DNSSEC Debugger - labs.eti.br

Analyzing DNSSEC problems for labs.eti.br

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to d.root-servers.net for ./DNSKEY
	Received 864 bytes from 199.7.91.13
	;; Response received from [199.7.91.13] 864 octets ;; HEADER SECTION ;; id = 41982 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1450, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20240601000000 20240511000000 20326 . OgCibhptSNJS9XS2WD2CXYw0HsdjPXn82iYAtzkE7ma1H2BfchG8nRnFZJ9fbrCjXAhDPnKCkuId 8cuJ2PGuLzy9Q3d4zIt7Ow5o8YkpKGEJB6uVi1BRauxVzKgH7u5QnKf8d1AlKFikFdBHHLaZ97XG ci02qRRm1jpe+aY4sLnKHx1kTJozHJp+Xaml/nCiS4AXrCxNyc4EH2/oraODfaewFIOQjpsAMeAw tPrccpst4ZL/9jmZUdRSs3IHwMk9gvSwpZI0YVBWZocKg96CmQQgq9NNNGhpI5gXXdbP++bu4myT GIx8wR1vjK7nau9GJK+76Bt4bc+1FIfpq4mbSg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20240601000000 20240511000000 20326 . OgCibhptSNJS9XS2WD2CXYw0HsdjPXn82iYAtzkE7ma1H2BfchG8nRnFZJ9fbrCjXAhDPnKCkuId 8cuJ2PGuLzy9Q3d4zIt7Ow5o8YkpKGEJB6uVi1BRauxVzKgH7u5QnKf8d1AlKFikFdBHHLaZ97XG ci02qRRm1jpe+aY4sLnKHx1kTJozHJp+Xaml/nCiS4AXrCxNyc4EH2/oraODfaewFIOQjpsAMeAw tPrccpst4ZL/9jmZUdRSs3IHwMk9gvSwpZI0YVBWZocKg96CmQQgq9NNNGhpI5gXXdbP++bu4myT GIx8wR1vjK7nau9GJK+76Bt4bc+1FIfpq4mbSg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=5613 is now in the chain-of-trust
	Query to c.root-servers.net for labs.eti.br/A
	Received 743 bytes from 192.33.4.12
	;; Response received from [192.33.4.12] 743 octets ;; HEADER SECTION ;; id = 38396 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 13 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; labs.eti.br. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) br. 172800 IN NS b.dns.br. br. 172800 IN NS f.dns.br. br. 172800 IN NS a.dns.br. br. 172800 IN NS e.dns.br. br. 172800 IN NS c.dns.br. br. 172800 IN NS d.dns.br. br. 86400 IN DS ( 38298 13 2 9f2d4993f47b0f2751de0007d70a2754ee532fe373761154d9ea7a8cb9d8ea18 ) br. 86400 IN RRSIG ( DS 8 1 86400 20240531170000 20240518160000 5613 . Z3cJNv9yENgfdIZYJnWjvxVCN4rjOx9P8nS/ENcuIj5VhjhtXYx9Jc0Ce4BUkNHWZWKF+XOOOfzB k4uPuIjihAO+qLH/Na+wfjK/TYs/ZH4aUXm8bx4N2U9LbX8ZV85ovfFNg1/oKWn97fF6dnUGKQjP Pa5VPXCXs2kJbszw/uiKCV5Uz2W9zRJrkVDF3fhvB9uQbugOg2PvQlMCTg+yPufSESq17j4KEErX DirD8DUKJOIOWph1GkRJmVAYa9Fi5c+govVjlnrFUg0H1MtNDg0dugKZjP6gYDwaJntIZPH/NdEw zT/eOKuhTJ4su+VZCQdyLvXRhZOJ+BTVlgzT2A== ) ;; ADDITIONAL SECTION (13 records) f.dns.br. 172800 IN A 200.219.159.10 e.dns.br. 172800 IN A 200.229.248.10 d.dns.br. 172800 IN A 200.219.154.10 c.dns.br. 172800 IN A 200.192.233.10 b.dns.br. 172800 IN A 200.189.41.10 a.dns.br. 172800 IN A 200.219.148.10 f.dns.br. 172800 IN AAAA 2001:12f8:c::10 e.dns.br. 172800 IN AAAA 2001:12f8:2::10 d.dns.br. 172800 IN AAAA 2001:12f8:4::10 c.dns.br. 172800 IN AAAA 2001:12f8:a::10 b.dns.br. 172800 IN AAAA 2001:12f8:8::10 a.dns.br. 172800 IN AAAA 2001:12f8:6::10 ;; { "EDNS-VERSION": 0 }
	Query to f.root-servers.net for br/DNSKEY
	Received 730 bytes from 192.5.5.241
	;; Response received from [192.5.5.241] 730 octets ;; HEADER SECTION ;; id = 3901 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 13 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; br. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) br. 172800 IN NS a.dns.br. br. 172800 IN NS b.dns.br. br. 172800 IN NS c.dns.br. br. 172800 IN NS d.dns.br. br. 172800 IN NS e.dns.br. br. 172800 IN NS f.dns.br. br. 86400 IN DS ( 38298 13 2 9f2d4993f47b0f2751de0007d70a2754ee532fe373761154d9ea7a8cb9d8ea18 ) br. 86400 IN RRSIG ( DS 8 1 86400 20240531170000 20240518160000 5613 . Z3cJNv9yENgfdIZYJnWjvxVCN4rjOx9P8nS/ENcuIj5VhjhtXYx9Jc0Ce4BUkNHWZWKF+XOOOfzB k4uPuIjihAO+qLH/Na+wfjK/TYs/ZH4aUXm8bx4N2U9LbX8ZV85ovfFNg1/oKWn97fF6dnUGKQjP Pa5VPXCXs2kJbszw/uiKCV5Uz2W9zRJrkVDF3fhvB9uQbugOg2PvQlMCTg+yPufSESq17j4KEErX DirD8DUKJOIOWph1GkRJmVAYa9Fi5c+govVjlnrFUg0H1MtNDg0dugKZjP6gYDwaJntIZPH/NdEw zT/eOKuhTJ4su+VZCQdyLvXRhZOJ+BTVlgzT2A== ) ;; ADDITIONAL SECTION (13 records) a.dns.br. 172800 IN A 200.219.148.10 a.dns.br. 172800 IN AAAA 2001:12f8:6::10 b.dns.br. 172800 IN A 200.189.41.10 b.dns.br. 172800 IN AAAA 2001:12f8:8::10 c.dns.br. 172800 IN A 200.192.233.10 c.dns.br. 172800 IN AAAA 2001:12f8:a::10 d.dns.br. 172800 IN A 200.219.154.10 d.dns.br. 172800 IN AAAA 2001:12f8:4::10 e.dns.br. 172800 IN A 200.229.248.10 e.dns.br. 172800 IN AAAA 2001:12f8:2::10 f.dns.br. 172800 IN A 200.219.159.10 f.dns.br. 172800 IN AAAA 2001:12f8:c::10 ;; { "EDNS-VERSION": 0 }
	Found child zone br

	Checking DS between . and br
	Query to b.root-servers.net for br/DS
	Received 366 bytes from 170.247.170.2
	;; Response received from [170.247.170.2] 366 octets ;; HEADER SECTION ;; id = 48781 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; br. IN DS ;; ANSWER SECTION (2 records) br. 86400 IN DS ( 38298 13 2 9f2d4993f47b0f2751de0007d70a2754ee532fe373761154d9ea7a8cb9d8ea18 ) br. 86400 IN RRSIG ( DS 8 1 86400 20240531170000 20240518160000 5613 . Z3cJNv9yENgfdIZYJnWjvxVCN4rjOx9P8nS/ENcuIj5VhjhtXYx9Jc0Ce4BUkNHWZWKF+XOOOfzB k4uPuIjihAO+qLH/Na+wfjK/TYs/ZH4aUXm8bx4N2U9LbX8ZV85ovfFNg1/oKWn97fF6dnUGKQjP Pa5VPXCXs2kJbszw/uiKCV5Uz2W9zRJrkVDF3fhvB9uQbugOg2PvQlMCTg+yPufSESq17j4KEErX DirD8DUKJOIOWph1GkRJmVAYa9Fi5c+govVjlnrFUg0H1MtNDg0dugKZjP6gYDwaJntIZPH/NdEw zT/eOKuhTJ4su+VZCQdyLvXRhZOJ+BTVlgzT2A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for br in the . zone
	DS=38298/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`br. 86400 IN RRSIG ( DS 8 1 86400 20240531170000 20240518160000 5613 . Z3cJNv9yENgfdIZYJnWjvxVCN4rjOx9P8nS/ENcuIj5VhjhtXYx9Jc0Ce4BUkNHWZWKF+XOOOfzB k4uPuIjihAO+qLH/Na+wfjK/TYs/ZH4aUXm8bx4N2U9LbX8ZV85ovfFNg1/oKWn97fF6dnUGKQjP Pa5VPXCXs2kJbszw/uiKCV5Uz2W9zRJrkVDF3fhvB9uQbugOg2PvQlMCTg+yPufSESq17j4KEErX DirD8DUKJOIOWph1GkRJmVAYa9Fi5c+govVjlnrFUg0H1MtNDg0dugKZjP6gYDwaJntIZPH/NdEw zT/eOKuhTJ4su+VZCQdyLvXRhZOJ+BTVlgzT2A== )`
	RRSIG=5613 and DNSKEY=5613 verifies the DS RRset
	DS=38298/SHA-256 is now in the chain-of-trust
	`br. 86400 IN DS ( 38298 13 2 9f2d4993f47b0f2751de0007d70a2754ee532fe373761154d9ea7a8cb9d8ea18 )`
	Query to b.dns.br for br/DNSKEY
	Received 289 bytes from 200.189.41.10
	;; Response received from [200.189.41.10] 289 octets ;; HEADER SECTION ;; id = 46649 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; br. IN DNSKEY ;; ANSWER SECTION (3 records) br. 21600 IN DNSKEY ( 257 3 13 VWbLmSaCrrQ0Z4ohG46qa5DCVTx/z6fFU560Rv8JRTKH/CzNGFpqE7F5KCxT9hnduoDJEi0Z5kgH 66j1ePF9pQ== ) ; Key ID = 38298 br. 21600 IN DNSKEY ( 256 3 13 rkwnkBv/lnZEMb1ClLhBaqKkBvmiCvv2L591UkwfzZu/gZDD5Ko1ISuVR0U9sAl1c/RtCFLbBE8P C5iEGM5xYw== ) ; Key ID = 63547 br. 21600 IN RRSIG ( DNSKEY 13 1 21600 20240526120000 20240505120000 38298 br. QqAjvil+voxAHzYovbfy/hJscRyYEzcSky6QIGz6NaXWPJbfpnDZ5DFXJT4r5CWHfJZqxPWY+PCo 6jgJYJHPdQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for br
	`br. 21600 IN DNSKEY ( 257 3 13 VWbLmSaCrrQ0Z4ohG46qa5DCVTx/z6fFU560Rv8JRTKH/CzNGFpqE7F5KCxT9hnduoDJEi0Z5kgH 66j1ePF9pQ== ) ; Key ID = 38298`
	`br. 21600 IN DNSKEY ( 256 3 13 rkwnkBv/lnZEMb1ClLhBaqKkBvmiCvv2L591UkwfzZu/gZDD5Ko1ISuVR0U9sAl1c/RtCFLbBE8P C5iEGM5xYw== ) ; Key ID = 63547`
	DNSKEY=38298/SEP is now in the chain-of-trust
	DS=38298/SHA-256 verifies DNSKEY=38298/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`br. 21600 IN RRSIG ( DNSKEY 13 1 21600 20240526120000 20240505120000 38298 br. QqAjvil+voxAHzYovbfy/hJscRyYEzcSky6QIGz6NaXWPJbfpnDZ5DFXJT4r5CWHfJZqxPWY+PCo 6jgJYJHPdQ== )`
	RRSIG=38298 and DNSKEY=38298/SEP verifies the DNSKEY RRset
	DNSKEY=63547 is now in the chain-of-trust
	Query to b.dns.br for labs.eti.br/A
	Received 482 bytes from 200.189.41.10
	;; Response received from [200.189.41.10] 482 octets ;; HEADER SECTION ;; id = 34352 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NXDOMAIN ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; labs.eti.br. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) eti.br. 900 IN SOA ( a.dns.br. hostmaster.registro.br. 2024140142 ;serial 1800 ;refresh 900 ;retry 604800 ;expire 900 ;minimum ) eti.br. 900 IN RRSIG ( SOA 13 2 172800 20240602055509 20240519045509 35149 eti.br. Qmju8mf0eUB5eA6/4eda+74nfMZpEtaRoarIrSb9Ma9d6c5nOyTlftRpcybZYB/3auAeqRQJv+5D GJSiWgSrGA== ) eti.br. 900 IN NSEC 2w.eti.br. NS SOA RRSIG NSEC DNSKEY eti.br. 900 IN RRSIG ( NSEC 13 2 900 20240602055509 20240519045509 35149 eti.br. Eq0fRun6hEVTwNqXgjNbnzNki53gDLFvovq/QLgzIgD2feD2DPDaoWWaebigx2XQ/oalxyjoNJLt PL+NMCFhgw== ) lab.eti.br. 900 IN NSEC labti.eti.br. NS DS RRSIG NSEC lab.eti.br. 900 IN RRSIG ( NSEC 13 3 900 20240528120111 20240514110111 35149 eti.br. 6D5mZboYWK2KCjOc4gq5zBmAfEMMazgZBenXJvqDYW6CASUG6Ms3P/abtxpcEytdCAUVwna/3ZUh sk42ITPTng== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Zone br (200.189.41.10) returns NXDOMAIN for labs.eti.br
	Checking NSEC records for an NXDOMAIN response
	Found 1 RRSIGs over NSEC RRset
	`lab.eti.br. 900 IN RRSIG ( NSEC 13 3 900 20240528120111 20240514110111 35149 eti.br. 6D5mZboYWK2KCjOc4gq5zBmAfEMMazgZBenXJvqDYW6CASUG6Ms3P/abtxpcEytdCAUVwna/3ZUh sk42ITPTng== )`
	None of the 1 RRSIG and 2 DNSKEY records validate the NSEC RRset
	The NSEC RRset was not signed by any trusted keys
	No NSEC record could prove that labs.eti.br does not exist
	No NSEC record could prove that *.br does not exist

Move your mouse over any

symbols for remediation hints.

Want a second opinion? Test labs.eti.br at dnsviz.net.

DNSSEC Debugger

Trust Anchor:
Name Servers:

Paste a DS or DNSKEY record into the field above to use a Trust Anchor that is not published in the DNS. Validation will begin at the owner name of the DS/DNSKEY record.

You may also supply alternative starting name servers, separated by whitespace or commas. The given name servers must be authoritative for the same zone as the Trust Anchor.