DNSSEC Analyzer - FNAL.GOV

Domain Name:

Time: 2020-09-26 19:15:46 UTC, NTP stratum 4

Analyzing DNSSEC problems for FNAL.GOV

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to b.root-servers.net for ./DNSKEY
	Received 1139 bytes from 199.9.14.201
	;; Answer received from 199.9.14.201 (1139 bytes) ;; HEADER SECTION ;; id = 24092 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN DNSKEY ( 256 3 8 AwEAAdauOGxLhfAKFTTZwGhBXbk793QKdWIQRjiSftWdusCwkPhNyJrIjwtNffCWXGLlZAbpcs41 4RE3oS1qVwV+AdXsO92SBu5haGlxMUk0NqZO7Xlf84/wrzGZVRRouPo5pNX/CKS8Mv9UOi0olKGC u31dNfh8qCszWZcloLDgeLzSnQSkvFoGe69vNCfh7feESKedkBC2qRz0BZv9+oJI0IY/3D7WEnV0 NOlf8gSHozhfJFJ/ZAKtvw/Q3ogrVJFk0LyVaU/NVtVA5FM4pVMIRID7pfrPi78aAzG7b/Wh/Pce 4jPAIpS3dApq25YkvMuPvfB91NMf9FemKwlp78PBVcM= ) ; Key ID = 46594 . 172800 IN DNSKEY ( 256 3 8 AwEAAfC/6HLClwss6h7rPfoG2cliv4/SPJRd2HPEglRsvKZRbPP2RLfiobeAkczcdqaD5q8loEt1 4lcTgDqwzOISZ3YvSVkM4JRMFwKzcjukKo5CsDVbMmhTD0C0yxWICRQ1M+Y5/XkZAT7mt4cb3fWc N9xgyq1wEXQX+zdLQHrNEVQSiL5SoA5cOtCSoQ45n8bKDXdw/0jjP9Rw1FVKsdzLVkQSrVMm8k30 WUkHm/SK/n/954KENkdQOA6Li2vO9nicQdegyAkDeNJCdPN/p3jEhCTQLyO4AlAmyaPcDHeeo7OX r/VsYu4NTDde9hBuS0zx/rewD+BvSnmnNHNmH2FjUE8= ) ; Key ID = 26116 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20201010000000 20200919000000 20326 . gNV6AU+66kB5XldvckVd/ldhaWTu0rO589zdyHDODOwQ1murJshvt8cjBw3G3G4xO06I1gCKT2HW IJLEEhhvQSRvowbcIW3EocWtTZjeQvCp4U1449doRAiUblpQi7EIstdOxIzcttvh0VcIRecWV7Fl 3kvBzEhpwX42EKXaWUV58Rrn/43o/bRSgh3XBSDwIuIsZVJiMMvHdgm0a5FM6jNHxuuXT1DLlXgL Qyggm/PFciUKTXAo91f6HiyWGNZY9AfAAlvprPiyFOCjBotvk7F5Bi5ss1p8mxl522t/8UuSKcFz qE1J3U4IisgEjTkyxnbCJqY/vKJcyPU8fCzxEg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAdauOGxLhfAKFTTZwGhBXbk793QKdWIQRjiSftWdusCwkPhNyJrIjwtNffCWXGLlZAbpcs41 4RE3oS1qVwV+AdXsO92SBu5haGlxMUk0NqZO7Xlf84/wrzGZVRRouPo5pNX/CKS8Mv9UOi0olKGC u31dNfh8qCszWZcloLDgeLzSnQSkvFoGe69vNCfh7feESKedkBC2qRz0BZv9+oJI0IY/3D7WEnV0 NOlf8gSHozhfJFJ/ZAKtvw/Q3ogrVJFk0LyVaU/NVtVA5FM4pVMIRID7pfrPi78aAzG7b/Wh/Pce 4jPAIpS3dApq25YkvMuPvfB91NMf9FemKwlp78PBVcM= ) ; Key ID = 46594`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAfC/6HLClwss6h7rPfoG2cliv4/SPJRd2HPEglRsvKZRbPP2RLfiobeAkczcdqaD5q8loEt1 4lcTgDqwzOISZ3YvSVkM4JRMFwKzcjukKo5CsDVbMmhTD0C0yxWICRQ1M+Y5/XkZAT7mt4cb3fWc N9xgyq1wEXQX+zdLQHrNEVQSiL5SoA5cOtCSoQ45n8bKDXdw/0jjP9Rw1FVKsdzLVkQSrVMm8k30 WUkHm/SK/n/954KENkdQOA6Li2vO9nicQdegyAkDeNJCdPN/p3jEhCTQLyO4AlAmyaPcDHeeo7OX r/VsYu4NTDde9hBuS0zx/rewD+BvSnmnNHNmH2FjUE8= ) ; Key ID = 26116`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20201010000000 20200919000000 20326 . gNV6AU+66kB5XldvckVd/ldhaWTu0rO589zdyHDODOwQ1murJshvt8cjBw3G3G4xO06I1gCKT2HW IJLEEhhvQSRvowbcIW3EocWtTZjeQvCp4U1449doRAiUblpQi7EIstdOxIzcttvh0VcIRecWV7Fl 3kvBzEhpwX42EKXaWUV58Rrn/43o/bRSgh3XBSDwIuIsZVJiMMvHdgm0a5FM6jNHxuuXT1DLlXgL Qyggm/PFciUKTXAo91f6HiyWGNZY9AfAAlvprPiyFOCjBotvk7F5Bi5ss1p8mxl522t/8UuSKcFz qE1J3U4IisgEjTkyxnbCJqY/vKJcyPU8fCzxEg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=46594 is now in the chain-of-trust
	DNSKEY=26116 is now in the chain-of-trust
	Query to e.root-servers.net for FNAL.GOV/A
	Received 663 bytes from 192.203.230.10
	;; Answer received from 192.203.230.10 (663 bytes) ;; HEADER SECTION ;; id = 19998 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 7 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) GOV. 172800 IN NS a.gov-servers.net. GOV. 172800 IN NS b.gov-servers.net. GOV. 172800 IN NS c.gov-servers.net. GOV. 172800 IN NS d.gov-servers.net. GOV. 86400 IN DS 7698 8 1 6f109b46a80cea9613dc86d5a3e065520505aafe GOV. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ) GOV. 86400 IN RRSIG ( DS 8 1 86400 20201009170000 20200926160000 46594 . CdDuJj0UH9xkYcOQA+ZmRi95J+CqNXiHjM4oBzue/kd/eaE63MsnCJI2KwQmIH7Vdd+BDdFft7Ke mV55CTM7gb0JfXHzr1azFlBm3mC9XhGwzBtWKq/Z756S5gHadrCi0kSwrSJRyxGzP3jttxE0bhiI jxfwrpSY8hG2g9daqsVxlHLxcsT30J/CkC1W+6R3ckU0NDIpDxEYy8tHXR/Yne+2jML/SsI7QTju ytyRUfHjqxlOpKVgVpQn7sN3D/lUJ0NwroV4wGrvzvs/v+wqv92tJpVZOikXaRK6zwMwbIGa3v+C bf9nP/2zNSmJBbeRN/FKZDBIYsoaYYqX97Pf3Q== ) ;; ADDITIONAL SECTION (9 records) a.gov-servers.net. 172800 IN A 69.36.157.30 b.gov-servers.net. 172800 IN A 209.112.123.30 c.gov-servers.net. 172800 IN A 69.36.153.30 d.gov-servers.net. 172800 IN A 81.19.194.30 a.gov-servers.net. 172800 IN AAAA 2001:500:4431::2:30 b.gov-servers.net. 172800 IN AAAA 2620:74:27::2:30 c.gov-servers.net. 172800 IN AAAA 2620:74:28::2:30 d.gov-servers.net. 172800 IN AAAA 2620:74:29::2:30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to a.root-servers.net for GOV/DNSKEY
	Received 658 bytes from 198.41.0.4
	;; Answer received from 198.41.0.4 (658 bytes) ;; HEADER SECTION ;; id = 27670 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 7 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; GOV. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) GOV. 172800 IN NS b.gov-servers.net. GOV. 172800 IN NS c.gov-servers.net. GOV. 172800 IN NS a.gov-servers.net. GOV. 172800 IN NS d.gov-servers.net. GOV. 86400 IN DS 7698 8 1 6f109b46a80cea9613dc86d5a3e065520505aafe GOV. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ) GOV. 86400 IN RRSIG ( DS 8 1 86400 20201009170000 20200926160000 46594 . CdDuJj0UH9xkYcOQA+ZmRi95J+CqNXiHjM4oBzue/kd/eaE63MsnCJI2KwQmIH7Vdd+BDdFft7Ke mV55CTM7gb0JfXHzr1azFlBm3mC9XhGwzBtWKq/Z756S5gHadrCi0kSwrSJRyxGzP3jttxE0bhiI jxfwrpSY8hG2g9daqsVxlHLxcsT30J/CkC1W+6R3ckU0NDIpDxEYy8tHXR/Yne+2jML/SsI7QTju ytyRUfHjqxlOpKVgVpQn7sN3D/lUJ0NwroV4wGrvzvs/v+wqv92tJpVZOikXaRK6zwMwbIGa3v+C bf9nP/2zNSmJBbeRN/FKZDBIYsoaYYqX97Pf3Q== ) ;; ADDITIONAL SECTION (9 records) b.gov-servers.net. 172800 IN A 209.112.123.30 b.gov-servers.net. 172800 IN AAAA 2620:74:27::2:30 c.gov-servers.net. 172800 IN A 69.36.153.30 c.gov-servers.net. 172800 IN AAAA 2620:74:28::2:30 a.gov-servers.net. 172800 IN A 69.36.157.30 a.gov-servers.net. 172800 IN AAAA 2001:500:4431::2:30 d.gov-servers.net. 172800 IN A 81.19.194.30 d.gov-servers.net. 172800 IN AAAA 2620:74:29::2:30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone GOV

GOV

	Checking DS between . and GOV
	Query to b.root-servers.net for GOV/DS
	Received 406 bytes from 199.9.14.201
	;; Answer received from 199.9.14.201 (406 bytes) ;; HEADER SECTION ;; id = 47142 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; GOV. IN DS ;; ANSWER SECTION (3 records) gov. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ) gov. 86400 IN DS 7698 8 1 6f109b46a80cea9613dc86d5a3e065520505aafe gov. 86400 IN RRSIG ( DS 8 1 86400 20201009170000 20200926160000 46594 . CdDuJj0UH9xkYcOQA+ZmRi95J+CqNXiHjM4oBzue/kd/eaE63MsnCJI2KwQmIH7Vdd+BDdFft7Ke mV55CTM7gb0JfXHzr1azFlBm3mC9XhGwzBtWKq/Z756S5gHadrCi0kSwrSJRyxGzP3jttxE0bhiI jxfwrpSY8hG2g9daqsVxlHLxcsT30J/CkC1W+6R3ckU0NDIpDxEYy8tHXR/Yne+2jML/SsI7QTju ytyRUfHjqxlOpKVgVpQn7sN3D/lUJ0NwroV4wGrvzvs/v+wqv92tJpVZOikXaRK6zwMwbIGa3v+C bf9nP/2zNSmJBbeRN/FKZDBIYsoaYYqX97Pf3Q== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DS records for GOV in the . zone
	DS=7698/SHA-256 has algorithm RSASHA256
	DS=7698/SHA-1 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20201009170000 20200926160000 46594 . CdDuJj0UH9xkYcOQA+ZmRi95J+CqNXiHjM4oBzue/kd/eaE63MsnCJI2KwQmIH7Vdd+BDdFft7Ke mV55CTM7gb0JfXHzr1azFlBm3mC9XhGwzBtWKq/Z756S5gHadrCi0kSwrSJRyxGzP3jttxE0bhiI jxfwrpSY8hG2g9daqsVxlHLxcsT30J/CkC1W+6R3ckU0NDIpDxEYy8tHXR/Yne+2jML/SsI7QTju ytyRUfHjqxlOpKVgVpQn7sN3D/lUJ0NwroV4wGrvzvs/v+wqv92tJpVZOikXaRK6zwMwbIGa3v+C bf9nP/2zNSmJBbeRN/FKZDBIYsoaYYqX97Pf3Q== )`
	RRSIG=46594 and DNSKEY=46594 verifies the DS RRset
	DS=7698/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 )`
	`gov. 86400 IN DS 7698 8 1 6f109b46a80cea9613dc86d5a3e065520505aafe`
	Query to b.gov-servers.net for GOV/DNSKEY
	Received 777 bytes from 209.112.123.30
	;; Answer received from 209.112.123.30 (777 bytes) ;; HEADER SECTION ;; id = 5511 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; GOV. IN DNSKEY ;; ANSWER SECTION (3 records) GOV. 86400 IN DNSKEY ( 257 3 8 AQO8daaz7B+yshOfL60rytKd9aOSujgponEw3fwBMEC3/+e9XzHw2k+VKnbJTZ+QaVtpfUd1q9HK ZIv/ck83Gl5TjYKE5jtUZ2kpEDZfVNGv6yx0smtWAXv1nCJS9ohnyOTd397eMojGDHqkEC+uojES cZheEkMxzgCZwDAs+/CSU7mSuHtCRZn19xlZUd5Gv7yDQ3mbOUwuy30oSk0z1Q5UUPpoihOugIZH FX6Jk7NLiW2wlqfq9qhV4zj7TiBiJY0mCc4zHN8/aq2VKDHp2Na7mWzvKyTy+SYQkBQ/08LbPwj9 YMc+uCzKL6sU/ObHv17EFhD8aPDftTHZvV9L+OZr ) ; Key ID = 7698 GOV. 86400 IN DNSKEY ( 256 3 8 AwEAAegdXlD9lumYfYK1EZkZgTXd/IgQSNnvRkdpQa8KXFujLQRrJ2+yqhamuyJq2HZ3k8yYqEER PmtKiuBYWIFw5on1Q0zUn3sO1/14bvKPcI5nbrpJXnlH672yS7FcSeWn14SRe9VzX1Y4/16QXtKh 2gC1Ot1nO0SUqjxdvY5lSDzcdJMRTJws3UjIK3f0uHMw+F5PuHpLWI5zZXir6KUuj2M= ) ; Key ID = 26665 GOV. 86400 IN RRSIG ( DNSKEY 8 1 86400 20201001190254 20200916185754 7698 gov. WJb3UC5UfhfrhSDl/HH+i6dNa14I10Toprb/UxSwtc3+S9Zryxs+sSdsUolE7TZbDbATIDrBb92U 8RgrE1d9/5YtacnuSr5bIp8IF7+DvlWA0Lz2kjatiXGje59QeG58hx//Q/P7AhnDdM7REWXxiNFa Qc1xrOQezskvGXX0KizIQm0TrXlAW0QQ4F2PteJCVhQg+w69WBRU4vxiGGAmJIdRVkwzgJXneadM rqLjoQXDV/XEnNc8nh9JIU5a1UsgW6hGypeuDjE/9p+UCXrFz6diNnEQ2P5cvJv8GqzJrnSONCKJ 8vNRlMB+n6D2WGFqzfVhFuAjuvSnfp8aXOByEQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DNSKEY records for GOV
	`GOV. 86400 IN DNSKEY ( 257 3 8 AQO8daaz7B+yshOfL60rytKd9aOSujgponEw3fwBMEC3/+e9XzHw2k+VKnbJTZ+QaVtpfUd1q9HK ZIv/ck83Gl5TjYKE5jtUZ2kpEDZfVNGv6yx0smtWAXv1nCJS9ohnyOTd397eMojGDHqkEC+uojES cZheEkMxzgCZwDAs+/CSU7mSuHtCRZn19xlZUd5Gv7yDQ3mbOUwuy30oSk0z1Q5UUPpoihOugIZH FX6Jk7NLiW2wlqfq9qhV4zj7TiBiJY0mCc4zHN8/aq2VKDHp2Na7mWzvKyTy+SYQkBQ/08LbPwj9 YMc+uCzKL6sU/ObHv17EFhD8aPDftTHZvV9L+OZr ) ; Key ID = 7698`
	`GOV. 86400 IN DNSKEY ( 256 3 8 AwEAAegdXlD9lumYfYK1EZkZgTXd/IgQSNnvRkdpQa8KXFujLQRrJ2+yqhamuyJq2HZ3k8yYqEER PmtKiuBYWIFw5on1Q0zUn3sO1/14bvKPcI5nbrpJXnlH672yS7FcSeWn14SRe9VzX1Y4/16QXtKh 2gC1Ot1nO0SUqjxdvY5lSDzcdJMRTJws3UjIK3f0uHMw+F5PuHpLWI5zZXir6KUuj2M= ) ; Key ID = 26665`
	DNSKEY=7698/SEP is now in the chain-of-trust
	DS=7698/SHA-256 verifies DNSKEY=7698/SEP
	DS=7698/SHA-1 verifies DNSKEY=7698/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`GOV. 86400 IN RRSIG ( DNSKEY 8 1 86400 20201001190254 20200916185754 7698 gov. WJb3UC5UfhfrhSDl/HH+i6dNa14I10Toprb/UxSwtc3+S9Zryxs+sSdsUolE7TZbDbATIDrBb92U 8RgrE1d9/5YtacnuSr5bIp8IF7+DvlWA0Lz2kjatiXGje59QeG58hx//Q/P7AhnDdM7REWXxiNFa Qc1xrOQezskvGXX0KizIQm0TrXlAW0QQ4F2PteJCVhQg+w69WBRU4vxiGGAmJIdRVkwzgJXneadM rqLjoQXDV/XEnNc8nh9JIU5a1UsgW6hGypeuDjE/9p+UCXrFz6diNnEQ2P5cvJv8GqzJrnSONCKJ 8vNRlMB+n6D2WGFqzfVhFuAjuvSnfp8aXOByEQ== )`
	RRSIG=7698 and DNSKEY=7698/SEP verifies the DNSKEY RRset
	DNSKEY=26665 is now in the chain-of-trust
	Query to c.gov-servers.net for FNAL.GOV/A
	Received 570 bytes from 69.36.153.30
	;; Answer received from 69.36.153.30 (570 bytes) ;; HEADER SECTION ;; id = 8378 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 9 arcount = 5 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) FNAL.GOV. 86400 IN NS ns1.FNAL.GOV. FNAL.GOV. 86400 IN NS adns1.es.net. FNAL.GOV. 86400 IN NS ns2.FNAL.GOV. FNAL.GOV. 86400 IN NS adns2.es.net. FNAL.GOV. 3600 IN DS 51525 7 1 e037ffe18a8a60b1ccab9ffe20f965c54f4e948a FNAL.GOV. 3600 IN DS 42708 7 1 c5dd8356d2b72daf53fb6a495ad3e1514e998a64 FNAL.GOV. 3600 IN DS ( 42708 7 2 815dba109bac952d72dce5c6eb23dca533fecce10f9b3c6769790c899176384a ) FNAL.GOV. 3600 IN DS ( 51525 7 2 aedde3335dc4e0b3e082cf5a2cccdbc46c4890aaee786d726ab3ac3b22437358 ) FNAL.GOV. 3600 IN RRSIG ( DS 8 2 3600 20201003161008 20200926161008 26665 gov. VoVqQHgQZ/7m46PQBLr/fdDSLp2daILpP5sJ5UuI9yHvSOezGe+SpM4f2bNIxv5BY+/jG9xxEJQf 1mDhZkkGaRx/rXbZEWJUuXMHZ0ZeCWBSp5U/VBQB5ivnyHcldkJUxFhLFRPSoEeDAZpU9AJZyY5g 1l+kFcsmkpNxiWR0t7d7rf256w7n9otapcwjJJU67yrd6EHXgxqeond5kYDo6Q== ) ;; ADDITIONAL SECTION (5 records) ns1.FNAL.GOV. 86400 IN A 198.49.208.71 ns1.FNAL.GOV. 86400 IN AAAA 2620:6a:0:1203::208:71 ns2.FNAL.GOV. 86400 IN A 198.49.208.70 ns2.FNAL.GOV. 86400 IN AAAA 2620:6a:0:1203::208:70 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to d.gov-servers.net for FNAL.GOV/DNSKEY
	Received 570 bytes from 81.19.194.30
	;; Answer received from 81.19.194.30 (570 bytes) ;; HEADER SECTION ;; id = 40395 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 9 arcount = 5 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) FNAL.GOV. 86400 IN NS ns1.FNAL.GOV. FNAL.GOV. 86400 IN NS adns1.es.net. FNAL.GOV. 86400 IN NS ns2.FNAL.GOV. FNAL.GOV. 86400 IN NS adns2.es.net. FNAL.GOV. 3600 IN DS 51525 7 1 e037ffe18a8a60b1ccab9ffe20f965c54f4e948a FNAL.GOV. 3600 IN DS 42708 7 1 c5dd8356d2b72daf53fb6a495ad3e1514e998a64 FNAL.GOV. 3600 IN DS ( 42708 7 2 815dba109bac952d72dce5c6eb23dca533fecce10f9b3c6769790c899176384a ) FNAL.GOV. 3600 IN DS ( 51525 7 2 aedde3335dc4e0b3e082cf5a2cccdbc46c4890aaee786d726ab3ac3b22437358 ) FNAL.GOV. 3600 IN RRSIG ( DS 8 2 3600 20201003161008 20200926161008 26665 gov. VoVqQHgQZ/7m46PQBLr/fdDSLp2daILpP5sJ5UuI9yHvSOezGe+SpM4f2bNIxv5BY+/jG9xxEJQf 1mDhZkkGaRx/rXbZEWJUuXMHZ0ZeCWBSp5U/VBQB5ivnyHcldkJUxFhLFRPSoEeDAZpU9AJZyY5g 1l+kFcsmkpNxiWR0t7d7rf256w7n9otapcwjJJU67yrd6EHXgxqeond5kYDo6Q== ) ;; ADDITIONAL SECTION (5 records) ns1.FNAL.GOV. 86400 IN A 198.49.208.71 ns1.FNAL.GOV. 86400 IN AAAA 2620:6a:0:1203::208:71 ns2.FNAL.GOV. 86400 IN A 198.49.208.70 ns2.FNAL.GOV. 86400 IN AAAA 2620:6a:0:1203::208:70 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone FNAL.GOV

FNAL.GOV

	Checking DS between GOV and FNAL.GOV
	Query to b.gov-servers.net for FNAL.GOV/DS
	Received 400 bytes from 209.112.123.30
	;; Answer received from 209.112.123.30 (400 bytes) ;; HEADER SECTION ;; id = 35955 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 5 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN DS ;; ANSWER SECTION (5 records) FNAL.GOV. 3600 IN DS 51525 7 1 e037ffe18a8a60b1ccab9ffe20f965c54f4e948a FNAL.GOV. 3600 IN DS 42708 7 1 c5dd8356d2b72daf53fb6a495ad3e1514e998a64 FNAL.GOV. 3600 IN DS ( 42708 7 2 815dba109bac952d72dce5c6eb23dca533fecce10f9b3c6769790c899176384a ) FNAL.GOV. 3600 IN DS ( 51525 7 2 aedde3335dc4e0b3e082cf5a2cccdbc46c4890aaee786d726ab3ac3b22437358 ) FNAL.GOV. 3600 IN RRSIG ( DS 8 2 3600 20201003161008 20200926161008 26665 gov. VoVqQHgQZ/7m46PQBLr/fdDSLp2daILpP5sJ5UuI9yHvSOezGe+SpM4f2bNIxv5BY+/jG9xxEJQf 1mDhZkkGaRx/rXbZEWJUuXMHZ0ZeCWBSp5U/VBQB5ivnyHcldkJUxFhLFRPSoEeDAZpU9AJZyY5g 1l+kFcsmkpNxiWR0t7d7rf256w7n9otapcwjJJU67yrd6EHXgxqeond5kYDo6Q== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 4 DS records for FNAL.GOV in the GOV zone
	DS=51525/SHA-1 has algorithm RSASHA1-NSEC3-SHA1
	DS=42708/SHA-1 has algorithm RSASHA1-NSEC3-SHA1
	DS=42708/SHA-256 has algorithm RSASHA1-NSEC3-SHA1
	DS=51525/SHA-256 has algorithm RSASHA1-NSEC3-SHA1
	Found 1 RRSIGs over DS RRset
	`FNAL.GOV. 3600 IN RRSIG ( DS 8 2 3600 20201003161008 20200926161008 26665 gov. VoVqQHgQZ/7m46PQBLr/fdDSLp2daILpP5sJ5UuI9yHvSOezGe+SpM4f2bNIxv5BY+/jG9xxEJQf 1mDhZkkGaRx/rXbZEWJUuXMHZ0ZeCWBSp5U/VBQB5ivnyHcldkJUxFhLFRPSoEeDAZpU9AJZyY5g 1l+kFcsmkpNxiWR0t7d7rf256w7n9otapcwjJJU67yrd6EHXgxqeond5kYDo6Q== )`
	RRSIG=26665 and DNSKEY=26665 verifies the DS RRset
	DS=51525/SHA-1 is now in the chain-of-trust
	DS=42708/SHA-1 is now in the chain-of-trust
	`FNAL.GOV. 3600 IN DS 51525 7 1 e037ffe18a8a60b1ccab9ffe20f965c54f4e948a`
	`FNAL.GOV. 3600 IN DS 42708 7 1 c5dd8356d2b72daf53fb6a495ad3e1514e998a64`
	`FNAL.GOV. 3600 IN DS ( 42708 7 2 815dba109bac952d72dce5c6eb23dca533fecce10f9b3c6769790c899176384a )`
	`FNAL.GOV. 3600 IN DS ( 51525 7 2 aedde3335dc4e0b3e082cf5a2cccdbc46c4890aaee786d726ab3ac3b22437358 )`
	Query to ns1.FNAL.GOV for FNAL.GOV/DNSKEY
	Received 1497 bytes from 198.49.208.71
	;; Answer received from 198.49.208.71 (1497 bytes) ;; HEADER SECTION ;; id = 21814 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 6 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN DNSKEY ;; ANSWER SECTION (6 records) FNAL.GOV. 172800 IN DNSKEY ( 257 3 7 AwEAAbvzrD9SU2Ob7h7uKuObbjjHhApWEqbd1p6Aj5EIhK94JZ1h+tkJtRXl4Rn8YPrulv1msj4W 6gKdlf5a+IjGbGcmfw1RMjaqg7t070/7BNEF/DIUIefq8NZ0CR/DYvtwtIAjFe7ysgAh0Ns56HZS VD41l6b0tIIyqbTugjZ3zHVnjvOs/wytDSV4M0Vx5zbA55UkTSpPVl0SF/KRVC4Ek1hAxvGK8B9B ZLw6v10xhw4twCkr3ZFaPoU7iLhSnQpAF9h5x1YtnsmJJMH7ViM4/AHDiG0ax2kK4p+6048oBKib tIkwbvgbtDUm3Uhg4l0S+eUgWKM3aNIkDqytOE0G1r0= ) ; Key ID = 51525 FNAL.GOV. 172800 IN DNSKEY ( 256 3 7 AwEAAbs3mOGFaK4oWDHRSPh9nDXP8A3Aq/nB7boOLvFumjt3douZ1FPOfACPEgVw9J6/rJTaWp66 KWvD4NkVCCoC5cblj1n/aRiUwrvAnKThutrcYZ4xt+lcCRmvtr8DpW13kF6/59m15rUS/PtH7yxy Sh1SwTGOcua+ALWZIUSiPFuf ) ; Key ID = 51842 FNAL.GOV. 172800 IN DNSKEY ( 257 3 7 AwEAAee52NP5xmXDXQEGqOUj4IXOGiJjZ/PeaGDy02qIY0Dgp49yrcX6TBh5wUpkGPp8m9ztadLh ye1cLyx3AfAyJxcXPeaw9p8BtzDer2ienBRHkdQaJW02bdIifhTHeIveNTW05znxh3Jwa2lD8lx9 TwnEo7RSQA0hyPN4+55WJCMsN2eoi0jT2A5O61d9B36jav9jby0qCb1wdO7BGXtzGtWCumYGz29k 7B3CiuOeEXJVDAT/fIw0mHaVO5IW8UbiATVQRw6cAaikzdT0zP7ABFSwau2zJDvv8I91yEc98Aoc m0XfOFRBi+XOyjt49i2XciBPTCWPwsw0OIPXLXgree8= ) ; Key ID = 42708 FNAL.GOV. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200930050720 20200926042848 42708 fnal.gov. H0XEJBSk5iVX9Em/YbTxdy4cZvKHtq1w8yR7nfzuqyJV4ueqBRcRpkRuvGydaYz8QPJ6ayJouZti CcmEynS9Q8NbrFmCEZwAdaIcJB3nmdF527JSLA4r9BbxkTSSHnggmAMbtdtgUO343JHzg5pY9iNF AogQRXDgZlTElGO4DhdmgcoaFRE1M2ov/EYz9WMAG1CwV8eL172N/dfcVJQD5Kqxhv6wK6gzrxbj qVerUzcdVtt/CVtlT7xcPhKm05pnxF6RmNEIJolrkKwNge+Y3WxGpU+yTwvpw9NAGn6B6mpeFLyH Qb1lFZCVG+WtVjF1vivkKI28W5Qj3v0yiNAVeg== ) fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200930050720 20200926042848 51525 fnal.gov. ntPcyyg7euLkGcKcDCdbgUv5msXSGrF7bQbpSOOrPBEsi7qpG3rizYgHiuCOcjp8dfvtgeJxsWUG GYQ0t0dTQBXUXKjGl9VG83ReA6FWVFDh/lMtXOuJVdc0y6arlCO0RjkfZRCbPEx7o6LxyhVY//Ly XGDLs4LVSWsSreDVk0szMxU1bjg162uve03zFtS6kyjOJLKh4F5zolAywxXAmURqGxwDtUXJxt3B ni9PBPQrvuBKps+C5RoRW5XFrLrQqgWh5Oitlxi6Xm93WEp2ARrqaGvuZs3mFMxMzm7Q/IZLaRn7 jt9uVFtRNhsQnLioXzTJcygUP0GRvZj6byAeoA== ) fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200930050720 20200926042848 51842 fnal.gov. JGF+NObsbgr8BES12rYfe16825AkDviqg8IMlin6swQGey7mcupOjdyAU0mKb+Dc5SuYfEwBTXYn YF0xGn3ceMDHM1VF+ZiQs405sTLxGWGWbkyXUqwVrYPX8G/jsfVXKLrxhqzawBuQGN+4K+Ny+cND qwB+ox7dNpg6wPRVbWc= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 3 DNSKEY records for FNAL.GOV
	`FNAL.GOV. 172800 IN DNSKEY ( 257 3 7 AwEAAbvzrD9SU2Ob7h7uKuObbjjHhApWEqbd1p6Aj5EIhK94JZ1h+tkJtRXl4Rn8YPrulv1msj4W 6gKdlf5a+IjGbGcmfw1RMjaqg7t070/7BNEF/DIUIefq8NZ0CR/DYvtwtIAjFe7ysgAh0Ns56HZS VD41l6b0tIIyqbTugjZ3zHVnjvOs/wytDSV4M0Vx5zbA55UkTSpPVl0SF/KRVC4Ek1hAxvGK8B9B ZLw6v10xhw4twCkr3ZFaPoU7iLhSnQpAF9h5x1YtnsmJJMH7ViM4/AHDiG0ax2kK4p+6048oBKib tIkwbvgbtDUm3Uhg4l0S+eUgWKM3aNIkDqytOE0G1r0= ) ; Key ID = 51525`
	`FNAL.GOV. 172800 IN DNSKEY ( 256 3 7 AwEAAbs3mOGFaK4oWDHRSPh9nDXP8A3Aq/nB7boOLvFumjt3douZ1FPOfACPEgVw9J6/rJTaWp66 KWvD4NkVCCoC5cblj1n/aRiUwrvAnKThutrcYZ4xt+lcCRmvtr8DpW13kF6/59m15rUS/PtH7yxy Sh1SwTGOcua+ALWZIUSiPFuf ) ; Key ID = 51842`
	`FNAL.GOV. 172800 IN DNSKEY ( 257 3 7 AwEAAee52NP5xmXDXQEGqOUj4IXOGiJjZ/PeaGDy02qIY0Dgp49yrcX6TBh5wUpkGPp8m9ztadLh ye1cLyx3AfAyJxcXPeaw9p8BtzDer2ienBRHkdQaJW02bdIifhTHeIveNTW05znxh3Jwa2lD8lx9 TwnEo7RSQA0hyPN4+55WJCMsN2eoi0jT2A5O61d9B36jav9jby0qCb1wdO7BGXtzGtWCumYGz29k 7B3CiuOeEXJVDAT/fIw0mHaVO5IW8UbiATVQRw6cAaikzdT0zP7ABFSwau2zJDvv8I91yEc98Aoc m0XfOFRBi+XOyjt49i2XciBPTCWPwsw0OIPXLXgree8= ) ; Key ID = 42708`
	DNSKEY=51525/SEP is now in the chain-of-trust
	DS=51525/SHA-1 verifies DNSKEY=51525/SEP
	DS=51525/SHA-256 verifies DNSKEY=51525/SEP
	DNSKEY=42708/SEP is now in the chain-of-trust
	DS=42708/SHA-1 verifies DNSKEY=42708/SEP
	DS=42708/SHA-256 verifies DNSKEY=42708/SEP
	Found 3 RRSIGs over DNSKEY RRset
	`FNAL.GOV. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200930050720 20200926042848 42708 fnal.gov. H0XEJBSk5iVX9Em/YbTxdy4cZvKHtq1w8yR7nfzuqyJV4ueqBRcRpkRuvGydaYz8QPJ6ayJouZti CcmEynS9Q8NbrFmCEZwAdaIcJB3nmdF527JSLA4r9BbxkTSSHnggmAMbtdtgUO343JHzg5pY9iNF AogQRXDgZlTElGO4DhdmgcoaFRE1M2ov/EYz9WMAG1CwV8eL172N/dfcVJQD5Kqxhv6wK6gzrxbj qVerUzcdVtt/CVtlT7xcPhKm05pnxF6RmNEIJolrkKwNge+Y3WxGpU+yTwvpw9NAGn6B6mpeFLyH Qb1lFZCVG+WtVjF1vivkKI28W5Qj3v0yiNAVeg== )`
	`fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200930050720 20200926042848 51525 fnal.gov. ntPcyyg7euLkGcKcDCdbgUv5msXSGrF7bQbpSOOrPBEsi7qpG3rizYgHiuCOcjp8dfvtgeJxsWUG GYQ0t0dTQBXUXKjGl9VG83ReA6FWVFDh/lMtXOuJVdc0y6arlCO0RjkfZRCbPEx7o6LxyhVY//Ly XGDLs4LVSWsSreDVk0szMxU1bjg162uve03zFtS6kyjOJLKh4F5zolAywxXAmURqGxwDtUXJxt3B ni9PBPQrvuBKps+C5RoRW5XFrLrQqgWh5Oitlxi6Xm93WEp2ARrqaGvuZs3mFMxMzm7Q/IZLaRn7 jt9uVFtRNhsQnLioXzTJcygUP0GRvZj6byAeoA== )`
	`fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20200930050720 20200926042848 51842 fnal.gov. JGF+NObsbgr8BES12rYfe16825AkDviqg8IMlin6swQGey7mcupOjdyAU0mKb+Dc5SuYfEwBTXYn YF0xGn3ceMDHM1VF+ZiQs405sTLxGWGWbkyXUqwVrYPX8G/jsfVXKLrxhqzawBuQGN+4K+Ny+cND qwB+ox7dNpg6wPRVbWc= )`
	RRSIG=42708 and DNSKEY=42708/SEP verifies the DNSKEY RRset
	RRSIG=51525 and DNSKEY=51525/SEP verifies the DNSKEY RRset
	RRSIG=51842 and DNSKEY=51842 verifies the DNSKEY RRset
	DNSKEY=51842 is now in the chain-of-trust
	Query to adns1.es.net for FNAL.GOV/A
	Received 229 bytes from 192.188.22.22
	;; Answer received from 192.188.22.22 (229 bytes) ;; HEADER SECTION ;; id = 35874 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN A ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN A 131.225.105.239 fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20200930182841 20200926174447 51842 fnal.gov. YrCBHmXwI4PHXuAmc/fFxawurI19N/mesjSYUJD7LFPDhYN0JLGo3zzf014KkUDPFg6GicRg6u6G d1jJKAUKFvGna3oc9zkURcW4+9mPFPyQl1XcNpJCAZNA/HZKV5dwneOML8uCVNa1aPg/84S7I/L9 e2M6ZhZErstTdLcfY0M= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	FNAL.GOV is authoritative for FNAL.GOV
	Found RRSIG signed by fnal.gov zone
	Query to adns1.es.net for FNAL.GOV/SOA
	Received 264 bytes from 192.188.22.22
	;; Answer received from 192.188.22.22 (264 bytes) ;; HEADER SECTION ;; id = 1780 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN SOA ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN SOA ( ns1.fnal.gov. netmanager.fnal.gov. 2023627405 ;serial 7200 ;refresh 120 ;retry 1209600 ;expire 900 ;minimum ) fnal.gov. 21600 IN RRSIG ( SOA 7 2 21600 20200930191546 20200926181546 51842 fnal.gov. MGE/JWUoKP2OAmQuKCYJGztonQDQK9h/Cwyuw1FIuoEPrSwoLcdJSFKrXcxTJYlKCfeo0JP+9/ud NOK3PdXYVjUqXhB+3crwCABwxqvgkKcUcp7jAGs4PY2l0kURdR2qYqsIwx5bgA4e3jf9ZyL0TPct 4hdfZWVakHRM6YZBFMM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to ns1.FNAL.GOV for FNAL.GOV/SOA
	Received 256 bytes from 198.49.208.71
	;; Answer received from 198.49.208.71 (256 bytes) ;; HEADER SECTION ;; id = 58653 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN SOA ;; ANSWER SECTION (2 records) FNAL.GOV. 21600 IN SOA ( ns1.FNAL.GOV. netmanager.FNAL.GOV. 2023627405 ;serial 7200 ;refresh 120 ;retry 1209600 ;expire 900 ;minimum ) FNAL.GOV. 21600 IN RRSIG ( SOA 7 2 21600 20200930191546 20200926181546 51842 fnal.gov. MGE/JWUoKP2OAmQuKCYJGztonQDQK9h/Cwyuw1FIuoEPrSwoLcdJSFKrXcxTJYlKCfeo0JP+9/ud NOK3PdXYVjUqXhB+3crwCABwxqvgkKcUcp7jAGs4PY2l0kURdR2qYqsIwx5bgA4e3jf9ZyL0TPct 4hdfZWVakHRM6YZBFMM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to adns2.es.net for FNAL.GOV/SOA
	Received 1270 bytes from 192.188.22.52
	;; Answer received from 192.188.22.52 (1270 bytes) ;; HEADER SECTION ;; id = 14492 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 5 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN SOA ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN SOA ( ns1.fnal.gov. netmanager.fnal.gov. 2023627404 ;serial 7200 ;refresh 120 ;retry 1209600 ;expire 900 ;minimum ) fnal.gov. 21600 IN RRSIG ( SOA 7 2 21600 20200930191534 20200926181534 51842 fnal.gov. WSbrMXzeNedTWscEkydzOaNKRd/O3bJ7VTITKiF6zUMoKsCbNpCazocxyeP90IMHJutYENU2vCie B52lnYiwOTRHF1Im6PwzzI0tIzLDDHaM53pr9AnxcE7qOMFqI+5uUgKyW1Jdx0meEl7OEeehtYgj dXrB3Cl+QaL+Kezejbg= ) ;; AUTHORITY SECTION (5 records) fnal.gov. 21600 IN NS ns1.fnal.gov. fnal.gov. 21600 IN NS ns2.fnal.gov. fnal.gov. 21600 IN NS adns1.es.net. fnal.gov. 21600 IN NS adns2.es.net. fnal.gov. 21600 IN RRSIG ( NS 7 2 21600 20200930063741 20200926060153 51842 fnal.gov. K6Mhdz00cfW/0oAB/+pmw84z6LfihN7x1ItxRgcXGCKo29uYVorNX7DHenVW7ZhpFMQhL9Cg62FE LJFHL/K0SEpOYm4o6bv9mogP1VPZAK7syrynrQrCym2DfUErniz9DBEycDR9e4VSRDWVbHDr7bEY wqWvxspJmFS+tt3hos8= ) ;; ADDITIONAL SECTION (9 records) ns1.fnal.gov. 21600 IN A 198.49.208.71 ns2.fnal.gov. 21600 IN A 198.49.208.70 ns1.fnal.gov. 21600 IN AAAA 2620:6a:0:1203::208:71 ns2.fnal.gov. 21600 IN AAAA 2620:6a:0:1203::208:70 ns1.fnal.gov. 21600 IN RRSIG ( A 7 3 21600 20200930013516 20200926010314 51842 fnal.gov. JsooI/ylF5uQp/59g9boqcWUg5T/ft631yWHrlUfHfDCMbESKeLwi4oxzn/kCtMFTJpauoQnrima WUTCC90xJSZ0ja8sYui1krTWAC9fGURFvF9E9nVkgZYeP6ZBuVhKOTGbp4/easDVPWkR3g/nm4o8 cg2fsYrynLJGW1/X4pE= ) ns1.fnal.gov. 21600 IN RRSIG ( AAAA 7 3 21600 20200929221259 20200925212652 51842 fnal.gov. KvS6y66CeowA2qA9nbIVRYd3l0cuRcRtHEn36Z5dvbLc3p+bvPI7wHFngoWfQvr4OMk8oRHlv2Ng rI9IRiMAeykVo3zx8QUlgx2B1BSe6Q3aHBRZUIu/KIOlnBvAAgfD2aNZyGigMleTzAb9Zpn+Vd9L MDDzod/TSdMJPxXLkuc= ) ns2.fnal.gov. 21600 IN RRSIG ( A 7 3 21600 20200930072248 20200926065559 51842 fnal.gov. fwViCH6eTs5tCpYFQrm5ISBTP3ZJzl+Ev/jQMPeaOxYWVPfEibbVOmeWwG7lNyhl+TNv4U/F5X6t Sq3OE9wrPCYyffeL+6bSW78aCO2S6eHO38sYpOQZfx6vg/5FPjBVwrRM/Ikc9LEJBpMjC9LVVrEm pTN8sw/LjOJ4w0jIm0Y= ) ns2.fnal.gov. 21600 IN RRSIG ( AAAA 7 3 21600 20200930045347 20200926041203 51842 fnal.gov. QrMa7SOP9ni8hPN1XnOUVHSZOOy70TvBxhdw2qvxHOSasUbI5T0JyjCZ58rS3T08wgB12aIc3TwM Woo1on256lF0saIZMrpwOVOy1tRzWliOqBal1a+7K/VJkHr3cKUgDWvFDxG/3Cx+A287NGZUXmYd VR63KjFXqvU9GTzFs20= ) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	adns2.es.net serial (2023627404) differs from adns1.es.net serial (2023627405)
	Query to ns2.FNAL.GOV for FNAL.GOV/SOA
	Received 256 bytes from 198.49.208.70
	;; Answer received from 198.49.208.70 (256 bytes) ;; HEADER SECTION ;; id = 13902 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN SOA ;; ANSWER SECTION (2 records) FNAL.GOV. 21600 IN SOA ( ns1.FNAL.GOV. netmanager.FNAL.GOV. 2023627405 ;serial 7200 ;refresh 120 ;retry 1209600 ;expire 900 ;minimum ) FNAL.GOV. 21600 IN RRSIG ( SOA 7 2 21600 20200930191546 20200926181546 51842 fnal.gov. MGE/JWUoKP2OAmQuKCYJGztonQDQK9h/Cwyuw1FIuoEPrSwoLcdJSFKrXcxTJYlKCfeo0JP+9/ud NOK3PdXYVjUqXhB+3crwCABwxqvgkKcUcp7jAGs4PY2l0kURdR2qYqsIwx5bgA4e3jf9ZyL0TPct 4hdfZWVakHRM6YZBFMM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to adns1.es.net for FNAL.GOV/A
	Received 229 bytes from 192.188.22.22
	;; Answer received from 192.188.22.22 (229 bytes) ;; HEADER SECTION ;; id = 34456 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; FNAL.GOV. IN A ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN A 131.225.105.239 fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20200930182841 20200926174447 51842 fnal.gov. YrCBHmXwI4PHXuAmc/fFxawurI19N/mesjSYUJD7LFPDhYN0JLGo3zzf014KkUDPFg6GicRg6u6G d1jJKAUKFvGna3oc9zkURcW4+9mPFPyQl1XcNpJCAZNA/HZKV5dwneOML8uCVNa1aPg/84S7I/L9 e2M6ZhZErstTdLcfY0M= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	FNAL.GOV A RR has value 131.225.105.239
	Found 1 RRSIGs over A RRset
	`fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20200930182841 20200926174447 51842 fnal.gov. YrCBHmXwI4PHXuAmc/fFxawurI19N/mesjSYUJD7LFPDhYN0JLGo3zzf014KkUDPFg6GicRg6u6G d1jJKAUKFvGna3oc9zkURcW4+9mPFPyQl1XcNpJCAZNA/HZKV5dwneOML8uCVNa1aPg/84S7I/L9 e2M6ZhZErstTdLcfY0M= )`
	RRSIG=51842 and DNSKEY=51842 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test FNAL.GOV at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: