DNSSEC Debugger

Back to Verisign Labs Tools

Domain Name:

Detail: more(+) / less(-)

Time: 2026-09-08 15:27:11 UTC

Analyzing DNSSEC problems for anl.gov

DS=20326/SHA-256 is now in the chain-of-trust

DS=38696/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	`. IN DS ( 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 )`
	Query to e.root-servers.net for ./DNSKEY
	Received 1139 bytes from 192.203.230.10
	;; Response received from [192.203.230.10] 1139 octets ;; HEADER SECTION ;; id = 14706 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAeCYD6Z7WWKVLeuWgowKP+3g+Gs1cnLKq7a3CaQxQpv8bfuFVI0WnG33qaSH/Mw9IBgifrdz f4XY/DQLnyBJ9MfaOyAWuEaEmYJ+GQPiwVVfstGwSA1McfFJUttTgq2Huu74KARhtA8wPo/N3Xcy YQtNhz+qCM5NBb3ecx/naw6sYab9LxS6f2cU0q03++BP5Ks0Uef8WJCa/1izCYE+vMkwoltV+tEN a3hpXiZ7jle/xdgaZrPi5ZGmyLVI34g1XVYrNlsCCTmNvFQIfzW5STFQFsQpizczyFn9r3LzSxxP CNwdlCG84bER0BmdwqbF6Tanv+FxMOavrahkj4wIy5k= ) ; keytag 57780 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20260920000000 20260830000000 20326 . PvfCYsLIvqwE52D32Fx+zL43nm8ojP/W3MbsbUu4IsBqewjFRvAv00Mp2ehX2IyjRUV2fhtHPFzL 3G0PK9GucRv7Ab97RauaOiVJnAqqUjELQR4HedSNVnprjF8UUmRiXPOTXAD/WEWLAk9MOOcwF+xK eB4f8spcLMIVDA9r32afCpu2lhs/3rwDD687GCz2HN5y4/Ew5Wi8ZSD3TMtbaSoGOb73Zpzw0XqB k9PqBVEZPcR2bZkgPRQZRYz8Pwga658J1hhw6qn3eocf4WluAldJGd2wYvXLUrwdZESnYac0aq8O Y2t3Z2MYoX1JnLQttItxyltVQIv8AoQnUMet/w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAeCYD6Z7WWKVLeuWgowKP+3g+Gs1cnLKq7a3CaQxQpv8bfuFVI0WnG33qaSH/Mw9IBgifrdz f4XY/DQLnyBJ9MfaOyAWuEaEmYJ+GQPiwVVfstGwSA1McfFJUttTgq2Huu74KARhtA8wPo/N3Xcy YQtNhz+qCM5NBb3ecx/naw6sYab9LxS6f2cU0q03++BP5Ks0Uef8WJCa/1izCYE+vMkwoltV+tEN a3hpXiZ7jle/xdgaZrPi5ZGmyLVI34g1XVYrNlsCCTmNvFQIfzW5STFQFsQpizczyFn9r3LzSxxP CNwdlCG84bER0BmdwqbF6Tanv+FxMOavrahkj4wIy5k= ) ; keytag 57780`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	DNSKEY=38696/SEP is now in the chain-of-trust
	DS=38696/SHA-256 verifies DNSKEY=38696/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20260920000000 20260830000000 20326 . PvfCYsLIvqwE52D32Fx+zL43nm8ojP/W3MbsbUu4IsBqewjFRvAv00Mp2ehX2IyjRUV2fhtHPFzL 3G0PK9GucRv7Ab97RauaOiVJnAqqUjELQR4HedSNVnprjF8UUmRiXPOTXAD/WEWLAk9MOOcwF+xK eB4f8spcLMIVDA9r32afCpu2lhs/3rwDD687GCz2HN5y4/Ew5Wi8ZSD3TMtbaSoGOb73Zpzw0XqB k9PqBVEZPcR2bZkgPRQZRYz8Pwga658J1hhw6qn3eocf4WluAldJGd2wYvXLUrwdZESnYac0aq8O Y2t3Z2MYoX1JnLQttItxyltVQIv8AoQnUMet/w== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=57780 is now in the chain-of-trust
	Query to e.root-servers.net for anl.gov/A
	Received 614 bytes from 192.203.230.10
	;; Response received from [192.203.230.10] 614 octets ;; HEADER SECTION ;; id = 34286 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20260921140000 20260908130000 57780 . obZuREUwrVNS+fdnGAwwO27CfUugdfKYdlX6s5bDG+tw81AseC5E4x7b7KOS2UkglFw+LA5kwwLO yWIS91XgTTQX7BewNOFZRbP6vV4MQAIxgs3SOZi206hq0iIrOkJ12TX+p+1wkPyQlFBvhIOF55/n luYIYZ1pA3wwljc0+0lmrljMJ9mPG6Jxcl4Y2oKH6QkMXFYCipvqz8nj7FuDKAN07S4+DayLt6Kn h64muwJU7KGdPLpP2n46XFXSJ8ovI1ezzL4KkOMUcYcR3h/vuCCRLU3NEBc/YBUCHWBFwh04lbtO rzVQuqWVZTwaSsD3+zftHOW6D21xNAZ8vFJXrw== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN A 199.33.231.1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN A 199.33.232.1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN A 199.33.233.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Query to j.root-servers.net for gov/DNSKEY
	Received 610 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 610 octets ;; HEADER SECTION ;; id = 25310 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20260921140000 20260908130000 57780 . obZuREUwrVNS+fdnGAwwO27CfUugdfKYdlX6s5bDG+tw81AseC5E4x7b7KOS2UkglFw+LA5kwwLO yWIS91XgTTQX7BewNOFZRbP6vV4MQAIxgs3SOZi206hq0iIrOkJ12TX+p+1wkPyQlFBvhIOF55/n luYIYZ1pA3wwljc0+0lmrljMJ9mPG6Jxcl4Y2oKH6QkMXFYCipvqz8nj7FuDKAN07S4+DayLt6Kn h64muwJU7KGdPLpP2n46XFXSJ8ovI1ezzL4KkOMUcYcR3h/vuCCRLU3NEBc/YBUCHWBFwh04lbtO rzVQuqWVZTwaSsD3+zftHOW6D21xNAZ8vFJXrw== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN A 199.33.231.1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN A 199.33.232.1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN A 199.33.233.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Found child zone gov

gov

	Checking DS between . and gov
	Query to l.root-servers.net for gov/DS
	Received 367 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 367 octets ;; HEADER SECTION ;; id = 34416 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20260921140000 20260908130000 57780 . obZuREUwrVNS+fdnGAwwO27CfUugdfKYdlX6s5bDG+tw81AseC5E4x7b7KOS2UkglFw+LA5kwwLO yWIS91XgTTQX7BewNOFZRbP6vV4MQAIxgs3SOZi206hq0iIrOkJ12TX+p+1wkPyQlFBvhIOF55/n luYIYZ1pA3wwljc0+0lmrljMJ9mPG6Jxcl4Y2oKH6QkMXFYCipvqz8nj7FuDKAN07S4+DayLt6Kn h64muwJU7KGdPLpP2n46XFXSJ8ovI1ezzL4KkOMUcYcR3h/vuCCRLU3NEBc/YBUCHWBFwh04lbtO rzVQuqWVZTwaSsD3+zftHOW6D21xNAZ8vFJXrw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for gov in the . zone
	DS=2536/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20260921140000 20260908130000 57780 . obZuREUwrVNS+fdnGAwwO27CfUugdfKYdlX6s5bDG+tw81AseC5E4x7b7KOS2UkglFw+LA5kwwLO yWIS91XgTTQX7BewNOFZRbP6vV4MQAIxgs3SOZi206hq0iIrOkJ12TX+p+1wkPyQlFBvhIOF55/n luYIYZ1pA3wwljc0+0lmrljMJ9mPG6Jxcl4Y2oKH6QkMXFYCipvqz8nj7FuDKAN07S4+DayLt6Kn h64muwJU7KGdPLpP2n46XFXSJ8ovI1ezzL4KkOMUcYcR3h/vuCCRLU3NEBc/YBUCHWBFwh04lbtO rzVQuqWVZTwaSsD3+zftHOW6D21xNAZ8vFJXrw== )`
	RRSIG=57780 and DNSKEY=57780 verifies the DS RRset
	DS=2536/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 )`
	Query to c.ns.gov for gov/DNSKEY
	Received 291 bytes from 199.33.232.1
	;; Response received from [199.33.232.1] 291 octets ;; HEADER SECTION ;; id = 568 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536 gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496 gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20261027110638 20260827110638 2536 gov. PtRLa+tjVuHiye3klDjS7yugV+CJgjvDc9nmgh/T1kZfHsYlKKP7AZC5rN3tuCnWUBN0JLaqMvvB aOtx0rt13Q== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for gov
	`gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536`
	`gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496`
	DNSKEY=2536/SEP is now in the chain-of-trust
	DS=2536/SHA-256 verifies DNSKEY=2536/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20261027110638 20260827110638 2536 gov. PtRLa+tjVuHiye3klDjS7yugV+CJgjvDc9nmgh/T1kZfHsYlKKP7AZC5rN3tuCnWUBN0JLaqMvvB aOtx0rt13Q== )`
	RRSIG=2536 and DNSKEY=2536/SEP verifies the DNSKEY RRset
	DNSKEY=35496 is now in the chain-of-trust
	Query to a.ns.gov for anl.gov/A
	Received 383 bytes from 199.33.230.1
	;; Response received from [199.33.230.1] 383 octets ;; HEADER SECTION ;; id = 32630 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 5 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) anl.gov. 10800 IN NS adns1.es.net. anl.gov. 10800 IN NS adns2.es.net. anl.gov. 10800 IN NS sdns.lbnl.net. anl.gov. 10800 IN NS t1dns1.anl.gov. anl.gov. 10800 IN NS t1dns2.anl.gov. anl.gov. 3600 IN DS ( 62719 8 2 02f8950a45fe2c9a10364de1e6c1799c501de568a91cf20a30acd0bec053f117 ) anl.gov. 3600 IN RRSIG ( DS 13 2 3600 20260909162711 20260907142711 35496 gov. tKsxfDyIYXu8fOm7zcmr8gdYqjl5FmqALdg9Prmgq3uO/wA7MeanqMsmrKlTTHTx9iy60ugKmbhD NqSqcAh2Fg== ) ;; ADDITIONAL SECTION (5 records) t1dns1.anl.gov. 3600 IN A 130.202.101.6 t1dns1.anl.gov. 3600 IN AAAA 2620:0:dc0:180e::6 t1dns2.anl.gov. 3600 IN A 130.202.101.37 t1dns2.anl.gov. 3600 IN AAAA 2620:0:dc0:180d::37 ;; { "EDNS-VERSION": 0 }
	Query to c.ns.gov for anl.gov/DNSKEY
	Received 383 bytes from 199.33.232.1
	;; Response received from [199.33.232.1] 383 octets ;; HEADER SECTION ;; id = 28355 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 5 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) anl.gov. 10800 IN NS adns1.es.net. anl.gov. 10800 IN NS adns2.es.net. anl.gov. 10800 IN NS sdns.lbnl.net. anl.gov. 10800 IN NS t1dns1.anl.gov. anl.gov. 10800 IN NS t1dns2.anl.gov. anl.gov. 3600 IN DS ( 62719 8 2 02f8950a45fe2c9a10364de1e6c1799c501de568a91cf20a30acd0bec053f117 ) anl.gov. 3600 IN RRSIG ( DS 13 2 3600 20260909162711 20260907142711 35496 gov. OYDl9LxFiL3CJhvnDENLng6Dkp5EYl22J0uLQXApefgZToMOfKzPLMK/t4/rctS/5ANRZmKCqptl WyY5nz04qw== ) ;; ADDITIONAL SECTION (5 records) t1dns1.anl.gov. 3600 IN A 130.202.101.6 t1dns1.anl.gov. 3600 IN AAAA 2620:0:dc0:180e::6 t1dns2.anl.gov. 3600 IN A 130.202.101.37 t1dns2.anl.gov. 3600 IN AAAA 2620:0:dc0:180d::37 ;; { "EDNS-VERSION": 0 }
	Found child zone anl.gov

anl.gov

	Checking DS between gov and anl.gov
	Query to a.ns.gov for anl.gov/DS
	Received 183 bytes from 199.33.230.1
	;; Response received from [199.33.230.1] 183 octets ;; HEADER SECTION ;; id = 9532 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN DS ;; ANSWER SECTION (2 records) anl.gov. 3600 IN DS ( 62719 8 2 02f8950a45fe2c9a10364de1e6c1799c501de568a91cf20a30acd0bec053f117 ) anl.gov. 3600 IN RRSIG ( DS 13 2 3600 20260909162711 20260907142711 35496 gov. wo4yMCCnbt+mQkx9SOG19QibdAn5fiH1/sy8jIGjy40Mr4Fho+9bdY7lxND2XQHC3PzFHda0VHkl ePdMlYGGbg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for anl.gov in the gov zone
	DS=62719/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`anl.gov. 3600 IN RRSIG ( DS 13 2 3600 20260909162711 20260907142711 35496 gov. wo4yMCCnbt+mQkx9SOG19QibdAn5fiH1/sy8jIGjy40Mr4Fho+9bdY7lxND2XQHC3PzFHda0VHkl ePdMlYGGbg== )`
	RRSIG=35496 and DNSKEY=35496 verifies the DS RRset
	DS=62719/SHA-256 is now in the chain-of-trust
	`anl.gov. 3600 IN DS ( 62719 8 2 02f8950a45fe2c9a10364de1e6c1799c501de568a91cf20a30acd0bec053f117 )`
	Query to adns1.es.net for anl.gov/DNSKEY
	Received 1070 bytes from 192.188.22.22
	;; Response received from [192.188.22.22] 1070 octets ;; HEADER SECTION ;; id = 59344 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 5 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN DNSKEY ;; ANSWER SECTION (5 records) anl.gov. 172800 IN DNSKEY ( 256 3 8 AwEAAaJbzGaj+/xolarVh8mihBx338sNT+oG9R9IAyzPg2RyNKnoW3CCrDbk2gGjg/lRywrtVMqi Di3LahUaodtOFO0TQ0RKPRmf5qqoKgeIeHiQT0tGAiU5wwd1bbpp67T38BcaR++LYNECD4gYEnvi n9YmOweav69q+9w1AWwDHCYT ) ; keytag 21313 anl.gov. 172800 IN DNSKEY ( 256 3 8 AwEAAa0mgadtlvY3lq5iu437KsI6NFJU8oYkGCuoRrYVeYetvFWoSimU12d6XvRo7qpclQ0Ts+G+ siyGybYdYe7wo7wfuw/sZlrUPs0EvPd6e79Hp5X4KOwuk4lCChNTa/XLSGuFdjxushgRvU4lJwon 3Vq/s5+NmtLUKs7zr/nhsTH5 ) ; keytag 45433 anl.gov. 172800 IN DNSKEY ( 257 3 8 AwEAAZUVT1oP6389Lnddde7Gs9FGkxQUuqDFYm4jItZNDDHC4ds7tIsGLS0kGeOYpR/B5yXB6lbP WmIM5RJj0PnvR+vmbq+mmJUGBIwCTqTBjWnB7Fl4DzAEgIH8CSqZ3OZ49ZzFY4tokWrc6rDi+JDb Z/xa3Ro8nhPnXJNz8VzQsG3sYKGCPUxSeAB10XVMok5aVRepxBXRPfv+F0Gy4nCMFHcudbJrqPGf sewnSXRPlfjpAIIEL9rYW0oNF7+whRtqyfOIrMsu+qtAau+Cf+467VeCm8f/zFobCfQsrZL57OQO 8437kCQqQopEWm0XxRMRxVXSm+GsQjxTlsl4gGe+4Wk= ) ; keytag 62719 anl.gov. 172800 IN RRSIG ( DNSKEY 8 2 172800 20260912075836 20260908074806 21313 anl.gov. SykzPYNU14e6Eb6kgPdsJFtf16WWHBXkTVA7pme/aNh+dguNpP8guF7nmgb+MtBB9zybFuMcd4Q9 LgAaHMdz2TxPHOGwMsgIpGVc+pP9kN6XwA3UhFcGh3029s599nhld5FPKRo9Bb5FCLx6+SQgBaJC P7BUIzr6ohzF8a9sn3Y= ) anl.gov. 172800 IN RRSIG ( DNSKEY 8 2 172800 20260912075836 20260908074806 62719 anl.gov. HUfwAfLNUV9hZaXjcaZxxU3BemTZ3BF024+eMqwhln7MXL4c4DMloQ4UQ6bHGtXgIfPUwJT0mEjz mJNB2OvCF5HJIeJDtMOCOnInCYQpqwZq6tD/avoqqmod7OZX/OlQtpjbNZSmfyL2mGQJIbZ663Hc n2iqF1bVI/4mW9vu1DF1nJZJ5WypC6i//h6YhOILOJeJetFsj9dVFjTdfn/6FwyEfyXtCJvKkGAc vIGwuyXfy5v61KxRtNoxav17Zk3Vm9IQNwAnhT1dzo9ze5B10z+s/gNCwjuFpq2MSohS/zb3lsXB UbrgajjBpbCa6aL0i7TfbESVo1N4gKgrlAjnag== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for anl.gov
	`anl.gov. 172800 IN DNSKEY ( 256 3 8 AwEAAaJbzGaj+/xolarVh8mihBx338sNT+oG9R9IAyzPg2RyNKnoW3CCrDbk2gGjg/lRywrtVMqi Di3LahUaodtOFO0TQ0RKPRmf5qqoKgeIeHiQT0tGAiU5wwd1bbpp67T38BcaR++LYNECD4gYEnvi n9YmOweav69q+9w1AWwDHCYT ) ; keytag 21313`
	`anl.gov. 172800 IN DNSKEY ( 256 3 8 AwEAAa0mgadtlvY3lq5iu437KsI6NFJU8oYkGCuoRrYVeYetvFWoSimU12d6XvRo7qpclQ0Ts+G+ siyGybYdYe7wo7wfuw/sZlrUPs0EvPd6e79Hp5X4KOwuk4lCChNTa/XLSGuFdjxushgRvU4lJwon 3Vq/s5+NmtLUKs7zr/nhsTH5 ) ; keytag 45433`
	`anl.gov. 172800 IN DNSKEY ( 257 3 8 AwEAAZUVT1oP6389Lnddde7Gs9FGkxQUuqDFYm4jItZNDDHC4ds7tIsGLS0kGeOYpR/B5yXB6lbP WmIM5RJj0PnvR+vmbq+mmJUGBIwCTqTBjWnB7Fl4DzAEgIH8CSqZ3OZ49ZzFY4tokWrc6rDi+JDb Z/xa3Ro8nhPnXJNz8VzQsG3sYKGCPUxSeAB10XVMok5aVRepxBXRPfv+F0Gy4nCMFHcudbJrqPGf sewnSXRPlfjpAIIEL9rYW0oNF7+whRtqyfOIrMsu+qtAau+Cf+467VeCm8f/zFobCfQsrZL57OQO 8437kCQqQopEWm0XxRMRxVXSm+GsQjxTlsl4gGe+4Wk= ) ; keytag 62719`
	DNSKEY=62719/SEP is now in the chain-of-trust
	DS=62719/SHA-256 verifies DNSKEY=62719/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`anl.gov. 172800 IN RRSIG ( DNSKEY 8 2 172800 20260912075836 20260908074806 21313 anl.gov. SykzPYNU14e6Eb6kgPdsJFtf16WWHBXkTVA7pme/aNh+dguNpP8guF7nmgb+MtBB9zybFuMcd4Q9 LgAaHMdz2TxPHOGwMsgIpGVc+pP9kN6XwA3UhFcGh3029s599nhld5FPKRo9Bb5FCLx6+SQgBaJC P7BUIzr6ohzF8a9sn3Y= )`
	`anl.gov. 172800 IN RRSIG ( DNSKEY 8 2 172800 20260912075836 20260908074806 62719 anl.gov. HUfwAfLNUV9hZaXjcaZxxU3BemTZ3BF024+eMqwhln7MXL4c4DMloQ4UQ6bHGtXgIfPUwJT0mEjz mJNB2OvCF5HJIeJDtMOCOnInCYQpqwZq6tD/avoqqmod7OZX/OlQtpjbNZSmfyL2mGQJIbZ663Hc n2iqF1bVI/4mW9vu1DF1nJZJ5WypC6i//h6YhOILOJeJetFsj9dVFjTdfn/6FwyEfyXtCJvKkGAc vIGwuyXfy5v61KxRtNoxav17Zk3Vm9IQNwAnhT1dzo9ze5B10z+s/gNCwjuFpq2MSohS/zb3lsXB UbrgajjBpbCa6aL0i7TfbESVo1N4gKgrlAjnag== )`
	RRSIG=21313 and DNSKEY=21313 verifies the DNSKEY RRset
	RRSIG=62719 and DNSKEY=62719/SEP verifies the DNSKEY RRset
	DNSKEY=21313 is now in the chain-of-trust
	DNSKEY=45433 is now in the chain-of-trust
	Query to adns1.es.net for anl.gov/A
	Received 500 bytes from 192.188.22.22
	;; Response received from [192.188.22.22] 500 octets ;; HEADER SECTION ;; id = 40431 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) anl.gov. 60 IN SOA ( infoblox-gm-prod.it.anl.gov. hostmaster.anl.gov. 3000002047 ;serial 14400 ;refresh 1800 ;retry 2419200 ;expire 60 ;minimum ) anl.gov. 60 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= ) anl.gov. 60 IN NSEC ( 0ec67e8445e83f4b3e138bf12277834f.anl.gov. NS SOA MX TXT RRSIG NSEC DNSKEY ) anl.gov. 60 IN RRSIG ( NSEC 8 2 60 20260912095509 20260908093743 21313 anl.gov. cqzsLZSuAueL5WZY/Dy67IxF9+Ejkjxeeb2QnPJb6tIXaVTJf4AdaYpU/QTTXRvXVCMhHvgtB2LJ TnulOXKbAFJXGhU51wazb2tyl/Mvl/H2+jgepgC1KyRKjnJw7P07yG5ejdOeUMXulwirTIwnbI6/ ADr+SZC3qJxTioPw4t8= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	adns1.es.net is authoritative for anl.gov
	Found RRSIG signed by anl.gov zone
	Query to t1dns1.anl.gov for anl.gov/SOA
	Received 277 bytes from 130.202.101.6
	;; Response received from [130.202.101.6] 277 octets ;; HEADER SECTION ;; id = 29933 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN SOA ;; ANSWER SECTION (2 records) anl.gov. 14400 IN SOA ( infoblox-gm-prod.it.anl.gov. hostmaster.anl.gov. 3000002047 ;serial 14400 ;refresh 1800 ;retry 2419200 ;expire 60 ;minimum ) anl.gov. 14400 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to sdns.lbnl.net for anl.gov/SOA
	Received 1144 bytes from 131.243.5.53
	;; Response received from [131.243.5.53] 1144 octets ;; HEADER SECTION ;; id = 39591 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 6 arcount = 8 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ;; {"EXTENDED-ERROR": {"ERROR": "Prohibited", "EXTRA-TEXT": "", "INFO-CODE": 18}} ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN SOA ;; ANSWER SECTION (2 records) anl.gov. 14400 IN SOA ( infoblox-gm-prod.it.anl.gov. hostmaster.anl.gov. 3000002047 ;serial 14400 ;refresh 1800 ;retry 2419200 ;expire 60 ;minimum ) anl.gov. 14400 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= ) ;; AUTHORITY SECTION (6 records) anl.gov. 14400 IN NS sdns.lbnl.net. anl.gov. 14400 IN NS adns1.es.net. anl.gov. 14400 IN NS t1dns1.anl.gov. anl.gov. 14400 IN NS adns2.es.net. anl.gov. 14400 IN NS t1dns2.anl.gov. anl.gov. 14400 IN RRSIG ( NS 8 2 14400 20260912095509 20260908093743 21313 anl.gov. Gy/WxnjPGQCPuYf+cuPdCnNMfURqPrVMOsROuBvpWsi+NEdPLiUWfmGvl0+y52w0NL1w9o0pFapT WdiWsk8q6hrScWQZaP/H/Rogyl8E5JAib0ri9zP4RIEu8WAFO0vpPM1lGLijX6Wj0e04TOEwaJRY Zf9WYyKLD3GuYJELHF4= ) ;; ADDITIONAL SECTION (8 records) t1dns1.anl.gov. 14400 IN A 130.202.101.6 t1dns2.anl.gov. 14400 IN A 130.202.101.37 t1dns1.anl.gov. 14400 IN AAAA 2620:0:dc0:180e::6 t1dns2.anl.gov. 14400 IN AAAA 2620:0:dc0:180d::37 t1dns1.anl.gov. 14400 IN RRSIG ( A 8 3 14400 20260912063801 20260908061017 21313 anl.gov. Sg2tSplwLTFWuCBEPcNPbcLNwK01PuqOWFguid3D1BTubK4Ba4A4LtY2edxC78p1ThgQvbIrMqWf MIU6N88El/Lir3H9dYUvnShakoqp5o77S5eWVEofP79oCYEGaRc2eTK83/pSMc8M0/m+LglqT2JM 1am+VXU49Ekjazxv4AA= ) t1dns1.anl.gov. 14400 IN RRSIG ( AAAA 8 3 14400 20260912054707 20260908052457 21313 anl.gov. m+f22Zfy7Rbzkgr8xodmOGv2b/pvtFAc/sGj52aH+Lxsj5KjiWK6ZmmRtuPl2MwTu62OOpRNGCaS /3tGtNIAUBa1KQGsvNoj6YP3Q7G6PgyiWuOPm3C31KzUrHihKpjtlr6Wi0WOhA05Ckwn30CLRjqQ PDesR8GNQcMBc7ZL6Zw= ) t1dns2.anl.gov. 14400 IN RRSIG ( A 8 3 14400 20260912084002 20260908082953 21313 anl.gov. Q8WE3/fKrbczHbH+dU+3ZjaHr9Z3UWuGZizSC/D33wUns1l2yy23RGu2WiGx32tOvsEX7N8DXHOg 2vmoBVpCUtE/eNWi5DS523A3El2HDimxja/yRWJg754cf5eVf8qL6UKPQ1zNRFLdfg7nA0eyB8Ha dY+nmatsEdeSv6o7G9A= ) ;; { "EDNS-VERSION": 0 }
	Query to adns2.es.net for anl.gov/SOA
	Received 1138 bytes from 192.188.22.52
	;; Response received from [192.188.22.52] 1138 octets ;; HEADER SECTION ;; id = 44889 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 6 arcount = 8 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN SOA ;; ANSWER SECTION (2 records) anl.gov. 14400 IN SOA ( infoblox-gm-prod.it.anl.gov. hostmaster.anl.gov. 3000002047 ;serial 14400 ;refresh 1800 ;retry 2419200 ;expire 60 ;minimum ) anl.gov. 14400 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= ) ;; AUTHORITY SECTION (6 records) anl.gov. 14400 IN NS t1dns2.anl.gov. anl.gov. 14400 IN NS adns1.es.net. anl.gov. 14400 IN NS sdns.lbnl.net. anl.gov. 14400 IN NS t1dns1.anl.gov. anl.gov. 14400 IN NS adns2.es.net. anl.gov. 14400 IN RRSIG ( NS 8 2 14400 20260912095509 20260908093743 21313 anl.gov. Gy/WxnjPGQCPuYf+cuPdCnNMfURqPrVMOsROuBvpWsi+NEdPLiUWfmGvl0+y52w0NL1w9o0pFapT WdiWsk8q6hrScWQZaP/H/Rogyl8E5JAib0ri9zP4RIEu8WAFO0vpPM1lGLijX6Wj0e04TOEwaJRY Zf9WYyKLD3GuYJELHF4= ) ;; ADDITIONAL SECTION (8 records) t1dns1.anl.gov. 14400 IN A 130.202.101.6 t1dns2.anl.gov. 14400 IN A 130.202.101.37 t1dns1.anl.gov. 14400 IN AAAA 2620:0:dc0:180e::6 t1dns2.anl.gov. 14400 IN AAAA 2620:0:dc0:180d::37 t1dns1.anl.gov. 14400 IN RRSIG ( A 8 3 14400 20260912063801 20260908061017 21313 anl.gov. Sg2tSplwLTFWuCBEPcNPbcLNwK01PuqOWFguid3D1BTubK4Ba4A4LtY2edxC78p1ThgQvbIrMqWf MIU6N88El/Lir3H9dYUvnShakoqp5o77S5eWVEofP79oCYEGaRc2eTK83/pSMc8M0/m+LglqT2JM 1am+VXU49Ekjazxv4AA= ) t1dns1.anl.gov. 14400 IN RRSIG ( AAAA 8 3 14400 20260912054707 20260908052457 21313 anl.gov. m+f22Zfy7Rbzkgr8xodmOGv2b/pvtFAc/sGj52aH+Lxsj5KjiWK6ZmmRtuPl2MwTu62OOpRNGCaS /3tGtNIAUBa1KQGsvNoj6YP3Q7G6PgyiWuOPm3C31KzUrHihKpjtlr6Wi0WOhA05Ckwn30CLRjqQ PDesR8GNQcMBc7ZL6Zw= ) t1dns2.anl.gov. 14400 IN RRSIG ( A 8 3 14400 20260912084002 20260908082953 21313 anl.gov. Q8WE3/fKrbczHbH+dU+3ZjaHr9Z3UWuGZizSC/D33wUns1l2yy23RGu2WiGx32tOvsEX7N8DXHOg 2vmoBVpCUtE/eNWi5DS523A3El2HDimxja/yRWJg754cf5eVf8qL6UKPQ1zNRFLdfg7nA0eyB8Ha dY+nmatsEdeSv6o7G9A= ) ;; { "EDNS-VERSION": 0 }
	Query to t1dns2.anl.gov for anl.gov/SOA
	Received 277 bytes from 130.202.101.37
	;; Response received from [130.202.101.37] 277 octets ;; HEADER SECTION ;; id = 61882 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN SOA ;; ANSWER SECTION (2 records) anl.gov. 14400 IN SOA ( infoblox-gm-prod.it.anl.gov. hostmaster.anl.gov. 3000002047 ;serial 14400 ;refresh 1800 ;retry 2419200 ;expire 60 ;minimum ) anl.gov. 14400 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to adns1.es.net for anl.gov/A
	Checking NSEC records for a NODATA response
	Found 1 RRSIGs over NSEC RRset
	`anl.gov. 60 IN RRSIG ( NSEC 8 2 60 20260912095509 20260908093743 21313 anl.gov. cqzsLZSuAueL5WZY/Dy67IxF9+Ejkjxeeb2QnPJb6tIXaVTJf4AdaYpU/QTTXRvXVCMhHvgtB2LJ TnulOXKbAFJXGhU51wazb2tyl/Mvl/H2+jgepgC1KyRKjnJw7P07yG5ejdOeUMXulwirTIwnbI6/ ADr+SZC3qJxTioPw4t8= )`
	RRSIG=21313 and DNSKEY=21313 verifies the NSEC RRset
	NSEC proves no records of type A exist for anl.gov
	Found 1 RRSIGs over SOA RRset
	`anl.gov. 60 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= )`
	RRSIG=21313 and DNSKEY=21313 verifies the SOA RRset

anl.gov

	Query to t1dns1.anl.gov for anl.gov/A
	Received 507 bytes from 130.202.101.6
	;; Response received from [130.202.101.6] 507 octets ;; HEADER SECTION ;; id = 22834 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) anl.gov. 60 IN SOA ( infoblox-gm-prod.it.anl.gov. hostmaster.anl.gov. 3000002047 ;serial 14400 ;refresh 1800 ;retry 2419200 ;expire 60 ;minimum ) anl.gov. 60 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= ) anl.gov. 60 IN NSEC ( 0ec67e8445e83f4b3e138bf12277834f.anl.gov. NS SOA MX TXT RRSIG NSEC DNSKEY ) anl.gov. 60 IN RRSIG ( NSEC 8 2 60 20260912095509 20260908093743 21313 anl.gov. cqzsLZSuAueL5WZY/Dy67IxF9+Ejkjxeeb2QnPJb6tIXaVTJf4AdaYpU/QTTXRvXVCMhHvgtB2LJ TnulOXKbAFJXGhU51wazb2tyl/Mvl/H2+jgepgC1KyRKjnJw7P07yG5ejdOeUMXulwirTIwnbI6/ ADr+SZC3qJxTioPw4t8= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	t1dns1.anl.gov is authoritative for anl.gov
	Found RRSIG signed by anl.gov zone
	Query to t1dns1.anl.gov for anl.gov/A
	Checking NSEC records for a NODATA response
	Found 1 RRSIGs over NSEC RRset
	`anl.gov. 60 IN RRSIG ( NSEC 8 2 60 20260912095509 20260908093743 21313 anl.gov. cqzsLZSuAueL5WZY/Dy67IxF9+Ejkjxeeb2QnPJb6tIXaVTJf4AdaYpU/QTTXRvXVCMhHvgtB2LJ TnulOXKbAFJXGhU51wazb2tyl/Mvl/H2+jgepgC1KyRKjnJw7P07yG5ejdOeUMXulwirTIwnbI6/ ADr+SZC3qJxTioPw4t8= )`
	RRSIG=21313 and DNSKEY=21313 verifies the NSEC RRset
	NSEC proves no records of type A exist for anl.gov
	Found 1 RRSIGs over SOA RRset
	`anl.gov. 60 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= )`
	RRSIG=21313 and DNSKEY=21313 verifies the SOA RRset

anl.gov

	Query to t1dns2.anl.gov for anl.gov/A
	Received 507 bytes from 130.202.101.37
	;; Response received from [130.202.101.37] 507 octets ;; HEADER SECTION ;; id = 3930 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) anl.gov. 60 IN SOA ( infoblox-gm-prod.it.anl.gov. hostmaster.anl.gov. 3000002047 ;serial 14400 ;refresh 1800 ;retry 2419200 ;expire 60 ;minimum ) anl.gov. 60 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= ) anl.gov. 60 IN NSEC ( 0ec67e8445e83f4b3e138bf12277834f.anl.gov. NS SOA MX TXT RRSIG NSEC DNSKEY ) anl.gov. 60 IN RRSIG ( NSEC 8 2 60 20260912095509 20260908093743 21313 anl.gov. cqzsLZSuAueL5WZY/Dy67IxF9+Ejkjxeeb2QnPJb6tIXaVTJf4AdaYpU/QTTXRvXVCMhHvgtB2LJ TnulOXKbAFJXGhU51wazb2tyl/Mvl/H2+jgepgC1KyRKjnJw7P07yG5ejdOeUMXulwirTIwnbI6/ ADr+SZC3qJxTioPw4t8= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	t1dns2.anl.gov is authoritative for anl.gov
	Found RRSIG signed by anl.gov zone
	Query to t1dns2.anl.gov for anl.gov/A
	Checking NSEC records for a NODATA response
	Found 1 RRSIGs over NSEC RRset
	`anl.gov. 60 IN RRSIG ( NSEC 8 2 60 20260912095509 20260908093743 21313 anl.gov. cqzsLZSuAueL5WZY/Dy67IxF9+Ejkjxeeb2QnPJb6tIXaVTJf4AdaYpU/QTTXRvXVCMhHvgtB2LJ TnulOXKbAFJXGhU51wazb2tyl/Mvl/H2+jgepgC1KyRKjnJw7P07yG5ejdOeUMXulwirTIwnbI6/ ADr+SZC3qJxTioPw4t8= )`
	RRSIG=21313 and DNSKEY=21313 verifies the NSEC RRset
	NSEC proves no records of type A exist for anl.gov
	Found 1 RRSIGs over SOA RRset
	`anl.gov. 60 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= )`
	RRSIG=21313 and DNSKEY=21313 verifies the SOA RRset

anl.gov

	Query to sdns.lbnl.net for anl.gov/A
	Received 500 bytes from 131.243.5.53
	;; Response received from [131.243.5.53] 500 octets ;; HEADER SECTION ;; id = 7711 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) anl.gov. 60 IN SOA ( infoblox-gm-prod.it.anl.gov. hostmaster.anl.gov. 3000002047 ;serial 14400 ;refresh 1800 ;retry 2419200 ;expire 60 ;minimum ) anl.gov. 60 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= ) anl.gov. 60 IN NSEC ( 0ec67e8445e83f4b3e138bf12277834f.anl.gov. NS SOA MX TXT RRSIG NSEC DNSKEY ) anl.gov. 60 IN RRSIG ( NSEC 8 2 60 20260912095509 20260908093743 21313 anl.gov. cqzsLZSuAueL5WZY/Dy67IxF9+Ejkjxeeb2QnPJb6tIXaVTJf4AdaYpU/QTTXRvXVCMhHvgtB2LJ TnulOXKbAFJXGhU51wazb2tyl/Mvl/H2+jgepgC1KyRKjnJw7P07yG5ejdOeUMXulwirTIwnbI6/ ADr+SZC3qJxTioPw4t8= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	sdns.lbnl.net is authoritative for anl.gov
	Found RRSIG signed by anl.gov zone
	Query to sdns.lbnl.net for anl.gov/A
	Checking NSEC records for a NODATA response
	Found 1 RRSIGs over NSEC RRset
	`anl.gov. 60 IN RRSIG ( NSEC 8 2 60 20260912095509 20260908093743 21313 anl.gov. cqzsLZSuAueL5WZY/Dy67IxF9+Ejkjxeeb2QnPJb6tIXaVTJf4AdaYpU/QTTXRvXVCMhHvgtB2LJ TnulOXKbAFJXGhU51wazb2tyl/Mvl/H2+jgepgC1KyRKjnJw7P07yG5ejdOeUMXulwirTIwnbI6/ ADr+SZC3qJxTioPw4t8= )`
	RRSIG=21313 and DNSKEY=21313 verifies the NSEC RRset
	NSEC proves no records of type A exist for anl.gov
	Found 1 RRSIGs over SOA RRset
	`anl.gov. 60 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= )`
	RRSIG=21313 and DNSKEY=21313 verifies the SOA RRset

anl.gov

	Query to adns2.es.net for anl.gov/A
	Received 500 bytes from 192.188.22.52
	;; Response received from [192.188.22.52] 500 octets ;; HEADER SECTION ;; id = 37520 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; anl.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) anl.gov. 60 IN SOA ( infoblox-gm-prod.it.anl.gov. hostmaster.anl.gov. 3000002047 ;serial 14400 ;refresh 1800 ;retry 2419200 ;expire 60 ;minimum ) anl.gov. 60 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= ) anl.gov. 60 IN NSEC ( 0ec67e8445e83f4b3e138bf12277834f.anl.gov. NS SOA MX TXT RRSIG NSEC DNSKEY ) anl.gov. 60 IN RRSIG ( NSEC 8 2 60 20260912095509 20260908093743 21313 anl.gov. cqzsLZSuAueL5WZY/Dy67IxF9+Ejkjxeeb2QnPJb6tIXaVTJf4AdaYpU/QTTXRvXVCMhHvgtB2LJ TnulOXKbAFJXGhU51wazb2tyl/Mvl/H2+jgepgC1KyRKjnJw7P07yG5ejdOeUMXulwirTIwnbI6/ ADr+SZC3qJxTioPw4t8= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	adns2.es.net is authoritative for anl.gov
	Found RRSIG signed by anl.gov zone
	Query to adns2.es.net for anl.gov/A
	Checking NSEC records for a NODATA response
	Found 1 RRSIGs over NSEC RRset
	`anl.gov. 60 IN RRSIG ( NSEC 8 2 60 20260912095509 20260908093743 21313 anl.gov. cqzsLZSuAueL5WZY/Dy67IxF9+Ejkjxeeb2QnPJb6tIXaVTJf4AdaYpU/QTTXRvXVCMhHvgtB2LJ TnulOXKbAFJXGhU51wazb2tyl/Mvl/H2+jgepgC1KyRKjnJw7P07yG5ejdOeUMXulwirTIwnbI6/ ADr+SZC3qJxTioPw4t8= )`
	RRSIG=21313 and DNSKEY=21313 verifies the NSEC RRset
	NSEC proves no records of type A exist for anl.gov
	Found 1 RRSIGs over SOA RRset
	`anl.gov. 60 IN RRSIG ( SOA 8 2 14400 20260912125839 20260908115839 21313 anl.gov. RevKe/KnoxbsrHZu78LFe/6C+MOe93fZwL9nW5J+kSqpVissFnUdgMrnb7hMNjPta8mVKpEzIWXO gWU7CWsNpAr5c+eeg86rOTKcLWnhTOqo+Y5WuJqkryA2nSV12xaj5+gbxLDYyCOwirVYYuAMCCfC AbjaBjoksOYrIZcYwcw= )`
	RRSIG=21313 and DNSKEY=21313 verifies the SOA RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test anl.gov at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: