DNSSEC Debugger - auth.acme-dns.io

Domain Name:

Time: 2025-07-10 14:47:59 UTC

Analyzing DNSSEC problems for auth.acme-dns.io

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to l.root-servers.net for ./DNSKEY
	Received 1414 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 1414 octets ;; HEADER SECTION ;; id = 63742 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 5 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (5 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAbEbGCpGTDrcZTWqWWE72nphyshpRcILdzCVlBGU9Ln1Fui9kkseUOP+g5GLUeVFKdTloeRT A9+EYiQdXgWXmXmuW/nGxZjAikluF/O9NzLVrr5iZnth2xu+F48nrJlAgWWiMNau54NI5sZ3iVQf hFsq2pZmf43RauRPniYMShOLO7EBWWXr5glDSgZGS9fSm6xHwwF+g8D4m8oanjvdCBNxXzSEKS31 ibxjLifTfvwCg3y4XXcNW9U6Nu3JmoKUdxqpPPIkBvVQbIz4UO2FwaR13uXC03ALP1Yx2QNSS4SZ lcIMtAftQR9wtCiuPWQnFv4jkzWqlhp1Lmf7bcoL9yk= ) ; keytag 53148 . 172800 IN DNSKEY ( 256 3 8 AwEAAbauxLSFZ+KSWi2cT6TJbm3d+GIVqb2N1XnDjMsRme0b6JlGp/cvwmM5CaJ5LQ7tG1r7LuTH jYZadtbNk2nZmclq9r4KInS48ungoAZb0gJXVw8IvBTBb1YWQmiBqD285pJuORwTii7DF++nNJJk 3i55HJt9SmBI7m7t8nvx7OOY/w0inxg3fLH2uY0SKO8he4FGwMc4Ubiab8N8Yhyhh+FkKKdD/+oA cuGF75PjlSXO460B4MlNLlEcjDEzIsKauRYx4YVgSaNomGhMMFblmXRzgW+1R6ywvm5mC9+omlyy izZp2GJfPwGMezuKSGDndO6CYYEc5/lsRhvBYsGjdPM= ) ; keytag 46441 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20250722000000 20250701000000 20326 . UGhOn2e0xbV2um4IqDwLtkXZVqk32Dz6Orahd8l3n5pQxAPO+PzC96lwt3YdDLFpzmu1FqPWugCK eq5uju1L2DklkEX7hnvBKKzb/Q2dkEA1w85dQQH34II778mePR3fvIDckntFXGsT9a8tdN9tFaP+ qJiwgtNbiKej8YheeX/DAAmZPn0s6/Bg3cLuozR9FXAwkgrA3rjcRpN/jKhPSauHvsin7gCbcUjs jA+P3l9y4Izc5ibPfdUIxVaTUt+OofHUV9VaZoexMQKwggIE78BLAs7AsP7KwlXDB8++Cy6IXVcg +9Gzv3k/gJokM3UHOGa0UrSfCIAKlfMFYADJBA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 4 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbEbGCpGTDrcZTWqWWE72nphyshpRcILdzCVlBGU9Ln1Fui9kkseUOP+g5GLUeVFKdTloeRT A9+EYiQdXgWXmXmuW/nGxZjAikluF/O9NzLVrr5iZnth2xu+F48nrJlAgWWiMNau54NI5sZ3iVQf hFsq2pZmf43RauRPniYMShOLO7EBWWXr5glDSgZGS9fSm6xHwwF+g8D4m8oanjvdCBNxXzSEKS31 ibxjLifTfvwCg3y4XXcNW9U6Nu3JmoKUdxqpPPIkBvVQbIz4UO2FwaR13uXC03ALP1Yx2QNSS4SZ lcIMtAftQR9wtCiuPWQnFv4jkzWqlhp1Lmf7bcoL9yk= ) ; keytag 53148`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbauxLSFZ+KSWi2cT6TJbm3d+GIVqb2N1XnDjMsRme0b6JlGp/cvwmM5CaJ5LQ7tG1r7LuTH jYZadtbNk2nZmclq9r4KInS48ungoAZb0gJXVw8IvBTBb1YWQmiBqD285pJuORwTii7DF++nNJJk 3i55HJt9SmBI7m7t8nvx7OOY/w0inxg3fLH2uY0SKO8he4FGwMc4Ubiab8N8Yhyhh+FkKKdD/+oA cuGF75PjlSXO460B4MlNLlEcjDEzIsKauRYx4YVgSaNomGhMMFblmXRzgW+1R6ywvm5mC9+omlyy izZp2GJfPwGMezuKSGDndO6CYYEc5/lsRhvBYsGjdPM= ) ; keytag 46441`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20250722000000 20250701000000 20326 . UGhOn2e0xbV2um4IqDwLtkXZVqk32Dz6Orahd8l3n5pQxAPO+PzC96lwt3YdDLFpzmu1FqPWugCK eq5uju1L2DklkEX7hnvBKKzb/Q2dkEA1w85dQQH34II778mePR3fvIDckntFXGsT9a8tdN9tFaP+ qJiwgtNbiKej8YheeX/DAAmZPn0s6/Bg3cLuozR9FXAwkgrA3rjcRpN/jKhPSauHvsin7gCbcUjs jA+P3l9y4Izc5ibPfdUIxVaTUt+OofHUV9VaZoexMQKwggIE78BLAs7AsP7KwlXDB8++Cy6IXVcg +9Gzv3k/gJokM3UHOGa0UrSfCIAKlfMFYADJBA== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=53148 is now in the chain-of-trust
	DNSKEY=46441 is now in the chain-of-trust
	DNSKEY=38696/SEP is now in the chain-of-trust
	Query to h.root-servers.net for auth.acme-dns.io/A
	Received 628 bytes from 198.97.190.53
	;; Response received from [198.97.190.53] 628 octets ;; HEADER SECTION ;; id = 20504 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; auth.acme-dns.io. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) io. 172800 IN NS a0.nic.io. io. 172800 IN NS a2.nic.io. io. 172800 IN NS b0.nic.io. io. 172800 IN NS c0.nic.io. io. 86400 IN DS ( 57355 8 2 95a57c3bab7849dbcddf7c72ada71a88146b141110318ca5be672057e865c3e2 ) io. 86400 IN RRSIG ( DS 8 1 86400 20250723050000 20250710040000 46441 . ewCFcibGnDaxQu3cXKUFZgBBTljhoUXecG5lL960IxPD2oXv42mK+YHQuYz7iYYpLT1xsHvVGxnH 8yhNTazZgMUcctVeXHBuYzmLEZCrPDjLL5jIjFT+xmmnl58YP/ii1UFyFW1ZlTJ1RGxZKbcRehGM s7387VSScPfHCTdO1M+pOC4HgMMNrGY1TYL2TxLTt8skHPFYC8f5Dsq/2/7f/drKUh3UHV884fg6 fKsndmPY2QDxfiL2dTUUhyR3Oqks4k0u3vrpP2xW+ve5VLQEfiPN2+F+zAyeGq4NrZyZgK+7HZz/ kKmaFqi6z0oF5cG37edJ3IdGfwQycOBMHKbYjg== ) ;; ADDITIONAL SECTION (9 records) a0.nic.io. 172800 IN A 65.22.160.17 a2.nic.io. 172800 IN A 65.22.163.17 b0.nic.io. 172800 IN A 65.22.161.17 c0.nic.io. 172800 IN A 65.22.162.17 a0.nic.io. 172800 IN AAAA 2a01:8840:9e::17 a2.nic.io. 172800 IN AAAA 2a01:8840:a1::17 b0.nic.io. 172800 IN AAAA 2a01:8840:9f::17 c0.nic.io. 172800 IN AAAA 2a01:8840:a0::17 ;; { "EDNS-VERSION": 0 }
	Query to l.root-servers.net for io/DNSKEY
	Received 614 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 614 octets ;; HEADER SECTION ;; id = 60375 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; io. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) io. 172800 IN NS a0.nic.io. io. 172800 IN NS a2.nic.io. io. 172800 IN NS b0.nic.io. io. 172800 IN NS c0.nic.io. io. 86400 IN DS ( 57355 8 2 95a57c3bab7849dbcddf7c72ada71a88146b141110318ca5be672057e865c3e2 ) io. 86400 IN RRSIG ( DS 8 1 86400 20250723050000 20250710040000 46441 . ewCFcibGnDaxQu3cXKUFZgBBTljhoUXecG5lL960IxPD2oXv42mK+YHQuYz7iYYpLT1xsHvVGxnH 8yhNTazZgMUcctVeXHBuYzmLEZCrPDjLL5jIjFT+xmmnl58YP/ii1UFyFW1ZlTJ1RGxZKbcRehGM s7387VSScPfHCTdO1M+pOC4HgMMNrGY1TYL2TxLTt8skHPFYC8f5Dsq/2/7f/drKUh3UHV884fg6 fKsndmPY2QDxfiL2dTUUhyR3Oqks4k0u3vrpP2xW+ve5VLQEfiPN2+F+zAyeGq4NrZyZgK+7HZz/ kKmaFqi6z0oF5cG37edJ3IdGfwQycOBMHKbYjg== ) ;; ADDITIONAL SECTION (9 records) a0.nic.io. 172800 IN A 65.22.160.17 a2.nic.io. 172800 IN A 65.22.163.17 b0.nic.io. 172800 IN A 65.22.161.17 c0.nic.io. 172800 IN A 65.22.162.17 a0.nic.io. 172800 IN AAAA 2a01:8840:9e::17 a2.nic.io. 172800 IN AAAA 2a01:8840:a1::17 b0.nic.io. 172800 IN AAAA 2a01:8840:9f::17 c0.nic.io. 172800 IN AAAA 2a01:8840:a0::17 ;; { "EDNS-VERSION": 0 }
	Found child zone io

	Checking DS between . and io
	Query to l.root-servers.net for io/DS
	Received 366 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 366 octets ;; HEADER SECTION ;; id = 37469 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; io. IN DS ;; ANSWER SECTION (2 records) io. 86400 IN DS ( 57355 8 2 95a57c3bab7849dbcddf7c72ada71a88146b141110318ca5be672057e865c3e2 ) io. 86400 IN RRSIG ( DS 8 1 86400 20250723050000 20250710040000 46441 . ewCFcibGnDaxQu3cXKUFZgBBTljhoUXecG5lL960IxPD2oXv42mK+YHQuYz7iYYpLT1xsHvVGxnH 8yhNTazZgMUcctVeXHBuYzmLEZCrPDjLL5jIjFT+xmmnl58YP/ii1UFyFW1ZlTJ1RGxZKbcRehGM s7387VSScPfHCTdO1M+pOC4HgMMNrGY1TYL2TxLTt8skHPFYC8f5Dsq/2/7f/drKUh3UHV884fg6 fKsndmPY2QDxfiL2dTUUhyR3Oqks4k0u3vrpP2xW+ve5VLQEfiPN2+F+zAyeGq4NrZyZgK+7HZz/ kKmaFqi6z0oF5cG37edJ3IdGfwQycOBMHKbYjg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for io in the . zone
	DS=57355/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`io. 86400 IN RRSIG ( DS 8 1 86400 20250723050000 20250710040000 46441 . ewCFcibGnDaxQu3cXKUFZgBBTljhoUXecG5lL960IxPD2oXv42mK+YHQuYz7iYYpLT1xsHvVGxnH 8yhNTazZgMUcctVeXHBuYzmLEZCrPDjLL5jIjFT+xmmnl58YP/ii1UFyFW1ZlTJ1RGxZKbcRehGM s7387VSScPfHCTdO1M+pOC4HgMMNrGY1TYL2TxLTt8skHPFYC8f5Dsq/2/7f/drKUh3UHV884fg6 fKsndmPY2QDxfiL2dTUUhyR3Oqks4k0u3vrpP2xW+ve5VLQEfiPN2+F+zAyeGq4NrZyZgK+7HZz/ kKmaFqi6z0oF5cG37edJ3IdGfwQycOBMHKbYjg== )`
	RRSIG=46441 and DNSKEY=46441 verifies the DS RRset
	DS=57355/SHA-256 is now in the chain-of-trust
	`io. 86400 IN DS ( 57355 8 2 95a57c3bab7849dbcddf7c72ada71a88146b141110318ca5be672057e865c3e2 )`
	Query to a0.nic.io for io/DNSKEY
	Received 893 bytes from 65.22.160.17
	;; Response received from [65.22.160.17] 893 octets ;; HEADER SECTION ;; id = 24645 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; io. IN DNSKEY ;; ANSWER SECTION (4 records) io. 3600 IN DNSKEY ( 257 3 8 AwEAAdgV7ipvizPjJNDZ1O5Ea7hmp+qelixmzCqWbwPH00VOKvlEcWfM/PKGLt+Phj9jVJqDytWI m7Ff7+fUaRMPzMuUW2Z7ViLitxH4iNtKtwU+DMzdGpzRMXFAF1WdbxCF5lWoK0MHsIR5oD9Vkwop kttyGnKjYhTDNObYHg8Mi5E9j0FjU4OEpKw6NbZduVKp2pRBBejm/8WKq0O1PukchMa6TQIJlYNs JZNzD1QLcKZWEup+fTvqzAWiK2Su6rlDC7rgwe6OjhrT2ejqlORp3h5S4WJGi3haUczvA/O5GYjh GmXxp5CJ01RJSYG0BsbY1tpEX+9Y4+GhS/nf8Qo0iDc= ) ; keytag 57355 io. 3600 IN DNSKEY ( 256 3 8 AwEAAb2C/MtmUiB7YBr2aULPH6oh6gNzusglXDY/diB1eUhTzF23P1yTV7W++bfUzdr+FIJ9f1cR 93Egb6PinXSp6XpF3ozaWIDdlC4g7E1wNGRwpqbX3TR1feB/u9v3yL9IloqJf378L+pt/8uo4xcq gZPPObZYbPEob8uddSjh3znP ) ; keytag 24585 io. 3600 IN DNSKEY ( 256 3 8 AwEAAbgHVrMgWgwEUyH+zY3whLzPfoGmMQLm2dhDNAk1e/mFw14VjL/28D9w1OOm38PmlzW1Tvzb xVD3ZX0OfSROWH0AmahhMvp68PShFyukHl/8+pQ0wlARCD7aWiepY+IwJR5IyylF/T2mp9QQWrSn Un1poBG7EmuNMVvqkZ8/CQph ) ; keytag 37905 io. 3600 IN RRSIG ( DNSKEY 8 1 3600 20250730152114 20250709142114 57355 io. kXwGUj70vWIHPQf3ypTuqlsSR587IbQqATU416+tyLoDz8Ns6e57tOmrY8jx+ECjoTHhr/GpMokx kdKET6WcUIeS9zjB2cr7EDvYX3gkc/wdcNnuKiD6n0ph1xfU7yf/jiDGuvlCrsxbCHJD5VHigwmn bFbtmao06lc0P35i/0t97drI0Wpjx4F+K6q6CKDASOUZ5RV5Rtm1cEHls4mcJb0R1XNCbx5mziCa jjNFmIS3uohWg46GGfYbVFI0uvxhl4m2MI1zdG+U0748XcbaR4k0o0xcDWYJ8E0MxGVoMT0WbD3x 3StZIu6/YwYAtYqmVHZce66e0OryrtEHtbplWA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for io
	`io. 3600 IN DNSKEY ( 257 3 8 AwEAAdgV7ipvizPjJNDZ1O5Ea7hmp+qelixmzCqWbwPH00VOKvlEcWfM/PKGLt+Phj9jVJqDytWI m7Ff7+fUaRMPzMuUW2Z7ViLitxH4iNtKtwU+DMzdGpzRMXFAF1WdbxCF5lWoK0MHsIR5oD9Vkwop kttyGnKjYhTDNObYHg8Mi5E9j0FjU4OEpKw6NbZduVKp2pRBBejm/8WKq0O1PukchMa6TQIJlYNs JZNzD1QLcKZWEup+fTvqzAWiK2Su6rlDC7rgwe6OjhrT2ejqlORp3h5S4WJGi3haUczvA/O5GYjh GmXxp5CJ01RJSYG0BsbY1tpEX+9Y4+GhS/nf8Qo0iDc= ) ; keytag 57355`
	`io. 3600 IN DNSKEY ( 256 3 8 AwEAAb2C/MtmUiB7YBr2aULPH6oh6gNzusglXDY/diB1eUhTzF23P1yTV7W++bfUzdr+FIJ9f1cR 93Egb6PinXSp6XpF3ozaWIDdlC4g7E1wNGRwpqbX3TR1feB/u9v3yL9IloqJf378L+pt/8uo4xcq gZPPObZYbPEob8uddSjh3znP ) ; keytag 24585`
	`io. 3600 IN DNSKEY ( 256 3 8 AwEAAbgHVrMgWgwEUyH+zY3whLzPfoGmMQLm2dhDNAk1e/mFw14VjL/28D9w1OOm38PmlzW1Tvzb xVD3ZX0OfSROWH0AmahhMvp68PShFyukHl/8+pQ0wlARCD7aWiepY+IwJR5IyylF/T2mp9QQWrSn Un1poBG7EmuNMVvqkZ8/CQph ) ; keytag 37905`
	DNSKEY=57355/SEP is now in the chain-of-trust
	DS=57355/SHA-256 verifies DNSKEY=57355/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`io. 3600 IN RRSIG ( DNSKEY 8 1 3600 20250730152114 20250709142114 57355 io. kXwGUj70vWIHPQf3ypTuqlsSR587IbQqATU416+tyLoDz8Ns6e57tOmrY8jx+ECjoTHhr/GpMokx kdKET6WcUIeS9zjB2cr7EDvYX3gkc/wdcNnuKiD6n0ph1xfU7yf/jiDGuvlCrsxbCHJD5VHigwmn bFbtmao06lc0P35i/0t97drI0Wpjx4F+K6q6CKDASOUZ5RV5Rtm1cEHls4mcJb0R1XNCbx5mziCa jjNFmIS3uohWg46GGfYbVFI0uvxhl4m2MI1zdG+U0748XcbaR4k0o0xcDWYJ8E0MxGVoMT0WbD3x 3StZIu6/YwYAtYqmVHZce66e0OryrtEHtbplWA== )`
	RRSIG=57355 and DNSKEY=57355/SEP verifies the DNSKEY RRset
	DNSKEY=24585 is now in the chain-of-trust
	DNSKEY=37905 is now in the chain-of-trust
	Query to a2.nic.io for auth.acme-dns.io/A
	Received 588 bytes from 65.22.163.17
	;; Response received from [65.22.163.17] 588 octets ;; HEADER SECTION ;; id = 64961 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; auth.acme-dns.io. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) acme-dns.io. 3600 IN NS pablo.ns.cloudflare.com. acme-dns.io. 3600 IN NS bonnie.ns.cloudflare.com. 52ko96budrr3nmfkc8cbka2vfqnm5jps.io. 3600 IN NSEC3 ( 1 1 0 73 52mc76vr67ipbdc6vbipgb6r99835hcr NS SOA RRSIG DNSKEY NSEC3PARAM ) oefie4maqdrpuiu1d3irptn66u41dooa.io. 3600 IN NSEC3 ( 1 1 0 73 oefngrokos1v035lfj991n8oqjg6mvv9 NS DS RRSIG ) 52ko96budrr3nmfkc8cbka2vfqnm5jps.io. 3600 IN RRSIG ( NSEC3 8 2 3600 20250731144036 20250710134036 37905 io. LqVbvJn8JHXTjumuofhdXZHHs9X+u382LNLMamOZXymAM9ck866xZTanmObN52SA0b2WTKm1COQS czg1SLlTrYXK3RLUiJkQDgQ3F7MFjHB/Alw6iHFoIpVmzzGYXFMNBmjA+8vkoE/dLXZ5HTc6/Cp2 x51kNdbZeocfp53Me6Y= ) oefie4maqdrpuiu1d3irptn66u41dooa.io. 3600 IN RRSIG ( NSEC3 8 2 3600 20250730152114 20250709142114 37905 io. tDYtzlsLgm0+u7I7YhajT+/1GQnIHupBiPkdfTRM83FbQkpm7igmbIhkLFlcK1XoDqXOP6Un/q1q XbcejPd2qZu5I3Ym94pByB7WGiCAFuBCg948i3FrN+QhfWSs5jzGOPY9/3dcLichsxdG6jdoby9p uVi7XVtbhTZyHPFQxGs= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a0.nic.io for acme-dns.io/DNSKEY
	Received 583 bytes from 65.22.160.17
	;; Response received from [65.22.160.17] 583 octets ;; HEADER SECTION ;; id = 35961 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; acme-dns.io. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) acme-dns.io. 3600 IN NS bonnie.ns.cloudflare.com. acme-dns.io. 3600 IN NS pablo.ns.cloudflare.com. 52ko96budrr3nmfkc8cbka2vfqnm5jps.io. 3600 IN NSEC3 ( 1 1 0 73 52mc76vr67ipbdc6vbipgb6r99835hcr NS SOA RRSIG DNSKEY NSEC3PARAM ) 52ko96budrr3nmfkc8cbka2vfqnm5jps.io. 3600 IN RRSIG ( NSEC3 8 2 3600 20250731144036 20250710134036 37905 io. LqVbvJn8JHXTjumuofhdXZHHs9X+u382LNLMamOZXymAM9ck866xZTanmObN52SA0b2WTKm1COQS czg1SLlTrYXK3RLUiJkQDgQ3F7MFjHB/Alw6iHFoIpVmzzGYXFMNBmjA+8vkoE/dLXZ5HTc6/Cp2 x51kNdbZeocfp53Me6Y= ) oefie4maqdrpuiu1d3irptn66u41dooa.io. 3600 IN NSEC3 ( 1 1 0 73 oefngrokos1v035lfj991n8oqjg6mvv9 NS DS RRSIG ) oefie4maqdrpuiu1d3irptn66u41dooa.io. 3600 IN RRSIG ( NSEC3 8 2 3600 20250730152114 20250709142114 37905 io. tDYtzlsLgm0+u7I7YhajT+/1GQnIHupBiPkdfTRM83FbQkpm7igmbIhkLFlcK1XoDqXOP6Un/q1q XbcejPd2qZu5I3Ym94pByB7WGiCAFuBCg948i3FrN+QhfWSs5jzGOPY9/3dcLichsxdG6jdoby9p uVi7XVtbhTZyHPFQxGs= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone acme-dns.io

acme-dns.io

	Checking DS between io and acme-dns.io
	Query to a0.nic.io for acme-dns.io/DS
	Received 753 bytes from 65.22.160.17
	;; Response received from [65.22.160.17] 753 octets ;; HEADER SECTION ;; id = 39227 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; acme-dns.io. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) 52ko96budrr3nmfkc8cbka2vfqnm5jps.io. 3600 IN NSEC3 ( 1 1 0 73 52mc76vr67ipbdc6vbipgb6r99835hcr NS SOA RRSIG DNSKEY NSEC3PARAM ) 52ko96budrr3nmfkc8cbka2vfqnm5jps.io. 3600 IN RRSIG ( NSEC3 8 2 3600 20250731144036 20250710134036 37905 io. LqVbvJn8JHXTjumuofhdXZHHs9X+u382LNLMamOZXymAM9ck866xZTanmObN52SA0b2WTKm1COQS czg1SLlTrYXK3RLUiJkQDgQ3F7MFjHB/Alw6iHFoIpVmzzGYXFMNBmjA+8vkoE/dLXZ5HTc6/Cp2 x51kNdbZeocfp53Me6Y= ) io. 3600 IN SOA ( a0.nic.io. hostmaster.donuts.email. 1752158278 ;serial 7200 ;refresh 900 ;retry 1209600 ;expire 3600 ;minimum ) io. 3600 IN RRSIG ( SOA 8 1 3600 20250731144036 20250710134036 37905 io. j2BXEnbBZD726xF9PtU1AAtqoTDfDoa+PzdsxN3o4wN8mVhosHBUOxM+cmGqvToAH4WbFRKSDVpZ 8X8oYPLbk7YmKy0rl6gi4c3DR9N+fgguDwpHumyaCfMHoSBi3HxhBetVzKnC2m1dA7FsuCNU/ZnQ s0k1fIDvXPUYl7i3mhg= ) oefie4maqdrpuiu1d3irptn66u41dooa.io. 3600 IN NSEC3 ( 1 1 0 73 oefngrokos1v035lfj991n8oqjg6mvv9 NS DS RRSIG ) oefie4maqdrpuiu1d3irptn66u41dooa.io. 3600 IN RRSIG ( NSEC3 8 2 3600 20250730152114 20250709142114 37905 io. tDYtzlsLgm0+u7I7YhajT+/1GQnIHupBiPkdfTRM83FbQkpm7igmbIhkLFlcK1XoDqXOP6Un/q1q XbcejPd2qZu5I3Ym94pByB7WGiCAFuBCg948i3FrN+QhfWSs5jzGOPY9/3dcLichsxdG6jdoby9p uVi7XVtbhTZyHPFQxGs= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DS records found for acme-dns.io in the io zone
	Query to bonnie.ns.cloudflare.com for acme-dns.io/DNSKEY
	Received 104 bytes from 108.162.192.76
	;; Response received from [108.162.192.76] 104 octets ;; HEADER SECTION ;; id = 11725 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 1 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; acme-dns.io. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) acme-dns.io. 1800 IN SOA ( bonnie.ns.cloudflare.com. dns.cloudflare.com. 2377066667 ;serial 10000 ;refresh 2400 ;retry 604800 ;expire 1800 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DNSKEY records found
	Query to pablo.ns.cloudflare.com for auth.acme-dns.io/A
	Received 78 bytes from 108.162.193.220
	;; Response received from [108.162.193.220] 78 octets ;; HEADER SECTION ;; id = 552 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 1 arcount = 2 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; auth.acme-dns.io. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) auth.acme-dns.io. 300 IN NS ns.auth.acme-dns.io. ;; ADDITIONAL SECTION (2 records) ns.auth.acme-dns.io. 300 IN A 49.12.60.200 ;; { "EDNS-VERSION": 0 }
	Query to pablo.ns.cloudflare.com for auth.acme-dns.io/DNSKEY
	Received 109 bytes from 172.64.33.220
	;; Response received from [172.64.33.220] 109 octets ;; HEADER SECTION ;; id = 16843 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 1 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; auth.acme-dns.io. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) acme-dns.io. 1800 IN SOA ( bonnie.ns.cloudflare.com. dns.cloudflare.com. 2377066667 ;serial 10000 ;refresh 2400 ;retry 604800 ;expire 1800 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	acme-dns.io refers to auth.acme-dns.io for auth.acme-dns.io
	No DS records found for auth.acme-dns.io in the referral

auth.acme-dns.io

	Checking DS between acme-dns.io and auth.acme-dns.io
	Query to bonnie.ns.cloudflare.com for auth.acme-dns.io/DS
	Received 109 bytes from 172.64.32.76
	;; Response received from [172.64.32.76] 109 octets ;; HEADER SECTION ;; id = 63503 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 1 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; auth.acme-dns.io. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) acme-dns.io. 1800 IN SOA ( bonnie.ns.cloudflare.com. dns.cloudflare.com. 2377066667 ;serial 10000 ;refresh 2400 ;retry 604800 ;expire 1800 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DS records found for auth.acme-dns.io in the acme-dns.io zone
	Query to ns.auth.acme-dns.io for auth.acme-dns.io/DNSKEY
	Received 34 bytes from 49.12.60.200
	;; Response received from [49.12.60.200] 34 octets ;; HEADER SECTION ;; id = 33069 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 0 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 0 arcount = 0 ;; QUESTION SECTION (1 record) ;; auth.acme-dns.io. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (0 records)
	No DNSKEY records found
	Query to ns.auth.acme-dns.io for auth.acme-dns.io/A
	Received 66 bytes from 49.12.60.200
	;; Response received from [49.12.60.200] 66 octets ;; HEADER SECTION ;; id = 231 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 0 co = 0 ;; qdcount = 1 ancount = 1 ;; nscount = 0 arcount = 0 ;; QUESTION SECTION (1 record) ;; auth.acme-dns.io. IN A ;; ANSWER SECTION (1 record) auth.acme-dns.io. 3600 IN A 49.12.60.200 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (0 records)
	ns.auth.acme-dns.io is authoritative for auth.acme-dns.io
	Query to ns.auth.acme-dns.io for auth.acme-dns.io/A
	Received 66 bytes from 49.12.60.200
	;; Response received from [49.12.60.200] 66 octets ;; HEADER SECTION ;; id = 47873 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 0 co = 0 ;; qdcount = 1 ancount = 1 ;; nscount = 0 arcount = 0 ;; QUESTION SECTION (1 record) ;; auth.acme-dns.io. IN A ;; ANSWER SECTION (1 record) auth.acme-dns.io. 3600 IN A 49.12.60.200 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (0 records)
	auth.acme-dns.io A RR has value 49.12.60.200
	No RRSIGs found

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test auth.acme-dns.io at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: