DNSSEC Debugger - my.nextdns.io

Domain Name:

Time: 2024-05-20 21:27:47 UTC

Analyzing DNSSEC problems for my.nextdns.io

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to b.root-servers.net for ./DNSKEY
	Received 864 bytes from 170.247.170.2
	;; Response received from [170.247.170.2] 864 octets ;; HEADER SECTION ;; id = 40669 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20240601000000 20240511000000 20326 . OgCibhptSNJS9XS2WD2CXYw0HsdjPXn82iYAtzkE7ma1H2BfchG8nRnFZJ9fbrCjXAhDPnKCkuId 8cuJ2PGuLzy9Q3d4zIt7Ow5o8YkpKGEJB6uVi1BRauxVzKgH7u5QnKf8d1AlKFikFdBHHLaZ97XG ci02qRRm1jpe+aY4sLnKHx1kTJozHJp+Xaml/nCiS4AXrCxNyc4EH2/oraODfaewFIOQjpsAMeAw tPrccpst4ZL/9jmZUdRSs3IHwMk9gvSwpZI0YVBWZocKg96CmQQgq9NNNGhpI5gXXdbP++bu4myT GIx8wR1vjK7nau9GJK+76Bt4bc+1FIfpq4mbSg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20240601000000 20240511000000 20326 . OgCibhptSNJS9XS2WD2CXYw0HsdjPXn82iYAtzkE7ma1H2BfchG8nRnFZJ9fbrCjXAhDPnKCkuId 8cuJ2PGuLzy9Q3d4zIt7Ow5o8YkpKGEJB6uVi1BRauxVzKgH7u5QnKf8d1AlKFikFdBHHLaZ97XG ci02qRRm1jpe+aY4sLnKHx1kTJozHJp+Xaml/nCiS4AXrCxNyc4EH2/oraODfaewFIOQjpsAMeAw tPrccpst4ZL/9jmZUdRSs3IHwMk9gvSwpZI0YVBWZocKg96CmQQgq9NNNGhpI5gXXdbP++bu4myT GIx8wR1vjK7nau9GJK+76Bt4bc+1FIfpq4mbSg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=5613 is now in the chain-of-trust
	Query to i.root-servers.net for my.nextdns.io/A
	Received 629 bytes from 192.36.148.17
	;; Response received from [192.36.148.17] 629 octets ;; HEADER SECTION ;; id = 29653 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; my.nextdns.io. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) io. 172800 IN NS a2.nic.io. io. 172800 IN NS c0.nic.io. io. 172800 IN NS a0.nic.io. io. 172800 IN NS b0.nic.io. io. 86400 IN DS ( 57355 8 2 95a57c3bab7849dbcddf7c72ada71a88146b141110318ca5be672057e865c3e2 ) io. 86400 IN RRSIG ( DS 8 1 86400 20240602170000 20240520160000 5613 . NCoC7n5IQjGSkYqBw+0bkuuF5fopl28EcZnt2vvAdIbilQZgK/5cprl2TrIrays70cJx5td1KpEU LIYEFvd/FjiqgfQylYn7wKTr0ybnmYNVbumgEW9PbHaPmEyDerFWhbwIOzIhhKc1RIYuNnOcH5lO 8ZIksxt6+Dl0QkQMl2ylSoRpS5zTJOhkidlMLLrokJBHyH3EdyBQmbr+bwR+h3BX+SrAF82o68/u sxFDdqFBmRh7c6aDSSLX99h16ESi2uaP7dGWSZmiaqxsNZd2TtDuJH0HmRiprDlS+DjLnPPkvROu 6nkSbaJez/siq83VnnlIl/6aHpr+PuNFaOVmdg== ) ;; ADDITIONAL SECTION (9 records) c0.nic.io. 172800 IN A 65.22.162.17 b0.nic.io. 172800 IN A 65.22.161.17 a2.nic.io. 172800 IN A 65.22.163.17 a0.nic.io. 172800 IN A 65.22.160.17 c0.nic.io. 172800 IN AAAA 2a01:8840:a0::17 b0.nic.io. 172800 IN AAAA 2a01:8840:9f::17 a2.nic.io. 172800 IN AAAA 2a01:8840:a1::17 a0.nic.io. 172800 IN AAAA 2a01:8840:9e::17 ;; { "EDNS-VERSION": 0 }
	Query to i.root-servers.net for io/DNSKEY
	Received 616 bytes from 192.36.148.17
	;; Response received from [192.36.148.17] 616 octets ;; HEADER SECTION ;; id = 16775 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; io. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) io. 172800 IN NS a0.nic.io. io. 172800 IN NS c0.nic.io. io. 172800 IN NS b0.nic.io. io. 172800 IN NS a2.nic.io. io. 86400 IN DS ( 57355 8 2 95a57c3bab7849dbcddf7c72ada71a88146b141110318ca5be672057e865c3e2 ) io. 86400 IN RRSIG ( DS 8 1 86400 20240602170000 20240520160000 5613 . NCoC7n5IQjGSkYqBw+0bkuuF5fopl28EcZnt2vvAdIbilQZgK/5cprl2TrIrays70cJx5td1KpEU LIYEFvd/FjiqgfQylYn7wKTr0ybnmYNVbumgEW9PbHaPmEyDerFWhbwIOzIhhKc1RIYuNnOcH5lO 8ZIksxt6+Dl0QkQMl2ylSoRpS5zTJOhkidlMLLrokJBHyH3EdyBQmbr+bwR+h3BX+SrAF82o68/u sxFDdqFBmRh7c6aDSSLX99h16ESi2uaP7dGWSZmiaqxsNZd2TtDuJH0HmRiprDlS+DjLnPPkvROu 6nkSbaJez/siq83VnnlIl/6aHpr+PuNFaOVmdg== ) ;; ADDITIONAL SECTION (9 records) c0.nic.io. 172800 IN A 65.22.162.17 b0.nic.io. 172800 IN A 65.22.161.17 a2.nic.io. 172800 IN A 65.22.163.17 a0.nic.io. 172800 IN A 65.22.160.17 c0.nic.io. 172800 IN AAAA 2a01:8840:a0::17 b0.nic.io. 172800 IN AAAA 2a01:8840:9f::17 a2.nic.io. 172800 IN AAAA 2a01:8840:a1::17 a0.nic.io. 172800 IN AAAA 2a01:8840:9e::17 ;; { "EDNS-VERSION": 0 }
	Found child zone io

