DNSSEC Debugger - switch.ch

Domain Name:

Time: 2024-05-19 12:53:41 UTC

Analyzing DNSSEC problems for switch.ch

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to m.root-servers.net for ./DNSKEY
	Received 865 bytes from 202.12.27.33
	;; Response received from [202.12.27.33] 865 octets ;; HEADER SECTION ;; id = 56707 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20240601000000 20240511000000 20326 . OgCibhptSNJS9XS2WD2CXYw0HsdjPXn82iYAtzkE7ma1H2BfchG8nRnFZJ9fbrCjXAhDPnKCkuId 8cuJ2PGuLzy9Q3d4zIt7Ow5o8YkpKGEJB6uVi1BRauxVzKgH7u5QnKf8d1AlKFikFdBHHLaZ97XG ci02qRRm1jpe+aY4sLnKHx1kTJozHJp+Xaml/nCiS4AXrCxNyc4EH2/oraODfaewFIOQjpsAMeAw tPrccpst4ZL/9jmZUdRSs3IHwMk9gvSwpZI0YVBWZocKg96CmQQgq9NNNGhpI5gXXdbP++bu4myT GIx8wR1vjK7nau9GJK+76Bt4bc+1FIfpq4mbSg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAZBALoOFImwcJJg9Iu7Vy7ZyLjhtXfvO1c9k4vHjOpf9i7U1kKtrBvhnwsOni1sb50gkUayR tMDTUQqvljMMf4bpkyEtcE5evCzhHbFLq1coL5QOix3mfJm++FvIMaAt52nOvAdqR/luuI11bA1A mSCIJKAUx147DcfOHYKg3as+dznn3Iah4cWBMVzDe7PPsFS1AO6gU8EpmiRJ9VMNA09fOyDuq9+d 6sw8UUnJRMAFAuPLhUFjUAOuWOw74BC9lOtMQpbLMz8pX0CDKdOXDHjyj61nxSSWxPdUjeoxI17l QTpSPRtqRHFn5Fgj2e+9BVwhhWGDQN8kUVSJHZtQiI0= ) ; Key ID = 5613`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20240601000000 20240511000000 20326 . OgCibhptSNJS9XS2WD2CXYw0HsdjPXn82iYAtzkE7ma1H2BfchG8nRnFZJ9fbrCjXAhDPnKCkuId 8cuJ2PGuLzy9Q3d4zIt7Ow5o8YkpKGEJB6uVi1BRauxVzKgH7u5QnKf8d1AlKFikFdBHHLaZ97XG ci02qRRm1jpe+aY4sLnKHx1kTJozHJp+Xaml/nCiS4AXrCxNyc4EH2/oraODfaewFIOQjpsAMeAw tPrccpst4ZL/9jmZUdRSs3IHwMk9gvSwpZI0YVBWZocKg96CmQQgq9NNNGhpI5gXXdbP++bu4myT GIx8wR1vjK7nau9GJK+76Bt4bc+1FIfpq4mbSg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=5613 is now in the chain-of-trust
	Query to m.root-servers.net for switch.ch/A
	Received 679 bytes from 202.12.27.33
	;; Response received from [202.12.27.33] 679 octets ;; HEADER SECTION ;; id = 45393 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 7 arcount = 11 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; switch.ch. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) ch. 172800 IN NS a.nic.ch. ch. 172800 IN NS b.nic.ch. ch. 172800 IN NS d.nic.ch. ch. 172800 IN NS e.nic.ch. ch. 172800 IN NS f.nic.ch. ch. 86400 IN DS ( 450 13 2 4994913d9ff4f0df95f08acdf1d66149d873368ff6c1836c64bdface62734fa2 ) ch. 86400 IN RRSIG ( DS 8 1 86400 20240601050000 20240519040000 5613 . ZNdYFvRt3nKtgepsKJ4Y1lblSqwyDOSbUbxhQVJeIWa5ihSn4Ds0dQX/vOxPdqRq+OhwYfeqDiEi ey8sUDsx+0/QaUn/wZIw0owNExFy7DpVbw3MPxtjqwale8MiPkv8+/ANmqMCJzYd+HGMFtSjIxZs m2AvBVP8p3s1GguIIC7o/4aw/0aigv4CEIs8enP4yXd++bEQ3yuto5dvhg25G4KFlsng5TdBoUzG y0jBkKFOxhd5kz5zowLZKEgY7rjjmkvwTLlwqJ96PqZNmTeH/ARxp52lKWhZBg+ONqGCxmJZxp1o bPv53XEm5mQbgQg6BNHPESaJFznN4Y1TNV17mg== ) ;; ADDITIONAL SECTION (11 records) f.nic.ch. 172800 IN A 194.146.106.10 e.nic.ch. 172800 IN A 194.0.17.1 d.nic.ch. 172800 IN A 194.0.25.39 b.nic.ch. 172800 IN A 130.59.31.43 a.nic.ch. 172800 IN A 130.59.31.41 f.nic.ch. 172800 IN AAAA 2001:67c:1010:2::53 e.nic.ch. 172800 IN AAAA 2001:678:3::1 d.nic.ch. 172800 IN AAAA 2001:678:20::39 b.nic.ch. 172800 IN AAAA 2001:620:0:ff::58 a.nic.ch. 172800 IN AAAA 2001:620:0:ff::56 ;; { "EDNS-VERSION": 0 }
	Query to e.root-servers.net for ch/DNSKEY
	Received 670 bytes from 192.203.230.10
	;; Response received from [192.203.230.10] 670 octets ;; HEADER SECTION ;; id = 62516 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 7 arcount = 11 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ch. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) ch. 172800 IN NS a.nic.ch. ch. 172800 IN NS b.nic.ch. ch. 172800 IN NS d.nic.ch. ch. 172800 IN NS e.nic.ch. ch. 172800 IN NS f.nic.ch. ch. 86400 IN DS ( 450 13 2 4994913d9ff4f0df95f08acdf1d66149d873368ff6c1836c64bdface62734fa2 ) ch. 86400 IN RRSIG ( DS 8 1 86400 20240601050000 20240519040000 5613 . ZNdYFvRt3nKtgepsKJ4Y1lblSqwyDOSbUbxhQVJeIWa5ihSn4Ds0dQX/vOxPdqRq+OhwYfeqDiEi ey8sUDsx+0/QaUn/wZIw0owNExFy7DpVbw3MPxtjqwale8MiPkv8+/ANmqMCJzYd+HGMFtSjIxZs m2AvBVP8p3s1GguIIC7o/4aw/0aigv4CEIs8enP4yXd++bEQ3yuto5dvhg25G4KFlsng5TdBoUzG y0jBkKFOxhd5kz5zowLZKEgY7rjjmkvwTLlwqJ96PqZNmTeH/ARxp52lKWhZBg+ONqGCxmJZxp1o bPv53XEm5mQbgQg6BNHPESaJFznN4Y1TNV17mg== ) ;; ADDITIONAL SECTION (11 records) a.nic.ch. 172800 IN A 130.59.31.41 b.nic.ch. 172800 IN A 130.59.31.43 d.nic.ch. 172800 IN A 194.0.25.39 e.nic.ch. 172800 IN A 194.0.17.1 f.nic.ch. 172800 IN A 194.146.106.10 a.nic.ch. 172800 IN AAAA 2001:620:0:ff::56 b.nic.ch. 172800 IN AAAA 2001:620:0:ff::58 d.nic.ch. 172800 IN AAAA 2001:678:20::39 e.nic.ch. 172800 IN AAAA 2001:678:3::1 f.nic.ch. 172800 IN AAAA 2001:67c:1010:2::53 ;; { "EDNS-VERSION": 0 }
	Found child zone ch

	Checking DS between . and ch
	Query to l.root-servers.net for ch/DS
	Received 366 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 366 octets ;; HEADER SECTION ;; id = 49247 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ch. IN DS ;; ANSWER SECTION (2 records) ch. 86400 IN DS ( 450 13 2 4994913d9ff4f0df95f08acdf1d66149d873368ff6c1836c64bdface62734fa2 ) ch. 86400 IN RRSIG ( DS 8 1 86400 20240601050000 20240519040000 5613 . ZNdYFvRt3nKtgepsKJ4Y1lblSqwyDOSbUbxhQVJeIWa5ihSn4Ds0dQX/vOxPdqRq+OhwYfeqDiEi ey8sUDsx+0/QaUn/wZIw0owNExFy7DpVbw3MPxtjqwale8MiPkv8+/ANmqMCJzYd+HGMFtSjIxZs m2AvBVP8p3s1GguIIC7o/4aw/0aigv4CEIs8enP4yXd++bEQ3yuto5dvhg25G4KFlsng5TdBoUzG y0jBkKFOxhd5kz5zowLZKEgY7rjjmkvwTLlwqJ96PqZNmTeH/ARxp52lKWhZBg+ONqGCxmJZxp1o bPv53XEm5mQbgQg6BNHPESaJFznN4Y1TNV17mg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for ch in the . zone
	DS=450/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`ch. 86400 IN RRSIG ( DS 8 1 86400 20240601050000 20240519040000 5613 . ZNdYFvRt3nKtgepsKJ4Y1lblSqwyDOSbUbxhQVJeIWa5ihSn4Ds0dQX/vOxPdqRq+OhwYfeqDiEi ey8sUDsx+0/QaUn/wZIw0owNExFy7DpVbw3MPxtjqwale8MiPkv8+/ANmqMCJzYd+HGMFtSjIxZs m2AvBVP8p3s1GguIIC7o/4aw/0aigv4CEIs8enP4yXd++bEQ3yuto5dvhg25G4KFlsng5TdBoUzG y0jBkKFOxhd5kz5zowLZKEgY7rjjmkvwTLlwqJ96PqZNmTeH/ARxp52lKWhZBg+ONqGCxmJZxp1o bPv53XEm5mQbgQg6BNHPESaJFznN4Y1TNV17mg== )`
	RRSIG=5613 and DNSKEY=5613 verifies the DS RRset
	DS=450/SHA-256 is now in the chain-of-trust
	`ch. 86400 IN DS ( 450 13 2 4994913d9ff4f0df95f08acdf1d66149d873368ff6c1836c64bdface62734fa2 )`
	Query to b.nic.ch for ch/DNSKEY
	Received 369 bytes from 130.59.31.43
	;; Response received from [130.59.31.43] 369 octets ;; HEADER SECTION ;; id = 13863 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ch. IN DNSKEY ;; ANSWER SECTION (4 records) ch. 86400 IN DNSKEY ( 257 3 13 X9G00h5by86dkmMZE7PD2dVzSCGFyiTDpgVh61isB0sA/tohdssa+399tXmXjfltYa4A2LmltIms rxVENcL7XA== ) ; Key ID = 450 ch. 86400 IN DNSKEY ( 256 3 13 rI5r0MR7ImWX940c4GLeuZ+IdVAA0ommOGbtpA+mgE5/6tm3FYVpagpmIK8s/S2+5lY4VuEGtFm0 1dzeoJh/Sw== ) ; Key ID = 216 ch. 86400 IN DNSKEY ( 256 3 13 nlsYVmsOCS7wBWxw+r8VkfSLeM+hxzDBTgqtBzfmhe+rvhzx3pUhiiJUU6QzmbCBfwrS3chqArLY oexNeEAOgg== ) ; Key ID = 8233 ch. 86400 IN RRSIG ( DNSKEY 13 1 86400 20240608100909 20240423090909 450 ch. LkNxcTycjk6Gmm6qbpFdNfPJHjBy4Vpv9IpCAE5mfF2Sjp9N4RRVjJqzmzmt67aovIs+xpId5isV j5/3UdszOw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for ch
	`ch. 86400 IN DNSKEY ( 257 3 13 X9G00h5by86dkmMZE7PD2dVzSCGFyiTDpgVh61isB0sA/tohdssa+399tXmXjfltYa4A2LmltIms rxVENcL7XA== ) ; Key ID = 450`
	`ch. 86400 IN DNSKEY ( 256 3 13 rI5r0MR7ImWX940c4GLeuZ+IdVAA0ommOGbtpA+mgE5/6tm3FYVpagpmIK8s/S2+5lY4VuEGtFm0 1dzeoJh/Sw== ) ; Key ID = 216`
	`ch. 86400 IN DNSKEY ( 256 3 13 nlsYVmsOCS7wBWxw+r8VkfSLeM+hxzDBTgqtBzfmhe+rvhzx3pUhiiJUU6QzmbCBfwrS3chqArLY oexNeEAOgg== ) ; Key ID = 8233`
	DNSKEY=450/SEP is now in the chain-of-trust
	DS=450/SHA-256 verifies DNSKEY=450/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`ch. 86400 IN RRSIG ( DNSKEY 13 1 86400 20240608100909 20240423090909 450 ch. LkNxcTycjk6Gmm6qbpFdNfPJHjBy4Vpv9IpCAE5mfF2Sjp9N4RRVjJqzmzmt67aovIs+xpId5isV j5/3UdszOw== )`
	RRSIG=450 and DNSKEY=450/SEP verifies the DNSKEY RRset
	DNSKEY=216 is now in the chain-of-trust
	DNSKEY=8233 is now in the chain-of-trust
	Query to e.nic.ch for switch.ch/A
	Received 373 bytes from 194.0.17.1
	;; Response received from [194.0.17.1] 373 octets ;; HEADER SECTION ;; id = 21670 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 5 arcount = 7 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; switch.ch. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (5 records) switch.ch. 3600 IN NS scsnms.switch.ch. switch.ch. 3600 IN NS ns3.switch.ch. switch.ch. 3600 IN NS ns2.switch.ch. switch.ch. 3600 IN DS ( 34598 13 2 7b8f73da246b4f0a7cdfa2695649bb7a93d92bbe1a598feb0a3e008e3beee6a3 ) switch.ch. 3600 IN RRSIG ( DS 13 2 3600 20240613031647 20240517113002 8233 ch. bP5V6S2ywf2i6BhXSh4WW5hxjkzusDPwHPaEapev5cuvzT/G1zXfm+C58JkxfwKKlLG36djoy1ut L9ggAN1kKA== ) ;; ADDITIONAL SECTION (7 records) scsnms.switch.ch. 3600 IN A 130.59.31.26 ns3.switch.ch. 3600 IN A 194.58.198.32 ns2.switch.ch. 3600 IN A 130.59.31.29 scsnms.switch.ch. 3600 IN AAAA 2001:620:0:ff::a7 ns3.switch.ch. 3600 IN AAAA 2a01:3f1:3032::53 ns2.switch.ch. 3600 IN AAAA 2001:620:0:ff::2f ;; { "EDNS-VERSION": 0 }
	Query to e.nic.ch for switch.ch/DNSKEY
	Received 373 bytes from 194.0.17.1
	;; Response received from [194.0.17.1] 373 octets ;; HEADER SECTION ;; id = 33764 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 5 arcount = 7 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; switch.ch. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (5 records) switch.ch. 3600 IN NS scsnms.switch.ch. switch.ch. 3600 IN NS ns3.switch.ch. switch.ch. 3600 IN NS ns2.switch.ch. switch.ch. 3600 IN DS ( 34598 13 2 7b8f73da246b4f0a7cdfa2695649bb7a93d92bbe1a598feb0a3e008e3beee6a3 ) switch.ch. 3600 IN RRSIG ( DS 13 2 3600 20240613031647 20240517113002 8233 ch. bP5V6S2ywf2i6BhXSh4WW5hxjkzusDPwHPaEapev5cuvzT/G1zXfm+C58JkxfwKKlLG36djoy1ut L9ggAN1kKA== ) ;; ADDITIONAL SECTION (7 records) scsnms.switch.ch. 3600 IN A 130.59.31.26 ns3.switch.ch. 3600 IN A 194.58.198.32 ns2.switch.ch. 3600 IN A 130.59.31.29 scsnms.switch.ch. 3600 IN AAAA 2001:620:0:ff::a7 ns3.switch.ch. 3600 IN AAAA 2a01:3f1:3032::53 ns2.switch.ch. 3600 IN AAAA 2001:620:0:ff::2f ;; { "EDNS-VERSION": 0 }
	Found child zone switch.ch

switch.ch

	Checking DS between ch and switch.ch
	Query to f.nic.ch for switch.ch/DS
	Received 184 bytes from 194.146.106.10
	;; Response received from [194.146.106.10] 184 octets ;; HEADER SECTION ;; id = 62417 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; switch.ch. IN DS ;; ANSWER SECTION (2 records) switch.ch. 3600 IN DS ( 34598 13 2 7b8f73da246b4f0a7cdfa2695649bb7a93d92bbe1a598feb0a3e008e3beee6a3 ) switch.ch. 3600 IN RRSIG ( DS 13 2 3600 20240613031647 20240517113002 8233 ch. bP5V6S2ywf2i6BhXSh4WW5hxjkzusDPwHPaEapev5cuvzT/G1zXfm+C58JkxfwKKlLG36djoy1ut L9ggAN1kKA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for switch.ch in the ch zone
	DS=34598/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`switch.ch. 3600 IN RRSIG ( DS 13 2 3600 20240613031647 20240517113002 8233 ch. bP5V6S2ywf2i6BhXSh4WW5hxjkzusDPwHPaEapev5cuvzT/G1zXfm+C58JkxfwKKlLG36djoy1ut L9ggAN1kKA== )`
	RRSIG=8233 and DNSKEY=8233 verifies the DS RRset
	DS=34598/SHA-256 is now in the chain-of-trust
	`switch.ch. 3600 IN DS ( 34598 13 2 7b8f73da246b4f0a7cdfa2695649bb7a93d92bbe1a598feb0a3e008e3beee6a3 )`
	Query to ns2.switch.ch for switch.ch/DNSKEY
	Received 383 bytes from 130.59.31.29
	;; Response received from [130.59.31.29] 383 octets ;; HEADER SECTION ;; id = 1155 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; switch.ch. IN DNSKEY ;; ANSWER SECTION (4 records) switch.ch. 86400 IN DNSKEY ( 257 3 13 fuQvlIZiF3jn397J+hmtvdZNYsvLqOKkEtmtxuDAA3ib9rPPiqOMinxsL4Nfhio5tuaLUkQRCcvE 9GN6rFs6gA== ) ; Key ID = 34598 switch.ch. 86400 IN DNSKEY ( 256 3 13 LbCPbBLha5sEOonzOWutQfDOVzzA3lbkV0EjDUiUAC1x0ayOdelsgp4smhnPkcR8GVdGD8ycKtGJ nQqGy98vLg== ) ; Key ID = 35461 switch.ch. 86400 IN DNSKEY ( 256 3 13 Iel9zDS8/wGe8bheenrBcYQ8ECbyhFJ4wP8mVe+vsGNbBrQ9zwotbrwZhqa36ik7bnkVwm323Xya C2gqEqAqNg== ) ; Key ID = 2532 switch.ch. 86400 IN RRSIG ( DNSKEY 13 2 86400 20240619122148 20240504112148 34598 switch.ch. oN+PQQBA6xuYvKlBi/4Uqc5sTLwfB2YO/W9jcguXQOJbJyMs2GnMJL/LqwS+8m2v4s492+FuDY9o qiq7gizxPg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for switch.ch
	`switch.ch. 86400 IN DNSKEY ( 257 3 13 fuQvlIZiF3jn397J+hmtvdZNYsvLqOKkEtmtxuDAA3ib9rPPiqOMinxsL4Nfhio5tuaLUkQRCcvE 9GN6rFs6gA== ) ; Key ID = 34598`
	`switch.ch. 86400 IN DNSKEY ( 256 3 13 LbCPbBLha5sEOonzOWutQfDOVzzA3lbkV0EjDUiUAC1x0ayOdelsgp4smhnPkcR8GVdGD8ycKtGJ nQqGy98vLg== ) ; Key ID = 35461`
	`switch.ch. 86400 IN DNSKEY ( 256 3 13 Iel9zDS8/wGe8bheenrBcYQ8ECbyhFJ4wP8mVe+vsGNbBrQ9zwotbrwZhqa36ik7bnkVwm323Xya C2gqEqAqNg== ) ; Key ID = 2532`
	DNSKEY=34598/SEP is now in the chain-of-trust
	DS=34598/SHA-256 verifies DNSKEY=34598/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`switch.ch. 86400 IN RRSIG ( DNSKEY 13 2 86400 20240619122148 20240504112148 34598 switch.ch. oN+PQQBA6xuYvKlBi/4Uqc5sTLwfB2YO/W9jcguXQOJbJyMs2GnMJL/LqwS+8m2v4s492+FuDY9o qiq7gizxPg== )`
	RRSIG=34598 and DNSKEY=34598/SEP verifies the DNSKEY RRset
	DNSKEY=35461 is now in the chain-of-trust
	DNSKEY=2532 is now in the chain-of-trust
	Query to ns3.switch.ch for switch.ch/A
	Received 1083 bytes from 194.58.198.32
	;; Response received from [194.58.198.32] 1083 octets ;; HEADER SECTION ;; id = 36992 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 4 arcount = 13 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; switch.ch. IN A ;; ANSWER SECTION (2 records) switch.ch. 300 IN A 130.59.31.80 switch.ch. 300 IN RRSIG ( A 13 2 300 20240608053603 20240510120525 2532 switch.ch. hkcsdUHKtj8JA0RbsWcil1dmKgWEmI+l5GOEqKWTTC6TpcSo6uA33zmk0w+F39HIAGyA+bR4gUW3 DriG/9Xaxw== ) ;; AUTHORITY SECTION (4 records) switch.ch. 86400 IN NS ns2.switch.ch. switch.ch. 86400 IN NS ns3.switch.ch. switch.ch. 86400 IN NS scsnms.switch.ch. switch.ch. 86400 IN RRSIG ( NS 13 2 86400 20240609064725 20240515105625 2532 switch.ch. PFhhAC0Ve58WjwDP7rye03ZTVLvvG0rvhjw21RwZHjiE79cDRJmyOc/g0G66oeo/WK0QHhs1L6zb RgtsopdQFg== ) ;; ADDITIONAL SECTION (13 records) ns2.switch.ch. 86400 IN A 130.59.31.29 ns2.switch.ch. 86400 IN RRSIG ( A 13 3 86400 20240612031814 20240513061453 2532 switch.ch. GTbLOmt0EQhnxa0B4HC9A2CZ8oUbNHJmUs21mnuBBmUlaKKEkrCUbjoPKUtwiuJZDdg8MkKZ529V 5txBvtKAmA== ) ns3.switch.ch. 86400 IN A 194.58.198.32 ns3.switch.ch. 86400 IN RRSIG ( A 13 3 86400 20240608064118 20240509120527 2532 switch.ch. kDsHudes6Q5sdeGEY5Hok2VMgCIOgtYv0tel4vsLyAvyQUSH6OkoNLZF9/Nn4e5CW9kV770gO6qP k7uE06hwtQ== ) scsnms.switch.ch. 86400 IN A 130.59.31.26 scsnms.switch.ch. 86400 IN RRSIG ( A 13 3 86400 20240606065859 20240518120524 2532 switch.ch. QWGTh/S+6aHyL/AnXn0jDtWaZz1g8bRRt9fOHYUtw2r1Z8MEMaDiLf0vEma0/xXmdJP1dxOlBSkg ji4DMZPS9Q== ) ns2.switch.ch. 86400 IN AAAA 2001:620:0:ff::2f ns2.switch.ch. 86400 IN RRSIG ( AAAA 13 3 86400 20240607025535 20240519040527 2532 switch.ch. UZU1x6Gg6LnUNN5O6fn+pXRo+msTj/v+awMQ6z4ti+/33goQaz1ZBxy3xmHW1TWtL+hjCZPGsjF+ 26L/xMbWEg== ) ns3.switch.ch. 86400 IN AAAA 2a01:3f1:3032::53 ns3.switch.ch. 86400 IN RRSIG ( AAAA 13 3 86400 20240605095400 20240507115812 2532 switch.ch. RWAmCngY+6GdYBRPTyYe3seP9Me4R8wVhWucQ+2pu/gS+zmPdgn8Bd1b+82UCMCfxrwn1FlrulHx 45eEUe3RBw== ) scsnms.switch.ch. 86400 IN AAAA 2001:620:0:ff::a7 scsnms.switch.ch. 86400 IN RRSIG ( AAAA 13 3 86400 20240610163052 20240513061453 2532 switch.ch. 1t7swFu9t0e16la8zG8Cmo93PHjUspw1EXgIARZYQmeWebqn1LLIzGtt3dEMWU5DErwivy7t8nkH IZKECKCv0Q== ) ;; { "EDNS-VERSION": 0 }
	ns3.switch.ch is authoritative for switch.ch
	Found RRSIG signed by switch.ch zone
	Query to scsnms.switch.ch for switch.ch/SOA
	Received 200 bytes from 130.59.31.26
	;; Response received from [130.59.31.26] 200 octets ;; HEADER SECTION ;; id = 61792 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; switch.ch. IN SOA ;; ANSWER SECTION (2 records) switch.ch. 86400 IN SOA ( scsnms.switch.ch. dns-operation.switch.ch. 2024051900 ;serial 900 ;refresh 600 ;retry 604800 ;expire 180 ;minimum ) switch.ch. 86400 IN RRSIG ( SOA 13 2 86400 20240613163706 20240519040527 2532 switch.ch. X0bqFLCai64VgP8pczr9V4Jqix01gEw2Nt6En8iMq97VyZcRLJO0d86xgbn2CHTYEXZ/qQRAcWXM dwsOyLcQ9Q== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns2.switch.ch for switch.ch/SOA
	Received 200 bytes from 130.59.31.29
	;; Response received from [130.59.31.29] 200 octets ;; HEADER SECTION ;; id = 40499 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; switch.ch. IN SOA ;; ANSWER SECTION (2 records) switch.ch. 86400 IN SOA ( scsnms.switch.ch. dns-operation.switch.ch. 2024051900 ;serial 900 ;refresh 600 ;retry 604800 ;expire 180 ;minimum ) switch.ch. 86400 IN RRSIG ( SOA 13 2 86400 20240613163706 20240519040527 2532 switch.ch. X0bqFLCai64VgP8pczr9V4Jqix01gEw2Nt6En8iMq97VyZcRLJO0d86xgbn2CHTYEXZ/qQRAcWXM dwsOyLcQ9Q== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns3.switch.ch for switch.ch/A
	Received 1083 bytes from 194.58.198.32
	;; Response received from [194.58.198.32] 1083 octets ;; HEADER SECTION ;; id = 2620 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 4 arcount = 13 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; switch.ch. IN A ;; ANSWER SECTION (2 records) switch.ch. 300 IN A 130.59.31.80 switch.ch. 300 IN RRSIG ( A 13 2 300 20240608053603 20240510120525 2532 switch.ch. hkcsdUHKtj8JA0RbsWcil1dmKgWEmI+l5GOEqKWTTC6TpcSo6uA33zmk0w+F39HIAGyA+bR4gUW3 DriG/9Xaxw== ) ;; AUTHORITY SECTION (4 records) switch.ch. 86400 IN NS ns2.switch.ch. switch.ch. 86400 IN NS ns3.switch.ch. switch.ch. 86400 IN NS scsnms.switch.ch. switch.ch. 86400 IN RRSIG ( NS 13 2 86400 20240609064725 20240515105625 2532 switch.ch. PFhhAC0Ve58WjwDP7rye03ZTVLvvG0rvhjw21RwZHjiE79cDRJmyOc/g0G66oeo/WK0QHhs1L6zb RgtsopdQFg== ) ;; ADDITIONAL SECTION (13 records) ns2.switch.ch. 86400 IN A 130.59.31.29 ns2.switch.ch. 86400 IN RRSIG ( A 13 3 86400 20240612031814 20240513061453 2532 switch.ch. GTbLOmt0EQhnxa0B4HC9A2CZ8oUbNHJmUs21mnuBBmUlaKKEkrCUbjoPKUtwiuJZDdg8MkKZ529V 5txBvtKAmA== ) ns3.switch.ch. 86400 IN A 194.58.198.32 ns3.switch.ch. 86400 IN RRSIG ( A 13 3 86400 20240608064118 20240509120527 2532 switch.ch. kDsHudes6Q5sdeGEY5Hok2VMgCIOgtYv0tel4vsLyAvyQUSH6OkoNLZF9/Nn4e5CW9kV770gO6qP k7uE06hwtQ== ) scsnms.switch.ch. 86400 IN A 130.59.31.26 scsnms.switch.ch. 86400 IN RRSIG ( A 13 3 86400 20240606065859 20240518120524 2532 switch.ch. QWGTh/S+6aHyL/AnXn0jDtWaZz1g8bRRt9fOHYUtw2r1Z8MEMaDiLf0vEma0/xXmdJP1dxOlBSkg ji4DMZPS9Q== ) ns2.switch.ch. 86400 IN AAAA 2001:620:0:ff::2f ns2.switch.ch. 86400 IN RRSIG ( AAAA 13 3 86400 20240607025535 20240519040527 2532 switch.ch. UZU1x6Gg6LnUNN5O6fn+pXRo+msTj/v+awMQ6z4ti+/33goQaz1ZBxy3xmHW1TWtL+hjCZPGsjF+ 26L/xMbWEg== ) ns3.switch.ch. 86400 IN AAAA 2a01:3f1:3032::53 ns3.switch.ch. 86400 IN RRSIG ( AAAA 13 3 86400 20240605095400 20240507115812 2532 switch.ch. RWAmCngY+6GdYBRPTyYe3seP9Me4R8wVhWucQ+2pu/gS+zmPdgn8Bd1b+82UCMCfxrwn1FlrulHx 45eEUe3RBw== ) scsnms.switch.ch. 86400 IN AAAA 2001:620:0:ff::a7 scsnms.switch.ch. 86400 IN RRSIG ( AAAA 13 3 86400 20240610163052 20240513061453 2532 switch.ch. 1t7swFu9t0e16la8zG8Cmo93PHjUspw1EXgIARZYQmeWebqn1LLIzGtt3dEMWU5DErwivy7t8nkH IZKECKCv0Q== ) ;; { "EDNS-VERSION": 0 }
	switch.ch A RR has value 130.59.31.80
	Found 1 RRSIGs over A RRset
	`switch.ch. 300 IN RRSIG ( A 13 2 300 20240608053603 20240510120525 2532 switch.ch. hkcsdUHKtj8JA0RbsWcil1dmKgWEmI+l5GOEqKWTTC6TpcSo6uA33zmk0w+F39HIAGyA+bR4gUW3 DriG/9Xaxw== )`
	RRSIG=2532 and DNSKEY=2532 verifies the A RRset

switch.ch

	Query to ns2.switch.ch for switch.ch/A
	Received 159 bytes from 130.59.31.29
	;; Response received from [130.59.31.29] 159 octets ;; HEADER SECTION ;; id = 57629 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; switch.ch. IN A ;; ANSWER SECTION (2 records) switch.ch. 300 IN A 130.59.31.80 switch.ch. 300 IN RRSIG ( A 13 2 300 20240608053603 20240510120525 2532 switch.ch. hkcsdUHKtj8JA0RbsWcil1dmKgWEmI+l5GOEqKWTTC6TpcSo6uA33zmk0w+F39HIAGyA+bR4gUW3 DriG/9Xaxw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns2.switch.ch is authoritative for switch.ch
	Found RRSIG signed by switch.ch zone
	Query to ns2.switch.ch for switch.ch/A
	Received 159 bytes from 130.59.31.29
	;; Response received from [130.59.31.29] 159 octets ;; HEADER SECTION ;; id = 14336 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; switch.ch. IN A ;; ANSWER SECTION (2 records) switch.ch. 300 IN A 130.59.31.80 switch.ch. 300 IN RRSIG ( A 13 2 300 20240608053603 20240510120525 2532 switch.ch. hkcsdUHKtj8JA0RbsWcil1dmKgWEmI+l5GOEqKWTTC6TpcSo6uA33zmk0w+F39HIAGyA+bR4gUW3 DriG/9Xaxw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	switch.ch A RR has value 130.59.31.80
	Found 1 RRSIGs over A RRset
	`switch.ch. 300 IN RRSIG ( A 13 2 300 20240608053603 20240510120525 2532 switch.ch. hkcsdUHKtj8JA0RbsWcil1dmKgWEmI+l5GOEqKWTTC6TpcSo6uA33zmk0w+F39HIAGyA+bR4gUW3 DriG/9Xaxw== )`
	RRSIG=2532 and DNSKEY=2532 verifies the A RRset

switch.ch

	Query to scsnms.switch.ch for switch.ch/A
	Received 159 bytes from 130.59.31.26
	;; Response received from [130.59.31.26] 159 octets ;; HEADER SECTION ;; id = 24983 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; switch.ch. IN A ;; ANSWER SECTION (2 records) switch.ch. 300 IN A 130.59.31.80 switch.ch. 300 IN RRSIG ( A 13 2 300 20240608053603 20240510120525 2532 switch.ch. hkcsdUHKtj8JA0RbsWcil1dmKgWEmI+l5GOEqKWTTC6TpcSo6uA33zmk0w+F39HIAGyA+bR4gUW3 DriG/9Xaxw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	scsnms.switch.ch is authoritative for switch.ch
	Found RRSIG signed by switch.ch zone
	Query to scsnms.switch.ch for switch.ch/A
	Received 159 bytes from 130.59.31.26
	;; Response received from [130.59.31.26] 159 octets ;; HEADER SECTION ;; id = 53393 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; switch.ch. IN A ;; ANSWER SECTION (2 records) switch.ch. 300 IN A 130.59.31.80 switch.ch. 300 IN RRSIG ( A 13 2 300 20240608053603 20240510120525 2532 switch.ch. hkcsdUHKtj8JA0RbsWcil1dmKgWEmI+l5GOEqKWTTC6TpcSo6uA33zmk0w+F39HIAGyA+bR4gUW3 DriG/9Xaxw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	switch.ch A RR has value 130.59.31.80
	Found 1 RRSIGs over A RRset
	`switch.ch. 300 IN RRSIG ( A 13 2 300 20240608053603 20240510120525 2532 switch.ch. hkcsdUHKtj8JA0RbsWcil1dmKgWEmI+l5GOEqKWTTC6TpcSo6uA33zmk0w+F39HIAGyA+bR4gUW3 DriG/9Xaxw== )`
	RRSIG=2532 and DNSKEY=2532 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test switch.ch at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: