Back to Verisign Labs Tools
Domain Name: Detail: more(+) / less(-) Time: 2025-07-04 03:12:09 UTC

Analyzing DNSSEC problems for CAPITOLGIFTSHOP.GOV

.
Found 4 DNSKEY records for .
DS=20326/SHA-256 verifies DNSKEY=20326/SEP
Found 1 RRSIGs over DNSKEY RRset
RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
GOV
Found 1 DS records for GOV in the . zone
DS=2536/SHA-256 has algorithm ECDSAP256SHA256
Found 1 RRSIGs over DS RRset
RRSIG=46441 and DNSKEY=46441 verifies the DS RRset
Found 2 DNSKEY records for GOV
DS=2536/SHA-256 verifies DNSKEY=2536/SEP
Found 1 RRSIGs over DNSKEY RRset
RRSIG=2536 and DNSKEY=2536/SEP verifies the DNSKEY RRset
CAPITOLGIFTSHOP.GOV
Found 2 DS records for CAPITOLGIFTSHOP.GOV in the GOV zone
DS=62962/SHA-1 uses a deprecated digest algorithm
DS=62962/SHA-1 has algorithm RSASHA256
DS=62962/SHA-256 has algorithm RSASHA256
Found 1 RRSIGs over DS RRset
RRSIG=35496 and DNSKEY=35496 verifies the DS RRset
Found 3 DNSKEY records for CAPITOLGIFTSHOP.GOV
None of the 3 DNSKEY records could be validated by any of the 2 DS records
Found 2 RRSIGs over DNSKEY RRset
RRSIG=32116 and DNSKEY=32116/SEP verifies the DNSKEY RRset
The DNSKEY RRset was not signed by any trusted keys
ns2.comcastbusiness.net is authoritative for CAPITOLGIFTSHOP.GOV
ns1.aoc.GOV serial (3038) differs from ns3.comcastbusiness.net serial (3037)
authns1.centurylink.net serial (3038) differs from ns3.comcastbusiness.net serial (3037)
ns2.aoc.GOV serial (3038) differs from ns3.comcastbusiness.net serial (3037)
authns2.centurylink.net serial (3038) differs from ns3.comcastbusiness.net serial (3037)
Found 1 RRSIGs over NSEC RRset
RRSIG=62695 and DNSKEY=62695 verifies the NSEC RRset
NSEC proves no records of type A exist for CAPITOLGIFTSHOP.GOV
Found 1 RRSIGs over SOA RRset
RRSIG=62695 and DNSKEY=62695 verifies the SOA RRset
CAPITOLGIFTSHOP.GOV
ns2.aoc.GOV is authoritative for CAPITOLGIFTSHOP.GOV
Found 1 RRSIGs over NSEC RRset
RRSIG=62695 and DNSKEY=62695 verifies the NSEC RRset
NSEC proves no records of type A exist for CAPITOLGIFTSHOP.GOV
Found 1 RRSIGs over SOA RRset
RRSIG=62695 and DNSKEY=62695 verifies the SOA RRset
CAPITOLGIFTSHOP.GOV
authns2.centurylink.net is authoritative for CAPITOLGIFTSHOP.GOV
Found 1 RRSIGs over NSEC RRset
RRSIG=62695 and DNSKEY=62695 verifies the NSEC RRset
NSEC proves no records of type A exist for CAPITOLGIFTSHOP.GOV
Found 1 RRSIGs over SOA RRset
RRSIG=62695 and DNSKEY=62695 verifies the SOA RRset
CAPITOLGIFTSHOP.GOV
ns3.comcastbusiness.net is authoritative for CAPITOLGIFTSHOP.GOV
Found 1 RRSIGs over NSEC RRset
RRSIG=62695 and DNSKEY=62695 verifies the NSEC RRset
NSEC proves no records of type A exist for CAPITOLGIFTSHOP.GOV
Found 1 RRSIGs over SOA RRset
RRSIG=62695 and DNSKEY=62695 verifies the SOA RRset
CAPITOLGIFTSHOP.GOV
ns1.aoc.GOV is authoritative for CAPITOLGIFTSHOP.GOV
Found 1 RRSIGs over NSEC RRset
RRSIG=62695 and DNSKEY=62695 verifies the NSEC RRset
NSEC proves no records of type A exist for CAPITOLGIFTSHOP.GOV
Found 1 RRSIGs over SOA RRset
RRSIG=62695 and DNSKEY=62695 verifies the SOA RRset
CAPITOLGIFTSHOP.GOV
authns1.centurylink.net is authoritative for CAPITOLGIFTSHOP.GOV
Found 1 RRSIGs over NSEC RRset
RRSIG=62695 and DNSKEY=62695 verifies the NSEC RRset
NSEC proves no records of type A exist for CAPITOLGIFTSHOP.GOV
Found 1 RRSIGs over SOA RRset
RRSIG=62695 and DNSKEY=62695 verifies the SOA RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test CAPITOLGIFTSHOP.GOV at dnsviz.net.

DNSSEC Debugger

↓ Advanced options