DNSSEC Debugger

Domain Name:

Time: 2024-05-13 13:22:45 UTC

Analyzing DNSSEC problems for gouv.tg

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to k.root-servers.net for ./DNSKEY
	Received 864 bytes from 193.0.14.129
	;; Response received from [193.0.14.129] 864 octets ;; HEADER SECTION ;; id = 41115 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20240601000000 20240511000000 20326 . OgCibhptSNJS9XS2WD2CXYw0HsdjPXn82iYAtzkE7ma1H2BfchG8nRnFZJ9fbrCjXAhDPnKCkuId 8cuJ2PGuLzy9Q3d4zIt7Ow5o8YkpKGEJB6uVi1BRauxVzKgH7u5QnKf8d1AlKFikFdBHHLaZ97XG ci02qRRm1jpe+aY4sLnKHx1kTJozHJp+Xaml/nCiS4AXrCxNyc4EH2/oraODfaewFIOQjpsAMeAw tPrccpst4ZL/9jmZUdRSs3IHwMk9gvSwpZI0YVBWZocKg96CmQQgq9NNNGhpI5gXXdbP++bu4myT GIx8wR1vjK7nau9GJK+76Bt4bc+1FIfpq4mbSg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20240601000000 20240511000000 20326 . OgCibhptSNJS9XS2WD2CXYw0HsdjPXn82iYAtzkE7ma1H2BfchG8nRnFZJ9fbrCjXAhDPnKCkuId 8cuJ2PGuLzy9Q3d4zIt7Ow5o8YkpKGEJB6uVi1BRauxVzKgH7u5QnKf8d1AlKFikFdBHHLaZ97XG ci02qRRm1jpe+aY4sLnKHx1kTJozHJp+Xaml/nCiS4AXrCxNyc4EH2/oraODfaewFIOQjpsAMeAw tPrccpst4ZL/9jmZUdRSs3IHwMk9gvSwpZI0YVBWZocKg96CmQQgq9NNNGhpI5gXXdbP++bu4myT GIx8wR1vjK7nau9GJK+76Bt4bc+1FIfpq4mbSg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=5613 is now in the chain-of-trust
	Query to c.root-servers.net for gouv.tg/A
	Received 753 bytes from 192.33.4.12
	;; Response received from [192.33.4.12] 753 octets ;; HEADER SECTION ;; id = 49581 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 10 arcount = 13 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gouv.tg. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (10 records) tg. 172800 IN NS ns2.nic.tg. tg. 172800 IN NS ns1.nic.tg. tg. 172800 IN NS ns1.admin.net. tg. 172800 IN NS ns3.admin.net. tg. 172800 IN NS ns5.admin.net. tg. 172800 IN NS ns4.admin.net. tg. 172800 IN NS ns2.admin.net. tg. 172800 IN NS tld.cafe.tg. tg. 86400 IN NSEC th. NS RRSIG NSEC tg. 86400 IN RRSIG ( NSEC 8 1 86400 20240526050000 20240513040000 5613 . TsKnO3vpaRsdHEqWeYAXX58I4Fx+wT4fAjsWub+sRDppCFYgiKG5VkPvAOuM+WoPyk21CYMcmMYR azF4g74l4OrpXBkSAVEG7rMYVreXjO+Jweb3fCDxcVDa+e8c+VgXrGSdJElcu+6ao0C4hWH2sAvm 3GH1zqk3642f8lrCbYESDNdmsOaaZnE8sV78nCyEg7CuG4vCDlGVMfHD2Z0XCle6sUKL1POnOGCn s2loDtAxLaVX/02HcVCvOcQnFCn5Zbr34cB+yNS31BVuFAA+bIkGQWQYGkCGCFg1GueBdIjJ/urK f+eSvoF1Q0kQrTMvojO4CSBrPTz+oakY9JRXGw== ) ;; ADDITIONAL SECTION (13 records) tld.cafe.tg. 172800 IN A 80.248.64.20 ns5.admin.net. 172800 IN A 188.165.33.42 ns4.admin.net. 172800 IN A 103.25.58.26 ns3.admin.net. 172800 IN A 87.98.180.44 ns2.admin.net. 172800 IN A 108.61.25.122 ns2.nic.tg. 172800 IN A 80.248.68.12 ns1.admin.net. 172800 IN A 198.73.186.1 ns1.nic.tg. 172800 IN A 41.207.188.36 ns5.admin.net. 172800 IN AAAA 2001:41d0:8:5c79::3 ns4.admin.net. 172800 IN AAAA 2406:d501::47e3:2a7c ns3.admin.net. 172800 IN AAAA 2001:41d0:2:8adf::2 ns2.admin.net. 172800 IN AAAA 2001:19f0:300:1007::cafe ;; { "EDNS-VERSION": 0 }
	Query to c.root-servers.net for tg/DNSKEY
	Received 748 bytes from 192.33.4.12
	;; Response received from [192.33.4.12] 748 octets ;; HEADER SECTION ;; id = 52281 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 10 arcount = 13 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; tg. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (10 records) tg. 172800 IN NS tld.cafe.tg. tg. 172800 IN NS ns2.nic.tg. tg. 172800 IN NS ns1.nic.tg. tg. 172800 IN NS ns3.admin.net. tg. 172800 IN NS ns1.admin.net. tg. 172800 IN NS ns2.admin.net. tg. 172800 IN NS ns4.admin.net. tg. 172800 IN NS ns5.admin.net. tg. 86400 IN NSEC th. NS RRSIG NSEC tg. 86400 IN RRSIG ( NSEC 8 1 86400 20240526050000 20240513040000 5613 . TsKnO3vpaRsdHEqWeYAXX58I4Fx+wT4fAjsWub+sRDppCFYgiKG5VkPvAOuM+WoPyk21CYMcmMYR azF4g74l4OrpXBkSAVEG7rMYVreXjO+Jweb3fCDxcVDa+e8c+VgXrGSdJElcu+6ao0C4hWH2sAvm 3GH1zqk3642f8lrCbYESDNdmsOaaZnE8sV78nCyEg7CuG4vCDlGVMfHD2Z0XCle6sUKL1POnOGCn s2loDtAxLaVX/02HcVCvOcQnFCn5Zbr34cB+yNS31BVuFAA+bIkGQWQYGkCGCFg1GueBdIjJ/urK f+eSvoF1Q0kQrTMvojO4CSBrPTz+oakY9JRXGw== ) ;; ADDITIONAL SECTION (13 records) tld.cafe.tg. 172800 IN A 80.248.64.20 ns5.admin.net. 172800 IN A 188.165.33.42 ns4.admin.net. 172800 IN A 103.25.58.26 ns3.admin.net. 172800 IN A 87.98.180.44 ns2.admin.net. 172800 IN A 108.61.25.122 ns2.nic.tg. 172800 IN A 80.248.68.12 ns1.admin.net. 172800 IN A 198.73.186.1 ns1.nic.tg. 172800 IN A 41.207.188.36 ns5.admin.net. 172800 IN AAAA 2001:41d0:8:5c79::3 ns4.admin.net. 172800 IN AAAA 2406:d501::47e3:2a7c ns3.admin.net. 172800 IN AAAA 2001:41d0:2:8adf::2 ns2.admin.net. 172800 IN AAAA 2001:19f0:300:1007::cafe ;; { "EDNS-VERSION": 0 }
	Found child zone tg

	Checking DS between . and tg
	Query to g.root-servers.net for tg/DS
	Received 703 bytes from 192.112.36.4
	;; Response received from [192.112.36.4] 703 octets ;; HEADER SECTION ;; id = 57972 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; tg. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) . 86400 IN SOA ( a.root-servers.net. nstld.verisign-grs.com. 2024051300 ;serial 1800 ;refresh 900 ;retry 604800 ;expire 86400 ;minimum ) . 86400 IN RRSIG ( SOA 8 0 86400 20240526050000 20240513040000 5613 . IDSsjFQCxQe2hyimtM66MmQERIBC7CkczNFz91ScqZ3zZ8i6MSOwRTQ6gUWob6P7xTpNazbZW7xI 2iSflqb2NlMR+46I6MQ13RC4mWqZVTSdAdgxyEdXiXyQLs6UXG+Gw/HW6l29PT450LdnZ1PJSa6S N46MT0PrcgVEUtdIqITFTAoviA0NYT6W26DAkwp7F54R82McvHXhYDKAF7UT9BwEOHpLwS6lGWGd j2TVRLpvAnofg9oibgv3PV2ZeNl3BqtS22FA5PtJP9NcIyn61Upa2prUxoibLfyIDHRJDxRVvtTA 4Gva91ro1u9QRSz1vxuATLiZ+0zdaGZRBSThtw== ) tg. 86400 IN NSEC th. NS RRSIG NSEC tg. 86400 IN RRSIG ( NSEC 8 1 86400 20240526050000 20240513040000 5613 . TsKnO3vpaRsdHEqWeYAXX58I4Fx+wT4fAjsWub+sRDppCFYgiKG5VkPvAOuM+WoPyk21CYMcmMYR azF4g74l4OrpXBkSAVEG7rMYVreXjO+Jweb3fCDxcVDa+e8c+VgXrGSdJElcu+6ao0C4hWH2sAvm 3GH1zqk3642f8lrCbYESDNdmsOaaZnE8sV78nCyEg7CuG4vCDlGVMfHD2Z0XCle6sUKL1POnOGCn s2loDtAxLaVX/02HcVCvOcQnFCn5Zbr34cB+yNS31BVuFAA+bIkGQWQYGkCGCFg1GueBdIjJ/urK f+eSvoF1Q0kQrTMvojO4CSBrPTz+oakY9JRXGw== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DS records found for tg in the . zone
	Query to ns4.admin.net for tg/DNSKEY
	Received 88 bytes from 103.25.58.26
	;; Response received from [103.25.58.26] 88 octets ;; HEADER SECTION ;; id = 28583 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 1 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; tg. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) tg. 86400 IN SOA ( ns1.nic.tg. hostmaster.nic.tg. 2024051348 ;serial 21600 ;refresh 3600 ;retry 604800 ;expire 86400 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DNSKEY records found
	Query to tld.cafe.tg for gouv.tg/A
	Received 181 bytes from 80.248.64.20
	;; Response received from [80.248.64.20] 181 octets ;; HEADER SECTION ;; id = 16998 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 5 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gouv.tg. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) gouv.tg. 86400 IN NS ns2.gouv.tg. gouv.tg. 86400 IN NS ns1.gouv.tg. gouv.tg. 86400 IN NS tld.cafe.tg. gouv.tg. 86400 IN NS ns1.nic.tg. ;; ADDITIONAL SECTION (5 records) ns1.gouv.tg. 86400 IN A 160.242.199.139 ns2.gouv.tg. 86400 IN A 216.108.227.14 ns1.nic.tg. 86400 IN A 41.207.188.36 tld.cafe.tg. 86400 IN A 80.248.64.20 ;; { "EDNS-VERSION": 0 }
	Query to ns2.admin.net for gouv.tg/DNSKEY
	Received 185 bytes from 128.199.117.237
	;; Response received from [128.199.117.237] 185 octets ;; HEADER SECTION ;; id = 65312 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 5 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gouv.tg. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) gouv.tg. 86400 IN NS ns1.gouv.tg. gouv.tg. 86400 IN NS ns2.gouv.tg. gouv.tg. 86400 IN NS tld.cafe.tg. gouv.tg. 86400 IN NS ns1.nic.tg. ;; ADDITIONAL SECTION (5 records) tld.cafe.tg. 86400 IN A 80.248.64.20 ns2.gouv.tg. 86400 IN A 216.108.227.14 ns1.gouv.tg. 86400 IN A 160.242.199.139 ns1.nic.tg. 86400 IN A 41.207.188.36 ;; { "EDNS-VERSION": 0 }
	Found child zone gouv.tg

gouv.tg

	Checking DS between tg and gouv.tg
	Query to ns4.admin.net for gouv.tg/DS
	Received 93 bytes from 103.25.58.26
	;; Response received from [103.25.58.26] 93 octets ;; HEADER SECTION ;; id = 53094 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 1 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gouv.tg. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) tg. 86400 IN SOA ( ns1.nic.tg. hostmaster.nic.tg. 2024051348 ;serial 21600 ;refresh 3600 ;retry 604800 ;expire 86400 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DS records found for gouv.tg in the tg zone
	Query to tld.cafe.tg for gouv.tg/DNSKEY
	Received 181 bytes from 80.248.64.20
	;; Response received from [80.248.64.20] 181 octets ;; HEADER SECTION ;; id = 63203 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 5 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gouv.tg. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) gouv.tg. 86400 IN NS ns2.gouv.tg. gouv.tg. 86400 IN NS ns1.gouv.tg. gouv.tg. 86400 IN NS ns1.nic.tg. gouv.tg. 86400 IN NS tld.cafe.tg. ;; ADDITIONAL SECTION (5 records) ns1.gouv.tg. 86400 IN A 160.242.199.139 ns2.gouv.tg. 86400 IN A 216.108.227.14 ns1.nic.tg. 86400 IN A 41.207.188.36 tld.cafe.tg. 86400 IN A 80.248.64.20 ;; { "EDNS-VERSION": 0 }
	No DNSKEY records found
	Query to tld.cafe.tg for gouv.tg/A
	Received 181 bytes from 80.248.64.20
	;; Response received from [80.248.64.20] 181 octets ;; HEADER SECTION ;; id = 35080 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 5 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gouv.tg. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) gouv.tg. 86400 IN NS ns1.gouv.tg. gouv.tg. 86400 IN NS ns2.gouv.tg. gouv.tg. 86400 IN NS tld.cafe.tg. gouv.tg. 86400 IN NS ns1.nic.tg. ;; ADDITIONAL SECTION (5 records) ns1.gouv.tg. 86400 IN A 160.242.199.139 ns2.gouv.tg. 86400 IN A 216.108.227.14 ns1.nic.tg. 86400 IN A 41.207.188.36 tld.cafe.tg. 86400 IN A 80.248.64.20 ;; { "EDNS-VERSION": 0 }
	Zone gouv.tg gives referral to itself. Lame.

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test gouv.tg at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: