DNSSEC Analyzer - FNAL.GOV

Domain Name:

Time: 2020-07-04 23:13:18 UTC, NTP stratum 4

Analyzing DNSSEC problems for FNAL.GOV

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to h.root-servers.net for ./DNSKEY
	Received 1139 bytes from 198.97.190.53
	;; Answer received from 198.97.190.53 (1139 bytes) ;; HEADER SECTION ;; id = 34724 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAc4qsciJ5MdMUIu4n/pSTsSiU9OCyAanPTe5TcMX4v1hxhpFwiTGQUv3BXT6IAO4litrZKTU aj4vitqHW1+RQsHn3k/gSvt7FwyQwpy0mEnShBgr6RQiGtlBODNY67sTl+W8M/b6SLTAaaDri3BO 5u6wrDs149rMELJAdoVBjmXW+zRH3kZzh3lwyTZsYtk7L+3DYbTiiHq+sRB4F9XoBPAz5Psv4q4E iPq07nW3acbW84zTz3CyQUmQkJT9VB1oUKHz6sNoyccqzcMX4q1GHAYpQ7FAXlKMxidoN1Ay5DWA NgTmgJXzKhcI2nIZoq1x3yq4814O1LQd9QP68gI37+0= ) ; Key ID = 48903 . 172800 IN DNSKEY ( 256 3 8 AwEAAdauOGxLhfAKFTTZwGhBXbk793QKdWIQRjiSftWdusCwkPhNyJrIjwtNffCWXGLlZAbpcs41 4RE3oS1qVwV+AdXsO92SBu5haGlxMUk0NqZO7Xlf84/wrzGZVRRouPo5pNX/CKS8Mv9UOi0olKGC u31dNfh8qCszWZcloLDgeLzSnQSkvFoGe69vNCfh7feESKedkBC2qRz0BZv9+oJI0IY/3D7WEnV0 NOlf8gSHozhfJFJ/ZAKtvw/Q3ogrVJFk0LyVaU/NVtVA5FM4pVMIRID7pfrPi78aAzG7b/Wh/Pce 4jPAIpS3dApq25YkvMuPvfB91NMf9FemKwlp78PBVcM= ) ; Key ID = 46594 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20200722000000 20200701000000 20326 . OegGYuMyXFOfyJusWYcPZbbrbjHTk5zkyAFfgGf8vWUH8tHoLHn02+QK8u2D/RUAvacwChEOoh3/ iAW5n5GJk+CLYtilcgtEt5uKYX5uVt/vM9aDKr/hGmnhq1Z75scHpLRwL9e/icHZuiyQdgElGwwL hh1vn+m29fwwyAim3UG28gNY/DaifSuK/9g6dlCFDCjBHnOuSqOxoM53vfaQB/bGsXSTZbbWtReh ixpccKxVGwjl3XDG27Itgji7s/JQM2AhgYJcDULa0JTN06fGQM5dmhvvXTlkAZ7fhqTVzyBQcsu9 kbRbYGc0mhDCUzPv6qEigw+pKpifMmVC3+Q7sw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAc4qsciJ5MdMUIu4n/pSTsSiU9OCyAanPTe5TcMX4v1hxhpFwiTGQUv3BXT6IAO4litrZKTU aj4vitqHW1+RQsHn3k/gSvt7FwyQwpy0mEnShBgr6RQiGtlBODNY67sTl+W8M/b6SLTAaaDri3BO 5u6wrDs149rMELJAdoVBjmXW+zRH3kZzh3lwyTZsYtk7L+3DYbTiiHq+sRB4F9XoBPAz5Psv4q4E iPq07nW3acbW84zTz3CyQUmQkJT9VB1oUKHz6sNoyccqzcMX4q1GHAYpQ7FAXlKMxidoN1Ay5DWA NgTmgJXzKhcI2nIZoq1x3yq4814O1LQd9QP68gI37+0= ) ; Key ID = 48903`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAdauOGxLhfAKFTTZwGhBXbk793QKdWIQRjiSftWdusCwkPhNyJrIjwtNffCWXGLlZAbpcs41 4RE3oS1qVwV+AdXsO92SBu5haGlxMUk0NqZO7Xlf84/wrzGZVRRouPo5pNX/CKS8Mv9UOi0olKGC u31dNfh8qCszWZcloLDgeLzSnQSkvFoGe69vNCfh7feESKedkBC2qRz0BZv9+oJI0IY/3D7WEnV0 NOlf8gSHozhfJFJ/ZAKtvw/Q3ogrVJFk0LyVaU/NVtVA5FM4pVMIRID7pfrPi78aAzG7b/Wh/Pce 4jPAIpS3dApq25YkvMuPvfB91NMf9FemKwlp78PBVcM= ) ; Key ID = 46594`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20200722000000 20200701000000 20326 . OegGYuMyXFOfyJusWYcPZbbrbjHTk5zkyAFfgGf8vWUH8tHoLHn02+QK8u2D/RUAvacwChEOoh3/ iAW5n5GJk+CLYtilcgtEt5uKYX5uVt/vM9aDKr/hGmnhq1Z75scHpLRwL9e/icHZuiyQdgElGwwL hh1vn+m29fwwyAim3UG28gNY/DaifSuK/9g6dlCFDCjBHnOuSqOxoM53vfaQB/bGsXSTZbbWtReh ixpccKxVGwjl3XDG27Itgji7s/JQM2AhgYJcDULa0JTN06fGQM5dmhvvXTlkAZ7fhqTVzyBQcsu9 kbRbYGc0mhDCUzPv6qEigw+pKpifMmVC3+Q7sw== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=48903 is now in the chain-of-trust
	DNSKEY=46594 is now in the chain-of-trust
	Query to i.root-servers.net for FNAL.GOV/A
	Received 666 bytes from 192.36.148.17
	;; Answer received from 192.36.148.17 (666 bytes) ;; HEADER SECTION ;; id = 31654 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 7 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) gov. 172800 IN NS a.gov-servers.net. gov. 172800 IN NS b.gov-servers.net. gov. 172800 IN NS c.gov-servers.net. gov. 172800 IN NS d.gov-servers.net. gov. 86400 IN DS 7698 8 1 6f109b46a80cea9613dc86d5a3e065520505aafe gov. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20200717170000 20200704160000 46594 . AHOP1iLfNhPc9HTKzfmJ8w7sX3G39rBw7pbsmVayE3KdeWevdTUrnk8mXSDoRdXjvl1pDjjXnkBw YQQSww/oJmMF64gLRoQcWkUlmY8Mfsxnnn58Y3n6mfDm8qM0AqGScONcYjFdhtC5tFYcu2ls9xKk KgYa/a9zc6KkNPGJQjq4pLDB0XbRKZLgjZTMTRlgMM3O5FNp4dVfDIm8GlWapzoaPht+5BU9Dq5k PL4NN2fkR+hEs0P9JmVYN31rbXGdF1N7yG1lbj75DZSBpX1neAEHkyhoeupTnqdT3tXpDz8iXjkw ZCAVdoBbYhFquViGd4thxRsTUSbfPM41W8eO3g== ) ;; ADDITIONAL SECTION (9 records) a.gov-servers.net. 172800 IN A 69.36.157.30 a.gov-servers.net. 172800 IN AAAA 2001:500:4431::2:30 b.gov-servers.net. 172800 IN A 209.112.123.30 b.gov-servers.net. 172800 IN AAAA 2620:74:27::2:30 c.gov-servers.net. 172800 IN A 69.36.153.30 c.gov-servers.net. 172800 IN AAAA 2620:74:28::2:30 d.gov-servers.net. 172800 IN A 81.19.194.30 d.gov-servers.net. 172800 IN AAAA 2620:74:29::2:30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to c.root-servers.net for GOV/DNSKEY
	Received 661 bytes from 192.33.4.12
	;; Answer received from 192.33.4.12 (661 bytes) ;; HEADER SECTION ;; id = 31851 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 7 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; GOV. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) gov. 172800 IN NS a.gov-servers.net. gov. 172800 IN NS c.gov-servers.net. gov. 172800 IN NS b.gov-servers.net. gov. 172800 IN NS d.gov-servers.net. gov. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ) gov. 86400 IN DS 7698 8 1 6f109b46a80cea9613dc86d5a3e065520505aafe gov. 86400 IN RRSIG ( DS 8 1 86400 20200717170000 20200704160000 46594 . AHOP1iLfNhPc9HTKzfmJ8w7sX3G39rBw7pbsmVayE3KdeWevdTUrnk8mXSDoRdXjvl1pDjjXnkBw YQQSww/oJmMF64gLRoQcWkUlmY8Mfsxnnn58Y3n6mfDm8qM0AqGScONcYjFdhtC5tFYcu2ls9xKk KgYa/a9zc6KkNPGJQjq4pLDB0XbRKZLgjZTMTRlgMM3O5FNp4dVfDIm8GlWapzoaPht+5BU9Dq5k PL4NN2fkR+hEs0P9JmVYN31rbXGdF1N7yG1lbj75DZSBpX1neAEHkyhoeupTnqdT3tXpDz8iXjkw ZCAVdoBbYhFquViGd4thxRsTUSbfPM41W8eO3g== ) ;; ADDITIONAL SECTION (9 records) a.gov-servers.net. 172800 IN A 69.36.157.30 b.gov-servers.net. 172800 IN A 209.112.123.30 c.gov-servers.net. 172800 IN A 69.36.153.30 d.gov-servers.net. 172800 IN A 81.19.194.30 a.gov-servers.net. 172800 IN AAAA 2001:500:4431::2:30 b.gov-servers.net. 172800 IN AAAA 2620:74:27::2:30 c.gov-servers.net. 172800 IN AAAA 2620:74:28::2:30 d.gov-servers.net. 172800 IN AAAA 2620:74:29::2:30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone GOV

GOV

	Checking DS between . and GOV
	Query to j.root-servers.net for GOV/DS
	Received 403 bytes from 192.58.128.30
	;; Answer received from 192.58.128.30 (403 bytes) ;; HEADER SECTION ;; id = 61506 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; GOV. IN DS ;; ANSWER SECTION (3 records) GOV. 86400 IN DS 7698 8 1 6f109b46a80cea9613dc86d5a3e065520505aafe GOV. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ) GOV. 86400 IN RRSIG ( DS 8 1 86400 20200717170000 20200704160000 46594 . AHOP1iLfNhPc9HTKzfmJ8w7sX3G39rBw7pbsmVayE3KdeWevdTUrnk8mXSDoRdXjvl1pDjjXnkBw YQQSww/oJmMF64gLRoQcWkUlmY8Mfsxnnn58Y3n6mfDm8qM0AqGScONcYjFdhtC5tFYcu2ls9xKk KgYa/a9zc6KkNPGJQjq4pLDB0XbRKZLgjZTMTRlgMM3O5FNp4dVfDIm8GlWapzoaPht+5BU9Dq5k PL4NN2fkR+hEs0P9JmVYN31rbXGdF1N7yG1lbj75DZSBpX1neAEHkyhoeupTnqdT3tXpDz8iXjkw ZCAVdoBbYhFquViGd4thxRsTUSbfPM41W8eO3g== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DS records for GOV in the . zone
	DS=7698/SHA-1 has algorithm RSASHA256
	DS=7698/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`GOV. 86400 IN RRSIG ( DS 8 1 86400 20200717170000 20200704160000 46594 . AHOP1iLfNhPc9HTKzfmJ8w7sX3G39rBw7pbsmVayE3KdeWevdTUrnk8mXSDoRdXjvl1pDjjXnkBw YQQSww/oJmMF64gLRoQcWkUlmY8Mfsxnnn58Y3n6mfDm8qM0AqGScONcYjFdhtC5tFYcu2ls9xKk KgYa/a9zc6KkNPGJQjq4pLDB0XbRKZLgjZTMTRlgMM3O5FNp4dVfDIm8GlWapzoaPht+5BU9Dq5k PL4NN2fkR+hEs0P9JmVYN31rbXGdF1N7yG1lbj75DZSBpX1neAEHkyhoeupTnqdT3tXpDz8iXjkw ZCAVdoBbYhFquViGd4thxRsTUSbfPM41W8eO3g== )`
	RRSIG=46594 and DNSKEY=46594 verifies the DS RRset
	DS=7698/SHA-1 is now in the chain-of-trust
	`GOV. 86400 IN DS 7698 8 1 6f109b46a80cea9613dc86d5a3e065520505aafe`
	`GOV. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 )`
	Query to d.gov-servers.net for GOV/DNSKEY
	Received 777 bytes from 81.19.194.30
	;; Answer received from 81.19.194.30 (777 bytes) ;; HEADER SECTION ;; id = 59900 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; GOV. IN DNSKEY ;; ANSWER SECTION (3 records) GOV. 86400 IN DNSKEY ( 257 3 8 AQO8daaz7B+yshOfL60rytKd9aOSujgponEw3fwBMEC3/+e9XzHw2k+VKnbJTZ+QaVtpfUd1q9HK ZIv/ck83Gl5TjYKE5jtUZ2kpEDZfVNGv6yx0smtWAXv1nCJS9ohnyOTd397eMojGDHqkEC+uojES cZheEkMxzgCZwDAs+/CSU7mSuHtCRZn19xlZUd5Gv7yDQ3mbOUwuy30oSk0z1Q5UUPpoihOugIZH FX6Jk7NLiW2wlqfq9qhV4zj7TiBiJY0mCc4zHN8/aq2VKDHp2Na7mWzvKyTy+SYQkBQ/08LbPwj9 YMc+uCzKL6sU/ObHv17EFhD8aPDftTHZvV9L+OZr ) ; Key ID = 7698 GOV. 86400 IN DNSKEY ( 256 3 8 AwEAAaRBt9ApLI72LFfiXVo0ye5nyqvBZ60rp7FMVEohCYuM3WOBFxty2pkgIj7K3AEw6sHOJ6Kb J6yut0qXTxEIYu1jHm/Lg+VLrDLXLzw3I1BA+mAymmfR4mkyjT/umY/0PqXETGCmTOVFx4guyhDe EVr65wIGFXpRfMqJiCSXJKmhSFvAqw1vlBRAUYDG4G9tGhUJaJdflAKWvf9Rp5TicwU= ) ; Key ID = 40176 GOV. 86400 IN RRSIG ( DNSKEY 8 1 86400 20200713190254 20200628185754 7698 gov. cpLMlX7mvjmWoqy6BKZhJ39gUGSOy+c5uDA/f5A8nwkBllxnKp9jlCtyrJL6/FHVclJCkeeXzWPb 79sxp7aRZHQgR7jp4r/i6HSWGhOHCWYBNUm69ghiMBUPD+z8F29lp66nZTVDkgssvLTc/hGf5DF/ QfvNQE1ciB0MtKlmEk1QJRYNO3R5U1ZbjvH6+IpR+TfvkQxvXdPo/jeWN+OqOuZ6jg7bS5q3mWds fZHILyyJfXvAMq0wGnpA6bLHMXsT0okBsaAYQ3TTXJzUPubdNEwmey2hE9Qqs00huFbENw9tXnBb nuzJWV4zTvnbAdnGwYzhhYLKBp7W5xF1nEKcwA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DNSKEY records for GOV
	`GOV. 86400 IN DNSKEY ( 257 3 8 AQO8daaz7B+yshOfL60rytKd9aOSujgponEw3fwBMEC3/+e9XzHw2k+VKnbJTZ+QaVtpfUd1q9HK ZIv/ck83Gl5TjYKE5jtUZ2kpEDZfVNGv6yx0smtWAXv1nCJS9ohnyOTd397eMojGDHqkEC+uojES cZheEkMxzgCZwDAs+/CSU7mSuHtCRZn19xlZUd5Gv7yDQ3mbOUwuy30oSk0z1Q5UUPpoihOugIZH FX6Jk7NLiW2wlqfq9qhV4zj7TiBiJY0mCc4zHN8/aq2VKDHp2Na7mWzvKyTy+SYQkBQ/08LbPwj9 YMc+uCzKL6sU/ObHv17EFhD8aPDftTHZvV9L+OZr ) ; Key ID = 7698`
	`GOV. 86400 IN DNSKEY ( 256 3 8 AwEAAaRBt9ApLI72LFfiXVo0ye5nyqvBZ60rp7FMVEohCYuM3WOBFxty2pkgIj7K3AEw6sHOJ6Kb J6yut0qXTxEIYu1jHm/Lg+VLrDLXLzw3I1BA+mAymmfR4mkyjT/umY/0PqXETGCmTOVFx4guyhDe EVr65wIGFXpRfMqJiCSXJKmhSFvAqw1vlBRAUYDG4G9tGhUJaJdflAKWvf9Rp5TicwU= ) ; Key ID = 40176`
	DNSKEY=7698/SEP is now in the chain-of-trust
	DS=7698/SHA-1 verifies DNSKEY=7698/SEP
	DS=7698/SHA-256 verifies DNSKEY=7698/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`GOV. 86400 IN RRSIG ( DNSKEY 8 1 86400 20200713190254 20200628185754 7698 gov. cpLMlX7mvjmWoqy6BKZhJ39gUGSOy+c5uDA/f5A8nwkBllxnKp9jlCtyrJL6/FHVclJCkeeXzWPb 79sxp7aRZHQgR7jp4r/i6HSWGhOHCWYBNUm69ghiMBUPD+z8F29lp66nZTVDkgssvLTc/hGf5DF/ QfvNQE1ciB0MtKlmEk1QJRYNO3R5U1ZbjvH6+IpR+TfvkQxvXdPo/jeWN+OqOuZ6jg7bS5q3mWds fZHILyyJfXvAMq0wGnpA6bLHMXsT0okBsaAYQ3TTXJzUPubdNEwmey2hE9Qqs00huFbENw9tXnBb nuzJWV4zTvnbAdnGwYzhhYLKBp7W5xF1nEKcwA== )`
	RRSIG=7698 and DNSKEY=7698/SEP verifies the DNSKEY RRset
	DNSKEY=40176 is now in the chain-of-trust
	Query to d.gov-servers.net for FNAL.GOV/A
	Received 570 bytes from 81.19.194.30
	;; Answer received from 81.19.194.30 (570 bytes) ;; HEADER SECTION ;; id = 43787 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 9 arcount = 5 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) FNAL.GOV. 86400 IN NS ns1.FNAL.GOV. FNAL.GOV. 86400 IN NS adns1.es.net. FNAL.GOV. 86400 IN NS ns2.FNAL.GOV. FNAL.GOV. 86400 IN NS adns2.es.net. FNAL.GOV. 3600 IN DS 51525 7 1 e037ffe18a8a60b1ccab9ffe20f965c54f4e948a FNAL.GOV. 3600 IN DS 42708 7 1 c5dd8356d2b72daf53fb6a495ad3e1514e998a64 FNAL.GOV. 3600 IN DS ( 42708 7 2 815dba109bac952d72dce5c6eb23dca533fecce10f9b3c6769790c899176384a ) FNAL.GOV. 3600 IN DS ( 51525 7 2 aedde3335dc4e0b3e082cf5a2cccdbc46c4890aaee786d726ab3ac3b22437358 ) FNAL.GOV. 3600 IN RRSIG ( DS 8 2 3600 20200711221007 20200704221007 40176 gov. ObQUBDO7IZQxAr1/pqdYQjDIxfo6lW+aP5nNBVjg29gn4+KsgE92Rfvqb1Vd1PAznlQHaAIWs+ev e3z+ujRclKO0GBCRRHN3TV6vopCqzjcwbfN+E5GAWsdcl62tCinhH9Chy4t1CzrTVtMjdggnkEjS s9St8gINP0Q28KnTcRA8905R6+YmDhdaysc991ffgrfeJWWgcUEXGeb2Ax49Aw== ) ;; ADDITIONAL SECTION (5 records) ns1.FNAL.GOV. 86400 IN A 198.49.208.71 ns1.FNAL.GOV. 86400 IN AAAA 2620:6a:0:1203::208:71 ns2.FNAL.GOV. 86400 IN A 198.49.208.70 ns2.FNAL.GOV. 86400 IN AAAA 2620:6a:0:1203::208:70 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to c.gov-servers.net for FNAL.GOV/DNSKEY
	Received 570 bytes from 69.36.153.30
	;; Answer received from 69.36.153.30 (570 bytes) ;; HEADER SECTION ;; id = 47979 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 9 arcount = 5 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) FNAL.GOV. 86400 IN NS ns1.FNAL.GOV. FNAL.GOV. 86400 IN NS adns1.es.net. FNAL.GOV. 86400 IN NS ns2.FNAL.GOV. FNAL.GOV. 86400 IN NS adns2.es.net. FNAL.GOV. 3600 IN DS 51525 7 1 e037ffe18a8a60b1ccab9ffe20f965c54f4e948a FNAL.GOV. 3600 IN DS 42708 7 1 c5dd8356d2b72daf53fb6a495ad3e1514e998a64 FNAL.GOV. 3600 IN DS ( 42708 7 2 815dba109bac952d72dce5c6eb23dca533fecce10f9b3c6769790c899176384a ) FNAL.GOV. 3600 IN DS ( 51525 7 2 aedde3335dc4e0b3e082cf5a2cccdbc46c4890aaee786d726ab3ac3b22437358 ) FNAL.GOV. 3600 IN RRSIG ( DS 8 2 3600 20200711221007 20200704221007 40176 gov. ObQUBDO7IZQxAr1/pqdYQjDIxfo6lW+aP5nNBVjg29gn4+KsgE92Rfvqb1Vd1PAznlQHaAIWs+ev e3z+ujRclKO0GBCRRHN3TV6vopCqzjcwbfN+E5GAWsdcl62tCinhH9Chy4t1CzrTVtMjdggnkEjS s9St8gINP0Q28KnTcRA8905R6+YmDhdaysc991ffgrfeJWWgcUEXGeb2Ax49Aw== ) ;; ADDITIONAL SECTION (5 records) ns1.FNAL.GOV. 86400 IN A 198.49.208.71 ns1.FNAL.GOV. 86400 IN AAAA 2620:6a:0:1203::208:71 ns2.FNAL.GOV. 86400 IN A 198.49.208.70 ns2.FNAL.GOV. 86400 IN AAAA 2620:6a:0:1203::208:70 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone FNAL.GOV

FNAL.GOV

	Checking DS between GOV and FNAL.GOV
	Query to c.gov-servers.net for FNAL.GOV/DS
	Received 400 bytes from 69.36.153.30
	;; Answer received from 69.36.153.30 (400 bytes) ;; HEADER SECTION ;; id = 5854 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 5 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN DS ;; ANSWER SECTION (5 records) FNAL.GOV. 3600 IN DS 51525 7 1 e037ffe18a8a60b1ccab9ffe20f965c54f4e948a FNAL.GOV. 3600 IN DS 42708 7 1 c5dd8356d2b72daf53fb6a495ad3e1514e998a64 FNAL.GOV. 3600 IN DS ( 42708 7 2 815dba109bac952d72dce5c6eb23dca533fecce10f9b3c6769790c899176384a ) FNAL.GOV. 3600 IN DS ( 51525 7 2 aedde3335dc4e0b3e082cf5a2cccdbc46c4890aaee786d726ab3ac3b22437358 ) FNAL.GOV. 3600 IN RRSIG ( DS 8 2 3600 20200711221007 20200704221007 40176 gov. ObQUBDO7IZQxAr1/pqdYQjDIxfo6lW+aP5nNBVjg29gn4+KsgE92Rfvqb1Vd1PAznlQHaAIWs+ev e3z+ujRclKO0GBCRRHN3TV6vopCqzjcwbfN+E5GAWsdcl62tCinhH9Chy4t1CzrTVtMjdggnkEjS s9St8gINP0Q28KnTcRA8905R6+YmDhdaysc991ffgrfeJWWgcUEXGeb2Ax49Aw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 4 DS records for FNAL.GOV in the GOV zone
	DS=51525/SHA-1 has algorithm RSASHA1-NSEC3-SHA1
	DS=42708/SHA-1 has algorithm RSASHA1-NSEC3-SHA1
	DS=42708/SHA-256 has algorithm RSASHA1-NSEC3-SHA1
	DS=51525/SHA-256 has algorithm RSASHA1-NSEC3-SHA1
	Found 1 RRSIGs over DS RRset
	`FNAL.GOV. 3600 IN RRSIG ( DS 8 2 3600 20200711221007 20200704221007 40176 gov. ObQUBDO7IZQxAr1/pqdYQjDIxfo6lW+aP5nNBVjg29gn4+KsgE92Rfvqb1Vd1PAznlQHaAIWs+ev e3z+ujRclKO0GBCRRHN3TV6vopCqzjcwbfN+E5GAWsdcl62tCinhH9Chy4t1CzrTVtMjdggnkEjS s9St8gINP0Q28KnTcRA8905R6+YmDhdaysc991ffgrfeJWWgcUEXGeb2Ax49Aw== )`
	RRSIG=40176 and DNSKEY=40176 verifies the DS RRset
	DS=51525/SHA-1 is now in the chain-of-trust
	DS=42708/SHA-1 is now in the chain-of-trust
	`FNAL.GOV. 3600 IN DS 51525 7 1 e037ffe18a8a60b1ccab9ffe20f965c54f4e948a`
	`FNAL.GOV. 3600 IN DS 42708 7 1 c5dd8356d2b72daf53fb6a495ad3e1514e998a64`
	`FNAL.GOV. 3600 IN DS ( 42708 7 2 815dba109bac952d72dce5c6eb23dca533fecce10f9b3c6769790c899176384a )`
	`FNAL.GOV. 3600 IN DS ( 51525 7 2 aedde3335dc4e0b3e082cf5a2cccdbc46c4890aaee786d726ab3ac3b22437358 )`
	Query to ns1.FNAL.GOV for FNAL.GOV/DNSKEY
	Received 1813 bytes from 198.49.208.71
	;; Answer received from 198.49.208.71 (1813 bytes) ;; HEADER SECTION ;; id = 2741 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 8 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN DNSKEY ;; ANSWER SECTION (8 records) FNAL.GOV. 172800 IN DNSKEY ( 256 3 7 AwEAAZLmH8rL8XlTXixK9mHfSZg81L9dxW17ajgSLl/wzYG4b5CPxEqUd2wRqWcDxMzI7luGZa62 xOp0miRjfyoNI6iMZadOqOPVfhxg3VzI1us/paP6LHBfwk18iT65BNTSWEBiYI3EIVxVVP7svekO ZUhTxylxW+1bXiGmbUQzMf2n ) ; Key ID = 59834 FNAL.GOV. 172800 IN DNSKEY ( 257 3 7 AwEAAbvzrD9SU2Ob7h7uKuObbjjHhApWEqbd1p6Aj5EIhK94JZ1h+tkJtRXl4Rn8YPrulv1msj4W 6gKdlf5a+IjGbGcmfw1RMjaqg7t070/7BNEF/DIUIefq8NZ0CR/DYvtwtIAjFe7ysgAh0Ns56HZS VD41l6b0tIIyqbTugjZ3zHVnjvOs/wytDSV4M0Vx5zbA55UkTSpPVl0SF/KRVC4Ek1hAxvGK8B9B ZLw6v10xhw4twCkr3ZFaPoU7iLhSnQpAF9h5x1YtnsmJJMH7ViM4/AHDiG0ax2kK4p+6048oBKib tIkwbvgbtDUm3Uhg4l0S+eUgWKM3aNIkDqytOE0G1r0= ) ; Key ID = 51525 FNAL.GOV. 172800 IN DNSKEY ( 256 3 7 AwEAAa32fD8Ukp4Prpvxzk/tSAhPjtBqapgpq+KHb0tuGy2Rfw0I8OLaQtqGnu1JHfEVS1HplzGk En2cAAQ7MKzVM0XkUD4KyxpoBiB2lFIjuXPweL2DJ8aa0sGUhZNd52dC4WPFgr7dSmXshmTukjHr JlFa8ZaPe6aMy/SJKKSuF0qB ) ; Key ID = 51443 FNAL.GOV. 172800 IN DNSKEY ( 257 3 7 AwEAAee52NP5xmXDXQEGqOUj4IXOGiJjZ/PeaGDy02qIY0Dgp49yrcX6TBh5wUpkGPp8m9ztadLh ye1cLyx3AfAyJxcXPeaw9p8BtzDer2ienBRHkdQaJW02bdIifhTHeIveNTW05znxh3Jwa2lD8lx9 TwnEo7RSQA0hyPN4+55WJCMsN2eoi0jT2A5O61d9B36jav9jby0qCb1wdO7BGXtzGtWCumYGz29k 7B3CiuOeEXJVDAT/fIw0mHaVO5IW8UbiATVQRw6cAaikzdT0zP7ABFSwau2zJDvv8I91yEc98Aoc m0XfOFRBi+XOyjt49i2XciBPTCWPwsw0OIPXLXgree8= ) ; Key ID = 42708 FNAL.GOV. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200708083719 20200704073841 42708 fnal.gov. mjxSISihwYnIyBcPNUoPadxGG7tC5GX9wDaKf0Mtk51Tzddhb5kDN0pYVx1pt5UZ5Nn9N10Dhrxw 4HqboDDQIsH4q+6u2F45+ZRMBrDI8sYvOqeiKsk6vBackVseidm3eA7Gpvd+bU06aW+9AMzBPYlq AAH96DOZRV/02mGe1XKAhd4us5ZXHPwNBXx0REmUUtW+N4NuJh47Ta9+wvUXcAcvp3zefaaitVrn 8a2/jfKQ3h36jgW1nCAzD9FNljZdnE0Whc343Y9sYC+atjD6/7N18iFSeOXYLBvXrOg6XePqblzi 4t8gyexlZ2oA858qz73kak1ZHHfAIAtqvfq4VA== ) fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200708083719 20200704073841 51443 fnal.gov. RkUe7TPOJrPttTp84KyVb8/DPUHQ5I1FM6GPZV46RaCQTMZxum+Xh5bxkux4zV0PPZFKaZSFqlM8 WPDpYc6yvJCaFs8cMx3ID+l2KwG4784QXZdRHPoqEi09OTxXq9QA7Z/j+gT5CpnOYTObCvzOiVyt twV6NB9KDl/Xa02W4qg= ) fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200708083719 20200704073841 51525 fnal.gov. gWP5WjG79meGDIQyoH14WqcXaYnzKjSsH3HJwAx0pgsDgHnA31O57f1Kl5i8hieI8cyPdIsAVI/s SSeoXA3eaTaenSqtJVHV59gf6bfsA+fCpj+LsVHs9nUdRoWFOj96QxGn+aq7IKVhuBf3XLgDo+tQ c08TdCX98ChVhs2EE9Rpprh4UxYi5LXiT8laZG4rl2Nba+DdKB7iv22FsFsz2PF9CwoXxEXe1jH0 YUU0nDrc7dNnu+m6f0qsq3IblBSYZT/Ag/7ZGAPrXoFzmxIDQQAXqQdVAbCJSPPnPn6pFbvf5xvx re/QwBeiCDn8IvmwvIauTsKU5vcH2a6k4+JeCA== ) fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200708083719 20200704073841 59834 fnal.gov. V5rb69SeLwf0ORz7BKg73Uhz68UWfmTpF1BXmucZg9fG2NZolaw4jzLkUkverz8HeFj7xjl+amMJ L0+ZVcNY3+9j5cAxC2hdVAgcbvIOP7fOsxJ2GWNwqoalxxgZkxiV/hIqKIBRgFiZqMIM853JoIXh GTACpb63zHqcrgpIi6s= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 4 DNSKEY records for FNAL.GOV
	`FNAL.GOV. 172800 IN DNSKEY ( 256 3 7 AwEAAZLmH8rL8XlTXixK9mHfSZg81L9dxW17ajgSLl/wzYG4b5CPxEqUd2wRqWcDxMzI7luGZa62 xOp0miRjfyoNI6iMZadOqOPVfhxg3VzI1us/paP6LHBfwk18iT65BNTSWEBiYI3EIVxVVP7svekO ZUhTxylxW+1bXiGmbUQzMf2n ) ; Key ID = 59834`
	`FNAL.GOV. 172800 IN DNSKEY ( 257 3 7 AwEAAbvzrD9SU2Ob7h7uKuObbjjHhApWEqbd1p6Aj5EIhK94JZ1h+tkJtRXl4Rn8YPrulv1msj4W 6gKdlf5a+IjGbGcmfw1RMjaqg7t070/7BNEF/DIUIefq8NZ0CR/DYvtwtIAjFe7ysgAh0Ns56HZS VD41l6b0tIIyqbTugjZ3zHVnjvOs/wytDSV4M0Vx5zbA55UkTSpPVl0SF/KRVC4Ek1hAxvGK8B9B ZLw6v10xhw4twCkr3ZFaPoU7iLhSnQpAF9h5x1YtnsmJJMH7ViM4/AHDiG0ax2kK4p+6048oBKib tIkwbvgbtDUm3Uhg4l0S+eUgWKM3aNIkDqytOE0G1r0= ) ; Key ID = 51525`
	`FNAL.GOV. 172800 IN DNSKEY ( 256 3 7 AwEAAa32fD8Ukp4Prpvxzk/tSAhPjtBqapgpq+KHb0tuGy2Rfw0I8OLaQtqGnu1JHfEVS1HplzGk En2cAAQ7MKzVM0XkUD4KyxpoBiB2lFIjuXPweL2DJ8aa0sGUhZNd52dC4WPFgr7dSmXshmTukjHr JlFa8ZaPe6aMy/SJKKSuF0qB ) ; Key ID = 51443`
	`FNAL.GOV. 172800 IN DNSKEY ( 257 3 7 AwEAAee52NP5xmXDXQEGqOUj4IXOGiJjZ/PeaGDy02qIY0Dgp49yrcX6TBh5wUpkGPp8m9ztadLh ye1cLyx3AfAyJxcXPeaw9p8BtzDer2ienBRHkdQaJW02bdIifhTHeIveNTW05znxh3Jwa2lD8lx9 TwnEo7RSQA0hyPN4+55WJCMsN2eoi0jT2A5O61d9B36jav9jby0qCb1wdO7BGXtzGtWCumYGz29k 7B3CiuOeEXJVDAT/fIw0mHaVO5IW8UbiATVQRw6cAaikzdT0zP7ABFSwau2zJDvv8I91yEc98Aoc m0XfOFRBi+XOyjt49i2XciBPTCWPwsw0OIPXLXgree8= ) ; Key ID = 42708`
	DNSKEY=51525/SEP is now in the chain-of-trust
	DS=51525/SHA-1 verifies DNSKEY=51525/SEP
	DS=51525/SHA-256 verifies DNSKEY=51525/SEP
	DNSKEY=42708/SEP is now in the chain-of-trust
	DS=42708/SHA-1 verifies DNSKEY=42708/SEP
	DS=42708/SHA-256 verifies DNSKEY=42708/SEP
	Found 4 RRSIGs over DNSKEY RRset
	`FNAL.GOV. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200708083719 20200704073841 42708 fnal.gov. mjxSISihwYnIyBcPNUoPadxGG7tC5GX9wDaKf0Mtk51Tzddhb5kDN0pYVx1pt5UZ5Nn9N10Dhrxw 4HqboDDQIsH4q+6u2F45+ZRMBrDI8sYvOqeiKsk6vBackVseidm3eA7Gpvd+bU06aW+9AMzBPYlq AAH96DOZRV/02mGe1XKAhd4us5ZXHPwNBXx0REmUUtW+N4NuJh47Ta9+wvUXcAcvp3zefaaitVrn 8a2/jfKQ3h36jgW1nCAzD9FNljZdnE0Whc343Y9sYC+atjD6/7N18iFSeOXYLBvXrOg6XePqblzi 4t8gyexlZ2oA858qz73kak1ZHHfAIAtqvfq4VA== )`
	`fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200708083719 20200704073841 51443 fnal.gov. RkUe7TPOJrPttTp84KyVb8/DPUHQ5I1FM6GPZV46RaCQTMZxum+Xh5bxkux4zV0PPZFKaZSFqlM8 WPDpYc6yvJCaFs8cMx3ID+l2KwG4784QXZdRHPoqEi09OTxXq9QA7Z/j+gT5CpnOYTObCvzOiVyt twV6NB9KDl/Xa02W4qg= )`
	`fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200708083719 20200704073841 51525 fnal.gov. gWP5WjG79meGDIQyoH14WqcXaYnzKjSsH3HJwAx0pgsDgHnA31O57f1Kl5i8hieI8cyPdIsAVI/s SSeoXA3eaTaenSqtJVHV59gf6bfsA+fCpj+LsVHs9nUdRoWFOj96QxGn+aq7IKVhuBf3XLgDo+tQ c08TdCX98ChVhs2EE9Rpprh4UxYi5LXiT8laZG4rl2Nba+DdKB7iv22FsFsz2PF9CwoXxEXe1jH0 YUU0nDrc7dNnu+m6f0qsq3IblBSYZT/Ag/7ZGAPrXoFzmxIDQQAXqQdVAbCJSPPnPn6pFbvf5xvx re/QwBeiCDn8IvmwvIauTsKU5vcH2a6k4+JeCA== )`
	`fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200708083719 20200704073841 59834 fnal.gov. V5rb69SeLwf0ORz7BKg73Uhz68UWfmTpF1BXmucZg9fG2NZolaw4jzLkUkverz8HeFj7xjl+amMJ L0+ZVcNY3+9j5cAxC2hdVAgcbvIOP7fOsxJ2GWNwqoalxxgZkxiV/hIqKIBRgFiZqMIM853JoIXh GTACpb63zHqcrgpIi6s= )`
	RRSIG=42708 and DNSKEY=42708/SEP verifies the DNSKEY RRset
	RRSIG=51443 and DNSKEY=51443 verifies the DNSKEY RRset
	RRSIG=51525 and DNSKEY=51525/SEP verifies the DNSKEY RRset
	RRSIG=59834 and DNSKEY=59834 verifies the DNSKEY RRset
	DNSKEY=59834 is now in the chain-of-trust
	DNSKEY=51443 is now in the chain-of-trust
	Query to ns1.FNAL.GOV for FNAL.GOV/A
	Received 389 bytes from 198.49.208.71
	;; Answer received from 198.49.208.71 (389 bytes) ;; HEADER SECTION ;; id = 597 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN A ;; ANSWER SECTION (3 records) FNAL.GOV. 21600 IN A 131.225.105.239 FNAL.GOV. 21600 IN RRSIG ( A 7 2 21600 20200708202312 20200704201533 51443 fnal.gov. LAySQJNYf/AgzcGjqVhMerlhzLRkKSowSMmQF8/+fV5Ouvq5uPc02PHznaJK7u8ssDqF8rBfiDo6 qGZlj1aEmcTStBf4HR9Pr+kvEct2kDLq9RZMuhKT8N5PvL6Sxfg8oIy1pPFmH5Zp+FndJQYaNLwO 2BOvn1mWhqvHrAd7dTc= ) fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20200708202312 20200704201533 59834 fnal.gov. AiZn6tkaDZVL+LpWpWKUxswacf7RRMFR31Y1MK4rTI1peH34041/HRiEr6HRy9kaiRpBR7R8LjH1 ZMnf27MDFtYVNlct1nO2BUxJoWp9q1fWNaak0rte1DWQpGb8Tje7PjW2qgJjUBTb1s87zGfW38Hj xZY9ROQyRcb9cO3mzwg= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	FNAL.GOV is authoritative for FNAL.GOV
	Found RRSIG signed by fnal.gov zone
	Query to adns1.es.net for FNAL.GOV/SOA
	Received 432 bytes from 192.188.22.22
	;; Answer received from 192.188.22.22 (432 bytes) ;; HEADER SECTION ;; id = 8387 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN SOA ;; ANSWER SECTION (3 records) fnal.gov. 21600 IN SOA ( ns1.fnal.gov. netmanager.fnal.gov. 2023232049 ;serial 7200 ;refresh 120 ;retry 1209600 ;expire 900 ;minimum ) fnal.gov. 21600 IN RRSIG ( SOA 7 2 21600 20200708231312 20200704221312 51443 fnal.gov. cl1c/+4tuEwYUesHoAuXcqaenadwHQns4tEzlcsw5XHBhZW1i9O59QbHd5kRAA3YcS9+0AysWi4Y L4N7i1iTWskA16QkJEY6P0P5PcmS2ENDOig5X7/UqTL6bROxT477dGnsGKKsxeHNJ40U1pyswR6z tiVzINjScbXEXnt9gro= ) fnal.gov. 21600 IN RRSIG ( SOA 7 2 21600 20200708231312 20200704221312 59834 fnal.gov. QV0nx9ufa2hGEqV14Wt6GCr93KRD34p+NMtfbsRxnjjdqofsuWlazVyxmdRsNwS4ERadjAiz8kHS 08JMJ/ekc/BAvo/SoD52ElovzcuDabViFvYDK21nbA/MioNfqprcE0gPsypgnbC6mXBiF/xe4xlv vPPPcxmNrmpnF218n1M= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to ns1.FNAL.GOV for FNAL.GOV/SOA
	Received 424 bytes from 198.49.208.71
	;; Answer received from 198.49.208.71 (424 bytes) ;; HEADER SECTION ;; id = 55578 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN SOA ;; ANSWER SECTION (3 records) FNAL.GOV. 21600 IN SOA ( ns1.FNAL.GOV. netmanager.FNAL.GOV. 2023232050 ;serial 7200 ;refresh 120 ;retry 1209600 ;expire 900 ;minimum ) FNAL.GOV. 21600 IN RRSIG ( SOA 7 2 21600 20200708231317 20200704221317 51443 fnal.gov. Qm7/oixC0msIwADR7ibnq2LJdXp7nU+IFryf34eZU+gRX1zHn+vq7Cxj40eF72Y9rcaDTBF8XvgB DoKVkBSU2yrlKDLis/Qf0+uKU94n2+FPmlJmKmTwAPlFeE7lKtNntdRPcTJN6SEa2PCpxY+Qxrs6 d0FPsJqz83l8dX9++I8= ) fnal.gov. 21600 IN RRSIG ( SOA 7 2 21600 20200708231317 20200704221317 59834 fnal.gov. UWqSjVCW35Bpm2bJ03d76hthnJk/9dy4Ghg/2QlZpFMMHvzYUqMl/La4VZ9/PX4AMWld+/VF+nCA 6ryzdae8N/aI0iHdoJYkHpGWZElNcYmWWn9sN9W/yF44YG6Quwq8px9jN18zRpO0FNJycL3gewu3 yA9lbWMCq1G3qjnbRT8= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	ns1.FNAL.GOV serial (2023232050) differs from adns1.es.net serial (2023232049)
	Query to adns2.es.net for FNAL.GOV/SOA
	Received 2278 bytes from 192.188.22.52
	;; Answer received from 192.188.22.52 (2278 bytes) ;; HEADER SECTION ;; id = 57246 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 6 arcount = 13 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN SOA ;; ANSWER SECTION (3 records) fnal.gov. 21600 IN SOA ( ns1.fnal.gov. netmanager.fnal.gov. 2023232049 ;serial 7200 ;refresh 120 ;retry 1209600 ;expire 900 ;minimum ) fnal.gov. 21600 IN RRSIG ( SOA 7 2 21600 20200708231312 20200704221312 51443 fnal.gov. cl1c/+4tuEwYUesHoAuXcqaenadwHQns4tEzlcsw5XHBhZW1i9O59QbHd5kRAA3YcS9+0AysWi4Y L4N7i1iTWskA16QkJEY6P0P5PcmS2ENDOig5X7/UqTL6bROxT477dGnsGKKsxeHNJ40U1pyswR6z tiVzINjScbXEXnt9gro= ) fnal.gov. 21600 IN RRSIG ( SOA 7 2 21600 20200708231312 20200704221312 59834 fnal.gov. QV0nx9ufa2hGEqV14Wt6GCr93KRD34p+NMtfbsRxnjjdqofsuWlazVyxmdRsNwS4ERadjAiz8kHS 08JMJ/ekc/BAvo/SoD52ElovzcuDabViFvYDK21nbA/MioNfqprcE0gPsypgnbC6mXBiF/xe4xlv vPPPcxmNrmpnF218n1M= ) ;; AUTHORITY SECTION (6 records) fnal.gov. 21600 IN NS adns2.es.net. fnal.gov. 21600 IN NS ns2.fnal.gov. fnal.gov. 21600 IN NS ns1.fnal.gov. fnal.gov. 21600 IN NS adns1.es.net. fnal.gov. 21600 IN RRSIG ( NS 7 2 21600 20200708222631 20200704212944 51443 fnal.gov. h16vmfpzpSD+DgUlygPf9JsRRlmlLJWTBKTvF02uN2z+LIAYqHAMuDPOQZPRKferw1YDkXYZFo+l WAQ4EC2MFLRL4yMMbLaJ7ekHEADNG5jXLqhbNqtCvg2JB+KUYSaasayh/UErphz8CH3dICAJE/WO QqSQYcyYim/qcrneIcg= ) fnal.gov. 21600 IN RRSIG ( NS 7 2 21600 20200708222631 20200704212944 59834 fnal.gov. ffT4gNFO9bRGJ3kqOVj7eXFnygn+bECZoFyAGzv+j4NGc3JnNkP4ilVPlDxC+G0APnw2mIIrNJUS l52AtuCz1WL/Ed60bkwndxwJlRXh8bV1ZPMmCPJhdP3u+Azt6gKe6inazkAFY7uA70pz2BW2HDwc OcFtV+CK5zT5ChUwPh4= ) ;; ADDITIONAL SECTION (13 records) ns1.fnal.gov. 21600 IN A 198.49.208.71 ns2.fnal.gov. 21600 IN A 198.49.208.70 ns1.fnal.gov. 21600 IN AAAA 2620:6a:0:1203::208:71 ns2.fnal.gov. 21600 IN AAAA 2620:6a:0:1203::208:70 ns1.fnal.gov. 21600 IN RRSIG ( A 7 3 21600 20200708211048 20200704210007 51443 fnal.gov. k6Bo9Zb6TU+sbxy3oZT9TqG6ah0Bj+mPp4SxwsDipJr5oHNz2OLzPkJZrjlNjAy4fkQP6w9K/BMs QyjsrDNmBeE2n9t+T9ShEJdT9b1zADQRy2aT8IIT6Yw5ApdmCNNHfg1BnlNf5Mk9nhRnopXXOZTG wb+uYxs2hkb47Zfx0D4= ) ns1.fnal.gov. 21600 IN RRSIG ( A 7 3 21600 20200708211048 20200704210007 59834 fnal.gov. JMztsOol28jLYPDt8cvPH/txH/f6ynK17sWUZYGpffnx9icXAwnbvDoli1uL2MP0qB3Xzbb/Gs22 EfiE06ob2J9GboMCCL6Hgl/ta7UCCwOIpbjk5/wZKfJCyun0dgOduUt/7V086Yy2dLNI7T/mZkWA gpoFaprdr28mvYkvoz4= ) ns1.fnal.gov. 21600 IN RRSIG ( AAAA 7 3 21600 20200708185652 20200704183831 51443 fnal.gov. KGpV9fXK8mLbkLFULLqptELp1cuQn4hhd9b9Of/vzjv7NNV0EuJmvVuJIsW0JipAkrBrXbGEumkX txEPNaNt13jS+QZFblQdwFo89tjHnU5e1MmvcAiRACgW1nYvKjlvlo3zoXuQvZGmvdoAQB7Z/+D+ 7tY4JXIyxmJoWthZovI= ) ns1.fnal.gov. 21600 IN RRSIG ( AAAA 7 3 21600 20200708185652 20200704183831 59834 fnal.gov. W1rgTCbkmrmkbaAh5JzKtYWTqXMcYoGRLjX8NJZvW5V5Z5+k0MoeZkbJytgiC2YqlDZruCiw3cWL fnZ5rHPnheWocdWPkmdlwJ/3kkgw2Ebc9VmlaiABJSF80xblheOPWUxbKBRdYlmn/LZJE305w5eb fZhYH1wR16jQZOBX4h0= ) ns2.fnal.gov. 21600 IN RRSIG ( A 7 3 21600 20200708201531 20200704193342 51443 fnal.gov. YDtlYUGscoIlnznkndshVylzMpAMhOa2n98DwO9ydkH92HL+TZ0CvF8AigoHHKi9QBydLLfMSTkk Xo8T9lHEomd8srCCcCBkLTPSDZrOZb2NsnssdljKnwenDCQUNejw/7qGjiBEXQZ4Qx69G7WYjU7D O3CI2MI6RK7WF/GB9qs= ) ns2.fnal.gov. 21600 IN RRSIG ( A 7 3 21600 20200708201531 20200704193342 59834 fnal.gov. CwG/WpaUh0Q2pzU8xvlAOt+z7wza3ntzhVJef0W8HwIzasJF3rvRQbUCnl9PwJM9f+ume8Y/c50F S6ecgpzpN40HAHikaJyzHoffgH0TPZSYwQZZBqnyBNY5BbzjNGbh/JuRmmGlppxU1ikn82rNeGfB 7rXyvfwC5SpVdJQ76mg= ) ns2.fnal.gov. 21600 IN RRSIG ( AAAA 7 3 21600 20200708194506 20200704184519 51443 fnal.gov. h/+j4D/dDrO8Up9ppC+cJxDcMXlgr7sUmarT0mpK9BSJt4U5roNBQqVRo8QAscibRl2WyvD1ASu5 VinLRS/jvRFdJokpITkTsAL9gexSzjM1BMHsESbEivFI4/mohsylhJX/0CfNiN7OL3NoFsqDpUxR IZBfVQmQBcvxVWMvWRQ= ) ns2.fnal.gov. 21600 IN RRSIG ( AAAA 7 3 21600 20200708194506 20200704184519 59834 fnal.gov. R/wuadxOhDl4p3CWPPRPqk0llDTsa2Sj1HASIuxFdRQLAUFymrZHhWwq0NvRafQtpq8A59YX0qH3 HI76jO6vG/l1ABxjUY3/MSqDtU4CatQ98yWsxedkJooiwAPUL6jQPOLtFcTJ4wUf3AlxH/i9mZ1g M67snY6za0W1qIpg4LU= ) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to ns2.FNAL.GOV for FNAL.GOV/SOA
	Received 424 bytes from 198.49.208.70
	;; Answer received from 198.49.208.70 (424 bytes) ;; HEADER SECTION ;; id = 20741 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN SOA ;; ANSWER SECTION (3 records) FNAL.GOV. 21600 IN SOA ( ns1.FNAL.GOV. netmanager.FNAL.GOV. 2023232050 ;serial 7200 ;refresh 120 ;retry 1209600 ;expire 900 ;minimum ) FNAL.GOV. 21600 IN RRSIG ( SOA 7 2 21600 20200708231317 20200704221317 51443 fnal.gov. Qm7/oixC0msIwADR7ibnq2LJdXp7nU+IFryf34eZU+gRX1zHn+vq7Cxj40eF72Y9rcaDTBF8XvgB DoKVkBSU2yrlKDLis/Qf0+uKU94n2+FPmlJmKmTwAPlFeE7lKtNntdRPcTJN6SEa2PCpxY+Qxrs6 d0FPsJqz83l8dX9++I8= ) fnal.gov. 21600 IN RRSIG ( SOA 7 2 21600 20200708231317 20200704221317 59834 fnal.gov. UWqSjVCW35Bpm2bJ03d76hthnJk/9dy4Ghg/2QlZpFMMHvzYUqMl/La4VZ9/PX4AMWld+/VF+nCA 6ryzdae8N/aI0iHdoJYkHpGWZElNcYmWWn9sN9W/yF44YG6Quwq8px9jN18zRpO0FNJycL3gewu3 yA9lbWMCq1G3qjnbRT8= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	ns2.FNAL.GOV serial (2023232050) differs from adns1.es.net serial (2023232049)
	Query to ns1.FNAL.GOV for FNAL.GOV/A
	Received 389 bytes from 198.49.208.71
	;; Answer received from 198.49.208.71 (389 bytes) ;; HEADER SECTION ;; id = 45114 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN A ;; ANSWER SECTION (3 records) FNAL.GOV. 21600 IN A 131.225.105.239 FNAL.GOV. 21600 IN RRSIG ( A 7 2 21600 20200708202312 20200704201533 51443 fnal.gov. LAySQJNYf/AgzcGjqVhMerlhzLRkKSowSMmQF8/+fV5Ouvq5uPc02PHznaJK7u8ssDqF8rBfiDo6 qGZlj1aEmcTStBf4HR9Pr+kvEct2kDLq9RZMuhKT8N5PvL6Sxfg8oIy1pPFmH5Zp+FndJQYaNLwO 2BOvn1mWhqvHrAd7dTc= ) fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20200708202312 20200704201533 59834 fnal.gov. AiZn6tkaDZVL+LpWpWKUxswacf7RRMFR31Y1MK4rTI1peH34041/HRiEr6HRy9kaiRpBR7R8LjH1 ZMnf27MDFtYVNlct1nO2BUxJoWp9q1fWNaak0rte1DWQpGb8Tje7PjW2qgJjUBTb1s87zGfW38Hj xZY9ROQyRcb9cO3mzwg= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	FNAL.GOV A RR has value 131.225.105.239
	Found 2 RRSIGs over A RRset
	`FNAL.GOV. 21600 IN RRSIG ( A 7 2 21600 20200708202312 20200704201533 51443 fnal.gov. LAySQJNYf/AgzcGjqVhMerlhzLRkKSowSMmQF8/+fV5Ouvq5uPc02PHznaJK7u8ssDqF8rBfiDo6 qGZlj1aEmcTStBf4HR9Pr+kvEct2kDLq9RZMuhKT8N5PvL6Sxfg8oIy1pPFmH5Zp+FndJQYaNLwO 2BOvn1mWhqvHrAd7dTc= )`
	`fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20200708202312 20200704201533 59834 fnal.gov. AiZn6tkaDZVL+LpWpWKUxswacf7RRMFR31Y1MK4rTI1peH34041/HRiEr6HRy9kaiRpBR7R8LjH1 ZMnf27MDFtYVNlct1nO2BUxJoWp9q1fWNaak0rte1DWQpGb8Tje7PjW2qgJjUBTb1s87zGfW38Hj xZY9ROQyRcb9cO3mzwg= )`
	RRSIG=51443 and DNSKEY=51443 verifies the A RRset
	RRSIG=59834 and DNSKEY=59834 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test FNAL.GOV at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: