DNSSEC Debugger - saasc.cf

Analyzing DNSSEC problems for saasc.cf

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to d.root-servers.net for ./DNSKEY
	Received 864 bytes from 199.7.91.13
	;; Response received from [199.7.91.13] 864 octets ;; HEADER SECTION ;; id = 46685 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1450, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20240601000000 20240511000000 20326 . OgCibhptSNJS9XS2WD2CXYw0HsdjPXn82iYAtzkE7ma1H2BfchG8nRnFZJ9fbrCjXAhDPnKCkuId 8cuJ2PGuLzy9Q3d4zIt7Ow5o8YkpKGEJB6uVi1BRauxVzKgH7u5QnKf8d1AlKFikFdBHHLaZ97XG ci02qRRm1jpe+aY4sLnKHx1kTJozHJp+Xaml/nCiS4AXrCxNyc4EH2/oraODfaewFIOQjpsAMeAw tPrccpst4ZL/9jmZUdRSs3IHwMk9gvSwpZI0YVBWZocKg96CmQQgq9NNNGhpI5gXXdbP++bu4myT GIx8wR1vjK7nau9GJK+76Bt4bc+1FIfpq4mbSg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20240601000000 20240511000000 20326 . OgCibhptSNJS9XS2WD2CXYw0HsdjPXn82iYAtzkE7ma1H2BfchG8nRnFZJ9fbrCjXAhDPnKCkuId 8cuJ2PGuLzy9Q3d4zIt7Ow5o8YkpKGEJB6uVi1BRauxVzKgH7u5QnKf8d1AlKFikFdBHHLaZ97XG ci02qRRm1jpe+aY4sLnKHx1kTJozHJp+Xaml/nCiS4AXrCxNyc4EH2/oraODfaewFIOQjpsAMeAw tPrccpst4ZL/9jmZUdRSs3IHwMk9gvSwpZI0YVBWZocKg96CmQQgq9NNNGhpI5gXXdbP++bu4myT GIx8wR1vjK7nau9GJK+76Bt4bc+1FIfpq4mbSg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=5613 is now in the chain-of-trust
	Query to j.root-servers.net for saasc.cf/A
	Received 592 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 592 octets ;; HEADER SECTION ;; id = 44643 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; saasc.cf. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) cf. 172800 IN NS a.ns.cf. cf. 172800 IN NS b.ns.cf. cf. 172800 IN NS c.ns.cf. cf. 172800 IN NS d.ns.cf. cf. 86400 IN NSEC cfa. NS RRSIG NSEC cf. 86400 IN RRSIG ( NSEC 8 1 86400 20240531170000 20240518160000 5613 . E9ji3If/vKCpb9XvGfaoHh85COXiRUSD3wCqjwhvzzSmiWaGQq5xed3j4R2IDAISzzcvy2B1+SOo fqnfi6LhTiDgDyMefjCpeeFNvIf+kaHEWIfLEG1f7xfbEICqqBWYSQKVJJIyc1VZU9C5mDCGNPU1 RwOjNraSdXSR4V686vTkzE73lbUqWHjhfRFV4/udRlkEv1f3O4sOkoRtpyJN+Xc49j0ci1KfugkB zbnUjVtgzEeaE/j5eXa8Fp0lN2YKNU6f757vpZWNQdIzNiAoi9c/XH7B2wuYtZe3U/f1COULNEGR cg2+oSZ+tLTBwJAYkFAWEXdH9Cq3+Rx9nb8pMQ== ) ;; ADDITIONAL SECTION (9 records) a.ns.cf. 172800 IN A 185.21.168.17 b.ns.cf. 172800 IN A 185.21.169.17 c.ns.cf. 172800 IN A 185.21.170.17 d.ns.cf. 172800 IN A 185.21.171.17 a.ns.cf. 172800 IN AAAA 2a04:1b00:4::1 b.ns.cf. 172800 IN AAAA 2a04:1b00:5::1 c.ns.cf. 172800 IN AAAA 2a04:1b00:6::1 d.ns.cf. 172800 IN AAAA 2a04:1b00:7::1 ;; { "EDNS-VERSION": 0 }
	Query to a.root-servers.net for cf/DNSKEY
	Received 586 bytes from 198.41.0.4
	;; Response received from [198.41.0.4] 586 octets ;; HEADER SECTION ;; id = 64162 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cf. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) cf. 172800 IN NS d.ns.cf. cf. 172800 IN NS b.ns.cf. cf. 172800 IN NS a.ns.cf. cf. 172800 IN NS c.ns.cf. cf. 86400 IN NSEC cfa. NS RRSIG NSEC cf. 86400 IN RRSIG ( NSEC 8 1 86400 20240531170000 20240518160000 5613 . E9ji3If/vKCpb9XvGfaoHh85COXiRUSD3wCqjwhvzzSmiWaGQq5xed3j4R2IDAISzzcvy2B1+SOo fqnfi6LhTiDgDyMefjCpeeFNvIf+kaHEWIfLEG1f7xfbEICqqBWYSQKVJJIyc1VZU9C5mDCGNPU1 RwOjNraSdXSR4V686vTkzE73lbUqWHjhfRFV4/udRlkEv1f3O4sOkoRtpyJN+Xc49j0ci1KfugkB zbnUjVtgzEeaE/j5eXa8Fp0lN2YKNU6f757vpZWNQdIzNiAoi9c/XH7B2wuYtZe3U/f1COULNEGR cg2+oSZ+tLTBwJAYkFAWEXdH9Cq3+Rx9nb8pMQ== ) ;; ADDITIONAL SECTION (9 records) d.ns.cf. 172800 IN A 185.21.171.17 d.ns.cf. 172800 IN AAAA 2a04:1b00:7::1 b.ns.cf. 172800 IN A 185.21.169.17 b.ns.cf. 172800 IN AAAA 2a04:1b00:5::1 a.ns.cf. 172800 IN A 185.21.168.17 a.ns.cf. 172800 IN AAAA 2a04:1b00:4::1 c.ns.cf. 172800 IN A 185.21.170.17 c.ns.cf. 172800 IN AAAA 2a04:1b00:6::1 ;; { "EDNS-VERSION": 0 }
	Found child zone cf

	Checking DS between . and cf
	Query to e.root-servers.net for cf/DS
	Received 704 bytes from 192.203.230.10
	;; Response received from [192.203.230.10] 704 octets ;; HEADER SECTION ;; id = 14735 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cf. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) . 86400 IN SOA ( a.root-servers.net. nstld.verisign-grs.com. 2024051801 ;serial 1800 ;refresh 900 ;retry 604800 ;expire 86400 ;minimum ) . 86400 IN RRSIG ( SOA 8 0 86400 20240531170000 20240518160000 5613 . Y4VwhTIXoSqCluIVqWUK3fIf2YuNRufU/j1g+3jo37ZNUT4pTCCE0X2SC1CLBaLknpGs3odcSsUw Zvv+f0m59PZ++gD0QinONo+jP7glztR0rDa3FW9rrq5SP1spo+ormrbJP8PsPdGJsNhwkvlecPEE ooRVEWhRhFvXmJypHfmSOpHhXuKK0FQWFlqH3ng9ep1ng6yYwfYukFoAfbJ5PgV11900vyE1Q5yq 9MrIhlq+++VqNb4AV/9eiE7fRuZVq8CYN+32Cvl6s/lBfSj3k+1wXz/zsErUyf87utip5zWK8eV2 c8OoQ5Y/YVjSop7+ijim0Q/Rz5pYu4Nl8lSjUQ== ) cf. 86400 IN NSEC cfa. NS RRSIG NSEC cf. 86400 IN RRSIG ( NSEC 8 1 86400 20240531170000 20240518160000 5613 . E9ji3If/vKCpb9XvGfaoHh85COXiRUSD3wCqjwhvzzSmiWaGQq5xed3j4R2IDAISzzcvy2B1+SOo fqnfi6LhTiDgDyMefjCpeeFNvIf+kaHEWIfLEG1f7xfbEICqqBWYSQKVJJIyc1VZU9C5mDCGNPU1 RwOjNraSdXSR4V686vTkzE73lbUqWHjhfRFV4/udRlkEv1f3O4sOkoRtpyJN+Xc49j0ci1KfugkB zbnUjVtgzEeaE/j5eXa8Fp0lN2YKNU6f757vpZWNQdIzNiAoi9c/XH7B2wuYtZe3U/f1COULNEGR cg2+oSZ+tLTBwJAYkFAWEXdH9Cq3+Rx9nb8pMQ== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DS records found for cf in the . zone
	Query to b.ns.cf for cf/DNSKEY
	Received 94 bytes from 185.21.169.17
	;; Response received from [185.21.169.17] 94 octets ;; HEADER SECTION ;; id = 40841 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 1 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cf. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) cf. 5 IN SOA ( a.ns.cf. kohilaire.socatel.cf. 1715778349 ;serial 10800 ;refresh 3600 ;retry 604800 ;expire 5 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DNSKEY records found
	Query to c.ns.cf for saasc.cf/A
	Received 96 bytes from 185.21.170.17
	;; Response received from [185.21.170.17] 96 octets ;; HEADER SECTION ;; id = 52762 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NXDOMAIN ;; qdcount = 1 ancount = 0 nscount = 1 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; saasc.cf. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) cf. 5 IN SOA ( a.ns.cf. kohilaire.socatel.cf. 1715778349 ;serial 10800 ;refresh 3600 ;retry 604800 ;expire 5 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Zone cf (185.21.170.17) returns NXDOMAIN for saasc.cf
	No NSEC records in response

Move your mouse over any

symbols for remediation hints.

Want a second opinion? Test saasc.cf at dnsviz.net.

DNSSEC Debugger

Trust Anchor:
Name Servers:

Paste a DS or DNSKEY record into the field above to use a Trust Anchor that is not published in the DNS. Validation will begin at the owner name of the DS/DNSKEY record.

You may also supply alternative starting name servers, separated by whitespace or commas. The given name servers must be authoritative for the same zone as the Trust Anchor.