	Checking DS between . and io
	Query to l.root-servers.net for io/DS
	Received 366 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 366 octets ;; HEADER SECTION ;; id = 42180 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; io. IN DS ;; ANSWER SECTION (2 records) io. 86400 IN DS ( 57355 8 2 95a57c3bab7849dbcddf7c72ada71a88146b141110318ca5be672057e865c3e2 ) io. 86400 IN RRSIG ( DS 8 1 86400 20240602170000 20240520160000 5613 . NCoC7n5IQjGSkYqBw+0bkuuF5fopl28EcZnt2vvAdIbilQZgK/5cprl2TrIrays70cJx5td1KpEU LIYEFvd/FjiqgfQylYn7wKTr0ybnmYNVbumgEW9PbHaPmEyDerFWhbwIOzIhhKc1RIYuNnOcH5lO 8ZIksxt6+Dl0QkQMl2ylSoRpS5zTJOhkidlMLLrokJBHyH3EdyBQmbr+bwR+h3BX+SrAF82o68/u sxFDdqFBmRh7c6aDSSLX99h16ESi2uaP7dGWSZmiaqxsNZd2TtDuJH0HmRiprDlS+DjLnPPkvROu 6nkSbaJez/siq83VnnlIl/6aHpr+PuNFaOVmdg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for io in the . zone
	DS=57355/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`io. 86400 IN RRSIG ( DS 8 1 86400 20240602170000 20240520160000 5613 . NCoC7n5IQjGSkYqBw+0bkuuF5fopl28EcZnt2vvAdIbilQZgK/5cprl2TrIrays70cJx5td1KpEU LIYEFvd/FjiqgfQylYn7wKTr0ybnmYNVbumgEW9PbHaPmEyDerFWhbwIOzIhhKc1RIYuNnOcH5lO 8ZIksxt6+Dl0QkQMl2ylSoRpS5zTJOhkidlMLLrokJBHyH3EdyBQmbr+bwR+h3BX+SrAF82o68/u sxFDdqFBmRh7c6aDSSLX99h16ESi2uaP7dGWSZmiaqxsNZd2TtDuJH0HmRiprDlS+DjLnPPkvROu 6nkSbaJez/siq83VnnlIl/6aHpr+PuNFaOVmdg== )`
	RRSIG=5613 and DNSKEY=5613 verifies the DS RRset
	DS=57355/SHA-256 is now in the chain-of-trust
	`io. 86400 IN DS ( 57355 8 2 95a57c3bab7849dbcddf7c72ada71a88146b141110318ca5be672057e865c3e2 )`
	Query to a2.nic.io for io/DNSKEY
	Received 893 bytes from 65.22.163.17
	;; Response received from [65.22.163.17] 893 octets ;; HEADER SECTION ;; id = 27885 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; io. IN DNSKEY ;; ANSWER SECTION (4 records) io. 3600 IN DNSKEY ( 256 3 8 AwEAAaLASRPiGmFtDEPgozcCgfQBXnMY76WdF3wSKZztCUNjTuTWT6GgK9DrSOfBr6MvemMczIhw oH1v4gv4sPpzeDCzOilZHGB+PP8Z/z2POL3iXi0OXfxBdxOsceZuIvKK1TsZxvQsjtZ0h4wjY/A1 zlz7KOw+Q5nANbKR7XV7oBWd ) ; Key ID = 12723 io. 3600 IN DNSKEY ( 256 3 8 AwEAAcZbNeV6xbSrTr2YOzOaKT5wsackOutv9g+dnqxhHFY959sbW+Kmvsvmaxpk8dHyu1N/y+DV 7hD0kJqOck8eJArzM33bkVnEbuhpWLVgue0jmW188F9tT+hYya0DkLmLGfOBXaXRDr7dx/5pXaOW ivz+/ibhDkpb1dJT5MHfJQQV ) ; Key ID = 27108 io. 3600 IN DNSKEY ( 257 3 8 AwEAAdgV7ipvizPjJNDZ1O5Ea7hmp+qelixmzCqWbwPH00VOKvlEcWfM/PKGLt+Phj9jVJqDytWI m7Ff7+fUaRMPzMuUW2Z7ViLitxH4iNtKtwU+DMzdGpzRMXFAF1WdbxCF5lWoK0MHsIR5oD9Vkwop kttyGnKjYhTDNObYHg8Mi5E9j0FjU4OEpKw6NbZduVKp2pRBBejm/8WKq0O1PukchMa6TQIJlYNs JZNzD1QLcKZWEup+fTvqzAWiK2Su6rlDC7rgwe6OjhrT2ejqlORp3h5S4WJGi3haUczvA/O5GYjh GmXxp5CJ01RJSYG0BsbY1tpEX+9Y4+GhS/nf8Qo0iDc= ) ; Key ID = 57355 io. 3600 IN RRSIG ( DNSKEY 8 1 3600 20240607155151 20240517145151 57355 io. N5YUgw/lxYmsZeI4mCBwEwNysa2fYm6q4iaw04kaPKCCMLFUl9oIGl7B4RO+mD/XWqyk9sFL+YCR xWbhJei6eJw3TItRFaq/FA7B9uCYSVI5MVNJLn1CEu0Kw89bTbil7U14WCuzvf90pOZFKDxZS49V 9q9SWgc0R3ru2R1Bxi529594LU1QQn4Gc5MID/bqsHJjOWQowaovD24sQsNjr/FtbpxXl+UPptiy RSx3NbZltD6joH30meo2ij/A2dgZgMFGlh1cPpX02dMnavcGlU9iD/O8jqo8MUAMB76L/qH+9cN2 RiLr/e8pAfR8NAqqs2JWDCoAVofBr484rmHQEw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for io
	`io. 3600 IN DNSKEY ( 256 3 8 AwEAAaLASRPiGmFtDEPgozcCgfQBXnMY76WdF3wSKZztCUNjTuTWT6GgK9DrSOfBr6MvemMczIhw oH1v4gv4sPpzeDCzOilZHGB+PP8Z/z2POL3iXi0OXfxBdxOsceZuIvKK1TsZxvQsjtZ0h4wjY/A1 zlz7KOw+Q5nANbKR7XV7oBWd ) ; Key ID = 12723`
	`io. 3600 IN DNSKEY ( 256 3 8 AwEAAcZbNeV6xbSrTr2YOzOaKT5wsackOutv9g+dnqxhHFY959sbW+Kmvsvmaxpk8dHyu1N/y+DV 7hD0kJqOck8eJArzM33bkVnEbuhpWLVgue0jmW188F9tT+hYya0DkLmLGfOBXaXRDr7dx/5pXaOW ivz+/ibhDkpb1dJT5MHfJQQV ) ; Key ID = 27108`
	`io. 3600 IN DNSKEY ( 257 3 8 AwEAAdgV7ipvizPjJNDZ1O5Ea7hmp+qelixmzCqWbwPH00VOKvlEcWfM/PKGLt+Phj9jVJqDytWI m7Ff7+fUaRMPzMuUW2Z7ViLitxH4iNtKtwU+DMzdGpzRMXFAF1WdbxCF5lWoK0MHsIR5oD9Vkwop kttyGnKjYhTDNObYHg8Mi5E9j0FjU4OEpKw6NbZduVKp2pRBBejm/8WKq0O1PukchMa6TQIJlYNs JZNzD1QLcKZWEup+fTvqzAWiK2Su6rlDC7rgwe6OjhrT2ejqlORp3h5S4WJGi3haUczvA/O5GYjh GmXxp5CJ01RJSYG0BsbY1tpEX+9Y4+GhS/nf8Qo0iDc= ) ; Key ID = 57355`
	DNSKEY=57355/SEP is now in the chain-of-trust
	DS=57355/SHA-256 verifies DNSKEY=57355/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`io. 3600 IN RRSIG ( DNSKEY 8 1 3600 20240607155151 20240517145151 57355 io. N5YUgw/lxYmsZeI4mCBwEwNysa2fYm6q4iaw04kaPKCCMLFUl9oIGl7B4RO+mD/XWqyk9sFL+YCR xWbhJei6eJw3TItRFaq/FA7B9uCYSVI5MVNJLn1CEu0Kw89bTbil7U14WCuzvf90pOZFKDxZS49V 9q9SWgc0R3ru2R1Bxi529594LU1QQn4Gc5MID/bqsHJjOWQowaovD24sQsNjr/FtbpxXl+UPptiy RSx3NbZltD6joH30meo2ij/A2dgZgMFGlh1cPpX02dMnavcGlU9iD/O8jqo8MUAMB76L/qH+9cN2 RiLr/e8pAfR8NAqqs2JWDCoAVofBr484rmHQEw== )`
	RRSIG=57355 and DNSKEY=57355/SEP verifies the DNSKEY RRset
	DNSKEY=12723 is now in the chain-of-trust
	DNSKEY=27108 is now in the chain-of-trust
	Query to a0.nic.io for my.nextdns.io/A
	Received 306 bytes from 65.22.160.17
	;; Response received from [65.22.160.17] 306 octets ;; HEADER SECTION ;; id = 62194 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; my.nextdns.io. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) nextdns.io. 3600 IN NS lee.ns.cloudflare.com. nextdns.io. 3600 IN NS dawn.ns.cloudflare.com. nextdns.io. 3600 IN DS ( 2371 13 2 fa8e6c97f9769d8fbef6c694b28a2de882914784a2df171a376acd1f8168a633 ) nextdns.io. 3600 IN RRSIG ( DS 8 2 3600 20240607155151 20240517145151 27108 io. Ox0dXhBNIz6CMJzG0NezcchveR+KcHMyoyap3p5IB9hMZCetPGKGknqUd/VSgOa9Rp1RzvMEzuK2 zKzDNkZkzm97akw1Fm0wYf4gcNnFWBtDxe1QRlArg7ahWShItam7dekIr91Ybx6x48LDaBUbwxZW r8gG0jZ/g79lFXPZLt4= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to b0.nic.io for nextdns.io/DNSKEY
	Received 303 bytes from 65.22.161.17
	;; Response received from [65.22.161.17] 303 octets ;; HEADER SECTION ;; id = 7345 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nextdns.io. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) nextdns.io. 3600 IN NS lee.ns.cloudflare.com. nextdns.io. 3600 IN NS dawn.ns.cloudflare.com. nextdns.io. 3600 IN DS ( 2371 13 2 fa8e6c97f9769d8fbef6c694b28a2de882914784a2df171a376acd1f8168a633 ) nextdns.io. 3600 IN RRSIG ( DS 8 2 3600 20240607155151 20240517145151 27108 io. Ox0dXhBNIz6CMJzG0NezcchveR+KcHMyoyap3p5IB9hMZCetPGKGknqUd/VSgOa9Rp1RzvMEzuK2 zKzDNkZkzm97akw1Fm0wYf4gcNnFWBtDxe1QRlArg7ahWShItam7dekIr91Ybx6x48LDaBUbwxZW r8gG0jZ/g79lFXPZLt4= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone nextdns.io

nextdns.io

	Checking DS between io and nextdns.io
	Query to a2.nic.io for nextdns.io/DS
	Received 249 bytes from 65.22.163.17
	;; Response received from [65.22.163.17] 249 octets ;; HEADER SECTION ;; id = 23429 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nextdns.io. IN DS ;; ANSWER SECTION (2 records) nextdns.io. 3600 IN DS ( 2371 13 2 fa8e6c97f9769d8fbef6c694b28a2de882914784a2df171a376acd1f8168a633 ) nextdns.io. 3600 IN RRSIG ( DS 8 2 3600 20240607155151 20240517145151 27108 io. Ox0dXhBNIz6CMJzG0NezcchveR+KcHMyoyap3p5IB9hMZCetPGKGknqUd/VSgOa9Rp1RzvMEzuK2 zKzDNkZkzm97akw1Fm0wYf4gcNnFWBtDxe1QRlArg7ahWShItam7dekIr91Ybx6x48LDaBUbwxZW r8gG0jZ/g79lFXPZLt4= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for nextdns.io in the io zone
	DS=2371/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`nextdns.io. 3600 IN RRSIG ( DS 8 2 3600 20240607155151 20240517145151 27108 io. Ox0dXhBNIz6CMJzG0NezcchveR+KcHMyoyap3p5IB9hMZCetPGKGknqUd/VSgOa9Rp1RzvMEzuK2 zKzDNkZkzm97akw1Fm0wYf4gcNnFWBtDxe1QRlArg7ahWShItam7dekIr91Ybx6x48LDaBUbwxZW r8gG0jZ/g79lFXPZLt4= )`
	RRSIG=27108 and DNSKEY=27108 verifies the DS RRset
	DS=2371/SHA-256 is now in the chain-of-trust
	`nextdns.io. 3600 IN DS ( 2371 13 2 fa8e6c97f9769d8fbef6c694b28a2de882914784a2df171a376acd1f8168a633 )`
	Query to dawn.ns.cloudflare.com for nextdns.io/DNSKEY
	Received 305 bytes from 172.64.32.106
	;; Response received from [172.64.32.106] 305 octets ;; HEADER SECTION ;; id = 49057 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nextdns.io. IN DNSKEY ;; ANSWER SECTION (3 records) nextdns.io. 3600 IN DNSKEY ( 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iU zy1L53eKGQ== ) ; Key ID = 2371 nextdns.io. 3600 IN DNSKEY ( 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x 8fGAa2XhSA== ) ; Key ID = 34505 nextdns.io. 3600 IN RRSIG ( DNSKEY 13 2 3600 20240707152402 20240507152402 2371 nextdns.io. KTWBpIV+Gxf8dAAtMw1yX1xlVcqOyTk2gCmRuEVR3n86zCk9u5wfBCG240PfLWJjiYTska1BH0lM 0NHsD1pKnw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for nextdns.io
	`nextdns.io. 3600 IN DNSKEY ( 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iU zy1L53eKGQ== ) ; Key ID = 2371`
	`nextdns.io. 3600 IN DNSKEY ( 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x 8fGAa2XhSA== ) ; Key ID = 34505`
	DNSKEY=2371/SEP is now in the chain-of-trust
	DS=2371/SHA-256 verifies DNSKEY=2371/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`nextdns.io. 3600 IN RRSIG ( DNSKEY 13 2 3600 20240707152402 20240507152402 2371 nextdns.io. KTWBpIV+Gxf8dAAtMw1yX1xlVcqOyTk2gCmRuEVR3n86zCk9u5wfBCG240PfLWJjiYTska1BH0lM 0NHsD1pKnw== )`
	RRSIG=2371 and DNSKEY=2371/SEP verifies the DNSKEY RRset
	DNSKEY=34505 is now in the chain-of-trust
	Query to lee.ns.cloudflare.com for my.nextdns.io/A
	Received 182 bytes from 173.245.59.129
	;; Response received from [173.245.59.129] 182 octets ;; HEADER SECTION ;; id = 58250 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; my.nextdns.io. IN A ;; ANSWER SECTION (2 records) my.nextdns.io. 300 IN CNAME cname.vercel-dns.com. my.nextdns.io. 300 IN RRSIG ( CNAME 13 3 300 20240521222748 20240519202748 34505 nextdns.io. ovHXLmljcDHvImohCJ67RRMxEnsflSZoZl4ZhM1fyk9fHcfO32pF4W+YdwX5iEFTEx8kemTUaFp9 WxkYMhWk2w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	lee.ns.cloudflare.com is authoritative for my.nextdns.io
	Query to dawn.ns.cloudflare.com for my.nextdns.io/DNSKEY
	Received 182 bytes from 108.162.192.106
	;; Response received from [108.162.192.106] 182 octets ;; HEADER SECTION ;; id = 47223 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; my.nextdns.io. IN DNSKEY ;; ANSWER SECTION (2 records) my.nextdns.io. 300 IN CNAME cname.vercel-dns.com. my.nextdns.io. 300 IN RRSIG ( CNAME 13 3 300 20240521222748 20240519202748 34505 nextdns.io. XlUBhEt5oO+OE7PgJCP8IiOiOm7T0brQHuYCVtOcR+OEDDxdj63SyRW3X9inm7eOnovG5Fouyx4+ ijJTXmuSRg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found RRSIG signed by nextdns.io zone
	my.nextdns.io is a CNAME to cname.vercel-dns.com
	Found 1 RRSIGs over CNAME RRset
	`my.nextdns.io. 300 IN RRSIG ( CNAME 13 3 300 20240521222748 20240519202748 34505 nextdns.io. ovHXLmljcDHvImohCJ67RRMxEnsflSZoZl4ZhM1fyk9fHcfO32pF4W+YdwX5iEFTEx8kemTUaFp9 WxkYMhWk2w== )`
	RRSIG=34505 and DNSKEY=34505 verifies the CNAME RRset

	Query to m.root-servers.net for cname.vercel-dns.com/A
	Received 1183 bytes from 202.12.27.33
	;; Response received from [202.12.27.33] 1183 octets ;; HEADER SECTION ;; id = 38879 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 15 arcount = 27 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cname.vercel-dns.com. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 86400 IN DS ( 19718 13 2 8acbb0cd28f41250a80a491389424d341522d946b0da0c0291f2d3d771d7805a ) com. 86400 IN RRSIG ( DS 8 1 86400 20240602170000 20240520160000 5613 . H2HO74r24luXmEf0AGZO6wxMJ9+AtCVT2IKKOmuUHRP7hUQHI030I/yUauoEDrMuRhty9phFUaVx 4W4/UeE41IVTfr3XQyEMCbF926ORsBWflxXWUX+4R7Nde4mIynHz9eRGF9fog/Ht2djYT5vu9X+V YCs4m+88Fe1GHPl9SIR1dbvBusp+xSX0DmRKE476PdnYt6hnAieZjZkgzHxxeLYJPSA5FvHBlnY6 hXLc7vLBFtjj0n4f8Gsv227PVdlYf8q/i5XPU4n3wXuVSqJjtx9s7JXUwwI4zmRCT5wj/BMfW2sP LED+UUFZmL7Mwd+EDBzXFdXJY1SMshVfcdbdOw== ) ;; ADDITIONAL SECTION (27 records) m.gtld-servers.net. 172800 IN A 192.55.83.30 l.gtld-servers.net. 172800 IN A 192.41.162.30 k.gtld-servers.net. 172800 IN A 192.52.178.30 j.gtld-servers.net. 172800 IN A 192.48.79.30 i.gtld-servers.net. 172800 IN A 192.43.172.30 h.gtld-servers.net. 172800 IN A 192.54.112.30 g.gtld-servers.net. 172800 IN A 192.42.93.30 f.gtld-servers.net. 172800 IN A 192.35.51.30 e.gtld-servers.net. 172800 IN A 192.12.94.30 d.gtld-servers.net. 172800 IN A 192.31.80.30 c.gtld-servers.net. 172800 IN A 192.26.92.30 b.gtld-servers.net. 172800 IN A 192.33.14.30 a.gtld-servers.net. 172800 IN A 192.5.6.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 ;; { "EDNS-VERSION": 0 }
	Query to l.root-servers.net for com/DNSKEY
	Received 1163 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 1163 octets ;; HEADER SECTION ;; id = 13515 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 15 arcount = 27 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; com. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. com. 86400 IN DS ( 19718 13 2 8acbb0cd28f41250a80a491389424d341522d946b0da0c0291f2d3d771d7805a ) com. 86400 IN RRSIG ( DS 8 1 86400 20240602170000 20240520160000 5613 . H2HO74r24luXmEf0AGZO6wxMJ9+AtCVT2IKKOmuUHRP7hUQHI030I/yUauoEDrMuRhty9phFUaVx 4W4/UeE41IVTfr3XQyEMCbF926ORsBWflxXWUX+4R7Nde4mIynHz9eRGF9fog/Ht2djYT5vu9X+V YCs4m+88Fe1GHPl9SIR1dbvBusp+xSX0DmRKE476PdnYt6hnAieZjZkgzHxxeLYJPSA5FvHBlnY6 hXLc7vLBFtjj0n4f8Gsv227PVdlYf8q/i5XPU4n3wXuVSqJjtx9s7JXUwwI4zmRCT5wj/BMfW2sP LED+UUFZmL7Mwd+EDBzXFdXJY1SMshVfcdbdOw== ) ;; ADDITIONAL SECTION (27 records) a.gtld-servers.net. 172800 IN A 192.5.6.30 b.gtld-servers.net. 172800 IN A 192.33.14.30 c.gtld-servers.net. 172800 IN A 192.26.92.30 d.gtld-servers.net. 172800 IN A 192.31.80.30 e.gtld-servers.net. 172800 IN A 192.12.94.30 f.gtld-servers.net. 172800 IN A 192.35.51.30 g.gtld-servers.net. 172800 IN A 192.42.93.30 h.gtld-servers.net. 172800 IN A 192.54.112.30 i.gtld-servers.net. 172800 IN A 192.43.172.30 j.gtld-servers.net. 172800 IN A 192.48.79.30 k.gtld-servers.net. 172800 IN A 192.52.178.30 l.gtld-servers.net. 172800 IN A 192.41.162.30 m.gtld-servers.net. 172800 IN A 192.55.83.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 ;; { "EDNS-VERSION": 0 }
	Found child zone com

com

	Checking DS between . and com
	Query to l.root-servers.net for com/DS
	Received 367 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 367 octets ;; HEADER SECTION ;; id = 7131 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; com. IN DS ;; ANSWER SECTION (2 records) com. 86400 IN DS ( 19718 13 2 8acbb0cd28f41250a80a491389424d341522d946b0da0c0291f2d3d771d7805a ) com. 86400 IN RRSIG ( DS 8 1 86400 20240602170000 20240520160000 5613 . H2HO74r24luXmEf0AGZO6wxMJ9+AtCVT2IKKOmuUHRP7hUQHI030I/yUauoEDrMuRhty9phFUaVx 4W4/UeE41IVTfr3XQyEMCbF926ORsBWflxXWUX+4R7Nde4mIynHz9eRGF9fog/Ht2djYT5vu9X+V YCs4m+88Fe1GHPl9SIR1dbvBusp+xSX0DmRKE476PdnYt6hnAieZjZkgzHxxeLYJPSA5FvHBlnY6 hXLc7vLBFtjj0n4f8Gsv227PVdlYf8q/i5XPU4n3wXuVSqJjtx9s7JXUwwI4zmRCT5wj/BMfW2sP LED+UUFZmL7Mwd+EDBzXFdXJY1SMshVfcdbdOw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for com in the . zone
	DS=19718/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`com. 86400 IN RRSIG ( DS 8 1 86400 20240602170000 20240520160000 5613 . H2HO74r24luXmEf0AGZO6wxMJ9+AtCVT2IKKOmuUHRP7hUQHI030I/yUauoEDrMuRhty9phFUaVx 4W4/UeE41IVTfr3XQyEMCbF926ORsBWflxXWUX+4R7Nde4mIynHz9eRGF9fog/Ht2djYT5vu9X+V YCs4m+88Fe1GHPl9SIR1dbvBusp+xSX0DmRKE476PdnYt6hnAieZjZkgzHxxeLYJPSA5FvHBlnY6 hXLc7vLBFtjj0n4f8Gsv227PVdlYf8q/i5XPU4n3wXuVSqJjtx9s7JXUwwI4zmRCT5wj/BMfW2sP LED+UUFZmL7Mwd+EDBzXFdXJY1SMshVfcdbdOw== )`
	RRSIG=5613 and DNSKEY=5613 verifies the DS RRset
	DS=19718/SHA-256 is now in the chain-of-trust
	`com. 86400 IN DS ( 19718 13 2 8acbb0cd28f41250a80a491389424d341522d946b0da0c0291f2d3d771d7805a )`
	Query to j.gtld-servers.net for com/DNSKEY
	Received 291 bytes from 192.48.79.30
	;; Response received from [192.48.79.30] 291 octets ;; HEADER SECTION ;; id = 57473 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; com. IN DNSKEY ;; ANSWER SECTION (3 records) com. 86400 IN DNSKEY ( 257 3 13 tx8EZRAd2+K/DJRV0S+hbBzaRPS/G6JVNBitHzqpsGlz8huE61Ms9ANe6NSDLKJtiTBqfTJWDAyw Ep1FCsEINQ== ) ; Key ID = 19718 com. 86400 IN DNSKEY ( 256 3 13 cCRwZIITlPXwDm0yKpGVYSmWLL4OpEHxA7+Rt3jS0W1N4EMOaF8doSzrJuM7aDbgAR7jtQ9SNCvY ZCH2xSyfaQ== ) ; Key ID = 956 com. 86400 IN RRSIG ( DNSKEY 13 1 86400 20240601140235 20240517135735 19718 com. 3xQE/PGVd6/fhBGV2swH4FDArm3AdolfjBpLicfLAsTXZ6JvqclPaGsZxJuA78TUI+xeal1lT6hR WmRKA4Odrg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for com
	`com. 86400 IN DNSKEY ( 257 3 13 tx8EZRAd2+K/DJRV0S+hbBzaRPS/G6JVNBitHzqpsGlz8huE61Ms9ANe6NSDLKJtiTBqfTJWDAyw Ep1FCsEINQ== ) ; Key ID = 19718`
	`com. 86400 IN DNSKEY ( 256 3 13 cCRwZIITlPXwDm0yKpGVYSmWLL4OpEHxA7+Rt3jS0W1N4EMOaF8doSzrJuM7aDbgAR7jtQ9SNCvY ZCH2xSyfaQ== ) ; Key ID = 956`
	DNSKEY=19718/SEP is now in the chain-of-trust
	DS=19718/SHA-256 verifies DNSKEY=19718/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`com. 86400 IN RRSIG ( DNSKEY 13 1 86400 20240601140235 20240517135735 19718 com. 3xQE/PGVd6/fhBGV2swH4FDArm3AdolfjBpLicfLAsTXZ6JvqclPaGsZxJuA78TUI+xeal1lT6hR WmRKA4Odrg== )`
	RRSIG=19718 and DNSKEY=19718/SEP verifies the DNSKEY RRset
	DNSKEY=956 is now in the chain-of-trust
	Query to e.gtld-servers.net for cname.vercel-dns.com/A
	Received 530 bytes from 192.12.94.30
	;; Response received from [192.12.94.30] 530 octets ;; HEADER SECTION ;; id = 49527 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 5 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cname.vercel-dns.com. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) vercel-dns.com. 172800 IN NS ns1.vercel-dns.com. vercel-dns.com. 172800 IN NS ns2.vercel-dns.com. CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 ( 1 1 0 - ck0q2d6ni4i7eqh8na30ns61o48ul8g5 NS SOA RRSIG DNSKEY NSEC3PARAM ) CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG ( NSEC3 13 2 86400 20240524042459 20240517031459 956 com. z1jR7JNLkGW/vGt4F/eJR0w0JigXU31VwLVexqIEy4SXZ0PQKOWsp8eGk9jjcJ3Ta1dcmyUb1qNc vVWuGcCzUA== ) 28VA2048JQP6ONJNN2POA40JHQ7PC714.com. 86400 IN NSEC3 ( 1 1 0 - 28vaddlq08e2pbl55v5vdp4qjrs2t7q8 NS DS RRSIG ) 28VA2048JQP6ONJNN2POA40JHQ7PC714.com. 86400 IN RRSIG ( NSEC3 13 2 86400 20240525045949 20240518034949 956 com. /osGIvG6BphsR+4b5EMKsUagIrjsfM0XkK15pHnLS+iIzmXdyGp7V1/bBgbPm+/n38Kwocnrk75B e4FC9w4OaQ== ) ;; ADDITIONAL SECTION (5 records) ns1.vercel-dns.com. 172800 IN A 198.51.44.13 ns1.vercel-dns.com. 172800 IN AAAA 2620:4d:4000:6259:7:13:0:1 ns2.vercel-dns.com. 172800 IN A 198.51.45.13 ns2.vercel-dns.com. 172800 IN AAAA 2a00:edc0:6259:7:13::2 ;; { "EDNS-VERSION": 0 }
	Query to c.gtld-servers.net for vercel-dns.com/DNSKEY
	Received 524 bytes from 192.26.92.30
	;; Response received from [192.26.92.30] 524 octets ;; HEADER SECTION ;; id = 48038 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 5 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; vercel-dns.com. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) vercel-dns.com. 172800 IN NS ns1.vercel-dns.com. vercel-dns.com. 172800 IN NS ns2.vercel-dns.com. CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 ( 1 1 0 - ck0q2d6ni4i7eqh8na30ns61o48ul8g5 NS SOA RRSIG DNSKEY NSEC3PARAM ) CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG ( NSEC3 13 2 86400 20240524042459 20240517031459 956 com. z1jR7JNLkGW/vGt4F/eJR0w0JigXU31VwLVexqIEy4SXZ0PQKOWsp8eGk9jjcJ3Ta1dcmyUb1qNc vVWuGcCzUA== ) 28VA2048JQP6ONJNN2POA40JHQ7PC714.com. 86400 IN NSEC3 ( 1 1 0 - 28vaddlq08e2pbl55v5vdp4qjrs2t7q8 NS DS RRSIG ) 28VA2048JQP6ONJNN2POA40JHQ7PC714.com. 86400 IN RRSIG ( NSEC3 13 2 86400 20240525045949 20240518034949 956 com. /osGIvG6BphsR+4b5EMKsUagIrjsfM0XkK15pHnLS+iIzmXdyGp7V1/bBgbPm+/n38Kwocnrk75B e4FC9w4OaQ== ) ;; ADDITIONAL SECTION (5 records) ns1.vercel-dns.com. 172800 IN A 198.51.44.13 ns1.vercel-dns.com. 172800 IN AAAA 2620:4d:4000:6259:7:13:0:1 ns2.vercel-dns.com. 172800 IN A 198.51.45.13 ns2.vercel-dns.com. 172800 IN AAAA 2a00:edc0:6259:7:13::2 ;; { "EDNS-VERSION": 0 }
	Found child zone vercel-dns.com

vercel-dns.com

	Checking DS between com and vercel-dns.com
	Query to m.gtld-servers.net for vercel-dns.com/DS
	Received 572 bytes from 192.55.83.30
	;; Response received from [192.55.83.30] 572 octets ;; HEADER SECTION ;; id = 14933 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; vercel-dns.com. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 ( 1 1 0 - ck0q2d6ni4i7eqh8na30ns61o48ul8g5 NS SOA RRSIG DNSKEY NSEC3PARAM ) CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG ( NSEC3 13 2 86400 20240524042459 20240517031459 956 com. z1jR7JNLkGW/vGt4F/eJR0w0JigXU31VwLVexqIEy4SXZ0PQKOWsp8eGk9jjcJ3Ta1dcmyUb1qNc vVWuGcCzUA== ) com. 900 IN SOA ( a.gtld-servers.net. nstld.verisign-grs.com. 1716240449 ;serial 1800 ;refresh 900 ;retry 604800 ;expire 86400 ;minimum ) com. 900 IN RRSIG ( SOA 13 1 900 20240527212729 20240520201729 956 com. GQ396rr3/SwOGe0MtPBrT068Y0bx/yTQjmZzO3EqXtRCwgYr4EbSipxY30ChCuDxEfmFsFBulmTh KuI78Blocg== ) 28VA2048JQP6ONJNN2POA40JHQ7PC714.com. 86400 IN NSEC3 ( 1 1 0 - 28vaddlq08e2pbl55v5vdp4qjrs2t7q8 NS DS RRSIG ) 28VA2048JQP6ONJNN2POA40JHQ7PC714.com. 86400 IN RRSIG ( NSEC3 13 2 86400 20240525045949 20240518034949 956 com. /osGIvG6BphsR+4b5EMKsUagIrjsfM0XkK15pHnLS+iIzmXdyGp7V1/bBgbPm+/n38Kwocnrk75B e4FC9w4OaQ== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DS records found for vercel-dns.com in the com zone
	Query to ns1.vercel-dns.com for vercel-dns.com/DNSKEY
	Received 108 bytes from 198.51.44.13
	;; Response received from [198.51.44.13] 108 octets ;; HEADER SECTION ;; id = 34688 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 1 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; vercel-dns.com. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) vercel-dns.com. 3600 IN SOA ( dns1.p07.nsone.net. hostmaster.nsone.net. 1657560353 ;serial 43200 ;refresh 7200 ;retry 1209600 ;expire 3600 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DNSKEY records found
	Query to ns2.vercel-dns.com for cname.vercel-dns.com/A
	Received 81 bytes from 198.51.45.13
	;; Response received from [198.51.45.13] 81 octets ;; HEADER SECTION ;; id = 29163 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cname.vercel-dns.com. IN A ;; ANSWER SECTION (2 records) cname.vercel-dns.com. 600 IN A 76.76.21.93 cname.vercel-dns.com. 600 IN A 76.76.21.61 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns2.vercel-dns.com is authoritative for cname.vercel-dns.com
	Query to ns2.vercel-dns.com for cname.vercel-dns.com/DNSKEY
	Received 114 bytes from 198.51.45.13
	;; Response received from [198.51.45.13] 114 octets ;; HEADER SECTION ;; id = 52622 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 1 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cname.vercel-dns.com. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) vercel-dns.com. 3600 IN SOA ( dns1.p07.nsone.net. hostmaster.nsone.net. 1657560353 ;serial 43200 ;refresh 7200 ;retry 1209600 ;expire 3600 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns1.vercel-dns.com for vercel-dns.com/SOA
	Received 108 bytes from 198.51.44.13
	;; Response received from [198.51.44.13] 108 octets ;; HEADER SECTION ;; id = 54030 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; vercel-dns.com. IN SOA ;; ANSWER SECTION (1 record) vercel-dns.com. 3600 IN SOA ( dns1.p07.nsone.net. hostmaster.nsone.net. 1657560353 ;serial 43200 ;refresh 7200 ;retry 1209600 ;expire 3600 ;minimum ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns2.vercel-dns.com for cname.vercel-dns.com/A
	Received 81 bytes from 198.51.45.13
	;; Response received from [198.51.45.13] 81 octets ;; HEADER SECTION ;; id = 8788 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cname.vercel-dns.com. IN A ;; ANSWER SECTION (2 records) cname.vercel-dns.com. 600 IN A 76.76.21.123 cname.vercel-dns.com. 600 IN A 76.76.21.22 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	cname.vercel-dns.com A RR has value 76.76.21.123
	cname.vercel-dns.com A RR has value 76.76.21.22
	No RRSIGs found

vercel-dns.com

	Query to ns1.vercel-dns.com for cname.vercel-dns.com/A
	Received 81 bytes from 198.51.44.13
	;; Response received from [198.51.44.13] 81 octets ;; HEADER SECTION ;; id = 42107 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cname.vercel-dns.com. IN A ;; ANSWER SECTION (2 records) cname.vercel-dns.com. 600 IN A 76.76.21.142 cname.vercel-dns.com. 600 IN A 76.76.21.123 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns1.vercel-dns.com is authoritative for cname.vercel-dns.com
	Query to ns1.vercel-dns.com for cname.vercel-dns.com/DNSKEY
	Received 114 bytes from 198.51.44.13
	;; Response received from [198.51.44.13] 114 octets ;; HEADER SECTION ;; id = 3306 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 1 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cname.vercel-dns.com. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) vercel-dns.com. 3600 IN SOA ( dns1.p07.nsone.net. hostmaster.nsone.net. 1657560353 ;serial 43200 ;refresh 7200 ;retry 1209600 ;expire 3600 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns1.vercel-dns.com for cname.vercel-dns.com/A
	Received 81 bytes from 198.51.44.13
	;; Response received from [198.51.44.13] 81 octets ;; HEADER SECTION ;; id = 28871 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cname.vercel-dns.com. IN A ;; ANSWER SECTION (2 records) cname.vercel-dns.com. 600 IN A 76.76.21.9 cname.vercel-dns.com. 600 IN A 76.76.21.164 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	cname.vercel-dns.com A RR has value 76.76.21.9
	cname.vercel-dns.com A RR has value 76.76.21.164
	No RRSIGs found

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test my.nextdns.io at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: