e.dns.br for eng.br/DNSKEY
	Received 297 bytes from 200.229.248.10
	;; Response received from [200.229.248.10] 297 octets ;; HEADER SECTION ;; id = 25837 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; eng.br. IN DNSKEY ;; ANSWER SECTION (3 records) eng.br. 21600 IN DNSKEY ( 257 3 13 JceM8hKiVEv8NeFh66mtaiZTrQQFgC3MciUiiIH1hU7PIPHX6L03v5GIsxKrVeAkyJdvAGvQhEOw pXS0DkJFgg== ) ; Key ID = 35149 eng.br. 21600 IN DNSKEY ( 257 3 13 yOIsAkzr2+9CW2K06n4049fZkJC3hi70YTzd7tCyiQMKvGFWds5iSk/hDgOG3q9AmrP0yKnDkoNy Hq9Zt5smpg== ) ; Key ID = 29363 eng.br. 21600 IN RRSIG ( DNSKEY 13 2 21600 20240527173512 20240513163512 29363 eng.br. GY1w1vbnoy3aOnDYFs09hgkOYM1eAHFzHpNUJFmZwvLCkkLPHB0l1aRV2A1gKEGJgPR64ygg56ev Q546Spcrqw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for eng.br
	`eng.br. 21600 IN DNSKEY ( 257 3 13 JceM8hKiVEv8NeFh66mtaiZTrQQFgC3MciUiiIH1hU7PIPHX6L03v5GIsxKrVeAkyJdvAGvQhEOw pXS0DkJFgg== ) ; Key ID = 35149`
	`eng.br. 21600 IN DNSKEY ( 257 3 13 yOIsAkzr2+9CW2K06n4049fZkJC3hi70YTzd7tCyiQMKvGFWds5iSk/hDgOG3q9AmrP0yKnDkoNy Hq9Zt5smpg== ) ; Key ID = 29363`
	DNSKEY=35149/SEP is now in the chain-of-trust
	DS=35149/SHA-256 verifies DNSKEY=35149/SEP
	DNSKEY=29363/SEP is now in the chain-of-trust
	DS=29363/SHA-256 verifies DNSKEY=29363/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`eng.br. 21600 IN RRSIG ( DNSKEY 13 2 21600 20240527173512 20240513163512 29363 eng.br. GY1w1vbnoy3aOnDYFs09hgkOYM1eAHFzHpNUJFmZwvLCkkLPHB0l1aRV2A1gKEGJgPR64ygg56ev Q546Spcrqw== )`
	RRSIG=29363 and DNSKEY=29363/SEP verifies the DNSKEY RRset
	Query to a.dns.br for foo.eng.br/A
	Received 229 bytes from 200.219.148.10
	;; Response received from [200.219.148.10] 229 octets ;; HEADER SECTION ;; id = 38916 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; foo.eng.br. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) foo.eng.br. 3600 IN NS a.sec.dns.br. foo.eng.br. 3600 IN NS b.sec.dns.br. foo.eng.br. 3600 IN DS ( 40273 13 2 f7500ffd14814ef322cc521b83a6bdce245236df5172dc0041f0c6490f6ba5a0 ) foo.eng.br. 3600 IN RRSIG ( DS 13 3 3600 20240522190010 20240508180010 29363 eng.br. Fys3RmhzSrfSNyKoV4P5EaUbzM4+GozywV+aYY0hbMJ3BT8eCjzhMQhBILDKeokjgIeTUDfx5/iM KHLeoQDmsg== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to f.dns.br for foo.eng.br/DNSKEY
	Received 231 bytes from 200.219.159.10
	;; Response received from [200.219.159.10] 231 octets ;; HEADER SECTION ;; id = 49261 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; foo.eng.br. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) foo.eng.br. 3600 IN NS a.sec.dns.br. foo.eng.br. 3600 IN NS b.sec.dns.br. foo.eng.br. 3600 IN DS ( 40273 13 2 f7500ffd14814ef322cc521b83a6bdce245236df5172dc0041f0c6490f6ba5a0 ) foo.eng.br. 3600 IN RRSIG ( DS 13 3 3600 20240522190010 20240508180010 29363 eng.br. Fys3RmhzSrfSNyKoV4P5EaUbzM4+GozywV+aYY0hbMJ3BT8eCjzhMQhBILDKeokjgIeTUDfx5/iM KHLeoQDmsg== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone foo.eng.br

foo.eng.br

	Checking DS between eng.br and foo.eng.br
	Query to b.dns.br for foo.eng.br/DS
	Received 189 bytes from 200.189.41.10
	;; Response received from [200.189.41.10] 189 octets ;; HEADER SECTION ;; id = 62169 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; foo.eng.br. IN DS ;; ANSWER SECTION (2 records) foo.eng.br. 3600 IN DS ( 40273 13 2 f7500ffd14814ef322cc521b83a6bdce245236df5172dc0041f0c6490f6ba5a0 ) foo.eng.br. 3600 IN RRSIG ( DS 13 3 3600 20240522190010 20240508180010 29363 eng.br. Fys3RmhzSrfSNyKoV4P5EaUbzM4+GozywV+aYY0hbMJ3BT8eCjzhMQhBILDKeokjgIeTUDfx5/iM KHLeoQDmsg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for foo.eng.br in the eng.br zone
	DS=40273/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`foo.eng.br. 3600 IN RRSIG ( DS 13 3 3600 20240522190010 20240508180010 29363 eng.br. Fys3RmhzSrfSNyKoV4P5EaUbzM4+GozywV+aYY0hbMJ3BT8eCjzhMQhBILDKeokjgIeTUDfx5/iM KHLeoQDmsg== )`
	RRSIG=29363 and DNSKEY=29363/SEP verifies the DS RRset
	DS=40273/SHA-256 is now in the chain-of-trust
	`foo.eng.br. 3600 IN DS ( 40273 13 2 f7500ffd14814ef322cc521b83a6bdce245236df5172dc0041f0c6490f6ba5a0 )`
	Query to b.sec.dns.br for foo.eng.br/DNSKEY
	Received 225 bytes from 200.192.232.11
	;; Response received from [200.192.232.11] 225 octets ;; HEADER SECTION ;; id = 63322 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; foo.eng.br. IN DNSKEY ;; ANSWER SECTION (2 records) foo.eng.br. 3600 IN DNSKEY ( 257 3 13 JrijzHSI/qq5qFREfcNUYqdcKePm/Ai0cC15XB3UIjQ9pzuykILbCsl3NEoQejFAEKhx72mldwFa 0QPepN4Fxg== ) ; Key ID = 40273 foo.eng.br. 3600 IN RRSIG ( DNSKEY 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. e5VPvZ3ziYxiDUqip9J3M6HHGJ+cvjTTa9/Q8RxAMNJpMHyB/M7Xjn+z+vRneJQByJB9jPdu1mSR Cw/IQi5qrw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DNSKEY records for foo.eng.br
	`foo.eng.br. 3600 IN DNSKEY ( 257 3 13 JrijzHSI/qq5qFREfcNUYqdcKePm/Ai0cC15XB3UIjQ9pzuykILbCsl3NEoQejFAEKhx72mldwFa 0QPepN4Fxg== ) ; Key ID = 40273`
	DNSKEY=40273/SEP is now in the chain-of-trust
	DS=40273/SHA-256 verifies DNSKEY=40273/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`foo.eng.br. 3600 IN RRSIG ( DNSKEY 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. e5VPvZ3ziYxiDUqip9J3M6HHGJ+cvjTTa9/Q8RxAMNJpMHyB/M7Xjn+z+vRneJQByJB9jPdu1mSR Cw/IQi5qrw== )`
	RRSIG=40273 and DNSKEY=40273/SEP verifies the DNSKEY RRset
	Query to b.sec.dns.br for foo.eng.br/A
	Received 309 bytes from 200.192.232.11
	;; Response received from [200.192.232.11] 309 octets ;; HEADER SECTION ;; id = 4617 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 3 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; foo.eng.br. IN A ;; ANSWER SECTION (2 records) foo.eng.br. 3600 IN A 200.160.7.134 foo.eng.br. 3600 IN RRSIG ( A 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. KlQ4INx6i0whlrHwLY8ALznZUEaHmw6usmzyTbJ/9wlzHGatAdY4rYxZBOsdozOoinHAvqoGVue1 sATINXJzyw== ) ;; AUTHORITY SECTION (3 records) foo.eng.br. 3600 IN NS b.sec.dns.br. foo.eng.br. 3600 IN NS a.sec.dns.br. foo.eng.br. 3600 IN RRSIG ( NS 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. F01CzlTURHjW355l6NpTb/tAlPwSHfNf8dv8em6ho3lzIdZDq0Bcrv7UqjPAbaHnyWB5W3p8u0Nu AvAk044f9Q== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	b.sec.dns.br is authoritative for foo.eng.br
	Found RRSIG signed by foo.eng.br zone
	Query to a.sec.dns.br for foo.eng.br/SOA
	Received 351 bytes from 200.160.0.11
	;; Response received from [200.160.0.11] 351 octets ;; HEADER SECTION ;; id = 58512 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 3 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; foo.eng.br. IN SOA ;; ANSWER SECTION (2 records) foo.eng.br. 3600 IN SOA ( a.sec.dns.br. hostmaster.registro.br. 2024128000 ;serial 345600 ;refresh 900 ;retry 604800 ;expire 900 ;minimum ) foo.eng.br. 3600 IN RRSIG ( SOA 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. YuDTGAdovPgj69etdASQ7HOBKXKT3jiqcBB4R7vydP5EINp0pJ6qKISIAEvl8dLOLGbV4ACPV/Gc 7xwBv4FrSg== ) ;; AUTHORITY SECTION (3 records) foo.eng.br. 3600 IN NS b.sec.dns.br. foo.eng.br. 3600 IN NS a.sec.dns.br. foo.eng.br. 3600 IN RRSIG ( NS 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. F01CzlTURHjW355l6NpTb/tAlPwSHfNf8dv8em6ho3lzIdZDq0Bcrv7UqjPAbaHnyWB5W3p8u0Nu AvAk044f9Q== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to b.sec.dns.br for foo.eng.br/A
	Received 309 bytes from 200.192.232.11
	;; Response received from [200.192.232.11] 309 octets ;; HEADER SECTION ;; id = 27354 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 3 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; foo.eng.br. IN A ;; ANSWER SECTION (2 records) foo.eng.br. 3600 IN A 200.160.7.134 foo.eng.br. 3600 IN RRSIG ( A 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. KlQ4INx6i0whlrHwLY8ALznZUEaHmw6usmzyTbJ/9wlzHGatAdY4rYxZBOsdozOoinHAvqoGVue1 sATINXJzyw== ) ;; AUTHORITY SECTION (3 records) foo.eng.br. 3600 IN NS b.sec.dns.br. foo.eng.br. 3600 IN NS a.sec.dns.br. foo.eng.br. 3600 IN RRSIG ( NS 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. F01CzlTURHjW355l6NpTb/tAlPwSHfNf8dv8em6ho3lzIdZDq0Bcrv7UqjPAbaHnyWB5W3p8u0Nu AvAk044f9Q== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	foo.eng.br A RR has value 200.160.7.134
	Found 1 RRSIGs over A RRset
	`foo.eng.br. 3600 IN RRSIG ( A 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. KlQ4INx6i0whlrHwLY8ALznZUEaHmw6usmzyTbJ/9wlzHGatAdY4rYxZBOsdozOoinHAvqoGVue1 sATINXJzyw== )`
	RRSIG=40273 and DNSKEY=40273/SEP verifies the A RRset

foo.eng.br

	Query to a.sec.dns.br for foo.eng.br/A
	Received 309 bytes from 200.160.0.11
	;; Response received from [200.160.0.11] 309 octets ;; HEADER SECTION ;; id = 1495 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 3 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; foo.eng.br. IN A ;; ANSWER SECTION (2 records) foo.eng.br. 3600 IN A 200.160.7.134 foo.eng.br. 3600 IN RRSIG ( A 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. KlQ4INx6i0whlrHwLY8ALznZUEaHmw6usmzyTbJ/9wlzHGatAdY4rYxZBOsdozOoinHAvqoGVue1 sATINXJzyw== ) ;; AUTHORITY SECTION (3 records) foo.eng.br. 3600 IN NS a.sec.dns.br. foo.eng.br. 3600 IN NS b.sec.dns.br. foo.eng.br. 3600 IN RRSIG ( NS 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. F01CzlTURHjW355l6NpTb/tAlPwSHfNf8dv8em6ho3lzIdZDq0Bcrv7UqjPAbaHnyWB5W3p8u0Nu AvAk044f9Q== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a.sec.dns.br is authoritative for foo.eng.br
	Found RRSIG signed by foo.eng.br zone
	Query to a.sec.dns.br for foo.eng.br/A
	Received 309 bytes from 200.160.0.11
	;; Response received from [200.160.0.11] 309 octets ;; HEADER SECTION ;; id = 39420 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 3 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; foo.eng.br. IN A ;; ANSWER SECTION (2 records) foo.eng.br. 3600 IN A 200.160.7.134 foo.eng.br. 3600 IN RRSIG ( A 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. KlQ4INx6i0whlrHwLY8ALznZUEaHmw6usmzyTbJ/9wlzHGatAdY4rYxZBOsdozOoinHAvqoGVue1 sATINXJzyw== ) ;; AUTHORITY SECTION (3 records) foo.eng.br. 3600 IN NS b.sec.dns.br. foo.eng.br. 3600 IN NS a.sec.dns.br. foo.eng.br. 3600 IN RRSIG ( NS 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. F01CzlTURHjW355l6NpTb/tAlPwSHfNf8dv8em6ho3lzIdZDq0Bcrv7UqjPAbaHnyWB5W3p8u0Nu AvAk044f9Q== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	foo.eng.br A RR has value 200.160.7.134
	Found 1 RRSIGs over A RRset
	`foo.eng.br. 3600 IN RRSIG ( A 13 3 3600 20240616172010 20240507162010 40273 foo.eng.br. KlQ4INx6i0whlrHwLY8ALznZUEaHmw6usmzyTbJ/9wlzHGatAdY4rYxZBOsdozOoinHAvqoGVue1 sATINXJzyw== )`
	RRSIG=40273 and DNSKEY=40273/SEP verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test foo.eng.br at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: