DNSSEC Debugger - belfius.be

Domain Name:

Time: 2026-03-15 18:02:53 UTC

Analyzing DNSSEC problems for belfius.be

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to b.root-servers.net for ./DNSKEY
	Received 1139 bytes from 170.247.170.2
	;; Response received from [170.247.170.2] 1139 octets ;; HEADER SECTION ;; id = 43652 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAbNTVC2+pry4pc37pZI9Oj6b8FHxT3VGrvSPKLE1Tjyfe2kUZUtVX5xrv6AV4BVO+ygrYjGZ MNgEnbLU4zknnlnhI2e0g6iTza1aZh0dRZXGH16C1NUNq1CxBkUhIYQhQDeIOtLacx+RmFTc+hSH JJ2MJ79IS00kA7eKi6mofQ7SPJmdJVjI+JAx791y0f5QaB+iHGANU53FwiYXNUQjfAzCrtOaSevG sx8SO8BTaXLAjFq5eewOtwScVwfVDhEXlvpE6e+mIncwhNKaMRD9IPuHENqCNPI5MjxfAMVS6cEY 8eEozIkv/vHc+0Auu3n+Fcx6F2Js4KPXaHEShAXugfU= ) ; keytag 21831 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20260402000000 20260312000000 20326 . hcmCK2q88XH00Hynv8IgIMVTKrwyb8Lh/uvRpqBPMALNQunyrS+VKrlKb6rBQTFnGHeVR/jj3Eay Uuxv4fy2evliMYKLrfTHtdqD3oUvJMnwmxEMmhS84Ttw+bbTcHeYxb52NFiYVHKb37Y0OWN4lr0p V+3fwFtWumb1NlWZDMNsaHFv6UIdxgUGNBVEyUaTAK6E2jseQcoqv6A0rNxCG+xtz2zSpRV2JM1g dC8zVAcc068OamqrwZlzKqsqAgXP78NOERrFkzffoRaSEmOORcAQpUdCK265DL1Y7Xeq0QaNEKd2 fXglm/IxS+4sMPT+83Q/XasxUu5C3d0qEz76fw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbNTVC2+pry4pc37pZI9Oj6b8FHxT3VGrvSPKLE1Tjyfe2kUZUtVX5xrv6AV4BVO+ygrYjGZ MNgEnbLU4zknnlnhI2e0g6iTza1aZh0dRZXGH16C1NUNq1CxBkUhIYQhQDeIOtLacx+RmFTc+hSH JJ2MJ79IS00kA7eKi6mofQ7SPJmdJVjI+JAx791y0f5QaB+iHGANU53FwiYXNUQjfAzCrtOaSevG sx8SO8BTaXLAjFq5eewOtwScVwfVDhEXlvpE6e+mIncwhNKaMRD9IPuHENqCNPI5MjxfAMVS6cEY 8eEozIkv/vHc+0Auu3n+Fcx6F2Js4KPXaHEShAXugfU= ) ; keytag 21831`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20260402000000 20260312000000 20326 . hcmCK2q88XH00Hynv8IgIMVTKrwyb8Lh/uvRpqBPMALNQunyrS+VKrlKb6rBQTFnGHeVR/jj3Eay Uuxv4fy2evliMYKLrfTHtdqD3oUvJMnwmxEMmhS84Ttw+bbTcHeYxb52NFiYVHKb37Y0OWN4lr0p V+3fwFtWumb1NlWZDMNsaHFv6UIdxgUGNBVEyUaTAK6E2jseQcoqv6A0rNxCG+xtz2zSpRV2JM1g dC8zVAcc068OamqrwZlzKqsqAgXP78NOERrFkzffoRaSEmOORcAQpUdCK265DL1Y7Xeq0QaNEKd2 fXglm/IxS+4sMPT+83Q/XasxUu5C3d0qEz76fw== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=21831 is now in the chain-of-trust
	DNSKEY=38696/SEP is now in the chain-of-trust
	Query to b.root-servers.net for belfius.be/A
	Received 740 bytes from 170.247.170.2
	;; Response received from [170.247.170.2] 740 octets ;; HEADER SECTION ;; id = 56845 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; belfius.be. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) be. 172800 IN NS a.nsset.be. be. 172800 IN NS b.nsset.be. be. 172800 IN NS c.nsset.be. be. 172800 IN NS d.nsset.be. be. 172800 IN NS y.nsset.be. be. 172800 IN NS z.nsset.be. be. 86400 IN DS ( 45588 13 2 687575c3f0fa4570be3ac23af40ffafc5e28a8de69de855a2db1fb9b4d277319 ) be. 86400 IN RRSIG ( DS 8 1 86400 20260328170000 20260315160000 21831 . LuO8+YgLgm6sqgY7AWVFiEOkb5SJUWMDUwpSyPbUJSz2eQXqzV/dnZmQrmFs3TVPnQKuEAEWNUzr gnvjghc/qsTAnYCrPil2m/EV0oV8ggpEN3xofOiVgc0eLxZL2X22SSnZemO4+EtIYWQQ80GP++w/ HdIkphI+5OHd9H6GI+0Qm8TqCBpOls4+JwrB5vrpbWogb1iQ6VKH3W/IxsmoW68LwlJBzXJPGrnS 3shFO9+Dvt7ClL4zQ1DiZKNBtJQVMff1lnqdtsb4XXbijJLAsrzF6oRsdR1KQwvs/26MGZfKu6ed DKJP/YctbiEFC2D+WXPLIGw1P9L9ILOpQNin7A== ) ;; ADDITIONAL SECTION (13 records) a.nsset.be. 172800 IN A 194.0.6.1 a.nsset.be. 172800 IN AAAA 2001:678:9::1 b.nsset.be. 172800 IN A 194.0.37.1 b.nsset.be. 172800 IN AAAA 2001:678:64::1 c.nsset.be. 172800 IN A 194.0.43.1 c.nsset.be. 172800 IN AAAA 2001:678:68::1 d.nsset.be. 172800 IN A 194.0.44.1 d.nsset.be. 172800 IN AAAA 2001:678:6c::1 y.nsset.be. 172800 IN A 120.29.253.8 y.nsset.be. 172800 IN AAAA 2001:dcd:7::8 z.nsset.be. 172800 IN A 194.0.25.36 z.nsset.be. 172800 IN AAAA 2001:678:20::36 ;; { "EDNS-VERSION": 0 }
	Query to g.root-servers.net for be/DNSKEY
	Received 734 bytes from 192.112.36.4
	;; Response received from [192.112.36.4] 734 octets ;; HEADER SECTION ;; id = 7589 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; be. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) be. 172800 IN NS z.nsset.be. be. 172800 IN NS c.nsset.be. be. 172800 IN NS d.nsset.be. be. 172800 IN NS a.nsset.be. be. 172800 IN NS b.nsset.be. be. 172800 IN NS y.nsset.be. be. 86400 IN DS ( 45588 13 2 687575c3f0fa4570be3ac23af40ffafc5e28a8de69de855a2db1fb9b4d277319 ) be. 86400 IN RRSIG ( DS 8 1 86400 20260328170000 20260315160000 21831 . LuO8+YgLgm6sqgY7AWVFiEOkb5SJUWMDUwpSyPbUJSz2eQXqzV/dnZmQrmFs3TVPnQKuEAEWNUzr gnvjghc/qsTAnYCrPil2m/EV0oV8ggpEN3xofOiVgc0eLxZL2X22SSnZemO4+EtIYWQQ80GP++w/ HdIkphI+5OHd9H6GI+0Qm8TqCBpOls4+JwrB5vrpbWogb1iQ6VKH3W/IxsmoW68LwlJBzXJPGrnS 3shFO9+Dvt7ClL4zQ1DiZKNBtJQVMff1lnqdtsb4XXbijJLAsrzF6oRsdR1KQwvs/26MGZfKu6ed DKJP/YctbiEFC2D+WXPLIGw1P9L9ILOpQNin7A== ) ;; ADDITIONAL SECTION (13 records) z.nsset.be. 172800 IN A 194.0.25.36 y.nsset.be. 172800 IN A 120.29.253.8 d.nsset.be. 172800 IN A 194.0.44.1 c.nsset.be. 172800 IN A 194.0.43.1 b.nsset.be. 172800 IN A 194.0.37.1 a.nsset.be. 172800 IN A 194.0.6.1 z.nsset.be. 172800 IN AAAA 2001:678:20::36 y.nsset.be. 172800 IN AAAA 2001:dcd:7::8 d.nsset.be. 172800 IN AAAA 2001:678:6c::1 c.nsset.be. 172800 IN AAAA 2001:678:68::1 b.nsset.be. 172800 IN AAAA 2001:678:64::1 a.nsset.be. 172800 IN AAAA 2001:678:9::1 ;; { "EDNS-VERSION": 0 }
	Found child zone be

	Checking DS between . and be
	Query to i.root-servers.net for be/DS
	Received 366 bytes from 192.36.148.17
	;; Response received from [192.36.148.17] 366 octets ;; HEADER SECTION ;; id = 52366 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; be. IN DS ;; ANSWER SECTION (2 records) be. 86400 IN DS ( 45588 13 2 687575c3f0fa4570be3ac23af40ffafc5e28a8de69de855a2db1fb9b4d277319 ) be. 86400 IN RRSIG ( DS 8 1 86400 20260328170000 20260315160000 21831 . LuO8+YgLgm6sqgY7AWVFiEOkb5SJUWMDUwpSyPbUJSz2eQXqzV/dnZmQrmFs3TVPnQKuEAEWNUzr gnvjghc/qsTAnYCrPil2m/EV0oV8ggpEN3xofOiVgc0eLxZL2X22SSnZemO4+EtIYWQQ80GP++w/ HdIkphI+5OHd9H6GI+0Qm8TqCBpOls4+JwrB5vrpbWogb1iQ6VKH3W/IxsmoW68LwlJBzXJPGrnS 3shFO9+Dvt7ClL4zQ1DiZKNBtJQVMff1lnqdtsb4XXbijJLAsrzF6oRsdR1KQwvs/26MGZfKu6ed DKJP/YctbiEFC2D+WXPLIGw1P9L9ILOpQNin7A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for be in the . zone
	DS=45588/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`be. 86400 IN RRSIG ( DS 8 1 86400 20260328170000 20260315160000 21831 . LuO8+YgLgm6sqgY7AWVFiEOkb5SJUWMDUwpSyPbUJSz2eQXqzV/dnZmQrmFs3TVPnQKuEAEWNUzr gnvjghc/qsTAnYCrPil2m/EV0oV8ggpEN3xofOiVgc0eLxZL2X22SSnZemO4+EtIYWQQ80GP++w/ HdIkphI+5OHd9H6GI+0Qm8TqCBpOls4+JwrB5vrpbWogb1iQ6VKH3W/IxsmoW68LwlJBzXJPGrnS 3shFO9+Dvt7ClL4zQ1DiZKNBtJQVMff1lnqdtsb4XXbijJLAsrzF6oRsdR1KQwvs/26MGZfKu6ed DKJP/YctbiEFC2D+WXPLIGw1P9L9ILOpQNin7A== )`
	RRSIG=21831 and DNSKEY=21831 verifies the DS RRset
	DS=45588/SHA-256 is now in the chain-of-trust
	`be. 86400 IN DS ( 45588 13 2 687575c3f0fa4570be3ac23af40ffafc5e28a8de69de855a2db1fb9b4d277319 )`
	Query to b.nsset.be for be/DNSKEY
	Received 289 bytes from 194.0.37.1
	;; Response received from [194.0.37.1] 289 octets ;; HEADER SECTION ;; id = 20698 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; be. IN DNSKEY ;; ANSWER SECTION (3 records) be. 86400 IN DNSKEY ( 257 3 13 rqDMl0oIO7xaei757+vjjUA4kI4s9+k0lXuvYRbCJkZevzKOquRNCidC4XriS2oc9NCFKDX3yVYD r9/wYxJI6A== ) ; keytag 45588 be. 86400 IN DNSKEY ( 256 3 13 syuq0Hb4DcxTfNdATdBRgAExGAC+7jcbaeJZJTOnD7XqnMf80DCePQTluSR3r3WVtrjZlNOOKU4D 4gCHLRX5kw== ) ; keytag 19214 be. 86400 IN RRSIG ( DNSKEY 13 1 86400 20260501214830 20260114084919 45588 be. cJRGbpDQK6otU6dHAdx+9Q4V4kGsf0CKVj6rCetOYaCF73K7XmBKfjoO58dTo8L8v6dclSLhGdCN NwYJc/0gNg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for be
	`be. 86400 IN DNSKEY ( 257 3 13 rqDMl0oIO7xaei757+vjjUA4kI4s9+k0lXuvYRbCJkZevzKOquRNCidC4XriS2oc9NCFKDX3yVYD r9/wYxJI6A== ) ; keytag 45588`
	`be. 86400 IN DNSKEY ( 256 3 13 syuq0Hb4DcxTfNdATdBRgAExGAC+7jcbaeJZJTOnD7XqnMf80DCePQTluSR3r3WVtrjZlNOOKU4D 4gCHLRX5kw== ) ; keytag 19214`
	DNSKEY=45588/SEP is now in the chain-of-trust
	DS=45588/SHA-256 verifies DNSKEY=45588/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`be. 86400 IN RRSIG ( DNSKEY 13 1 86400 20260501214830 20260114084919 45588 be. cJRGbpDQK6otU6dHAdx+9Q4V4kGsf0CKVj6rCetOYaCF73K7XmBKfjoO58dTo8L8v6dclSLhGdCN NwYJc/0gNg== )`
	RRSIG=45588 and DNSKEY=45588/SEP verifies the DNSKEY RRset
	DNSKEY=19214 is now in the chain-of-trust
	Query to b.nsset.be for belfius.be/A
	Received 232 bytes from 194.0.37.1
	;; Response received from [194.0.37.1] 232 octets ;; HEADER SECTION ;; id = 35422 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; belfius.be. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) belfius.be. 86400 IN NS ns1.belfius.com. belfius.be. 86400 IN NS ns2.belfius.com. belfius.be. 86400 IN DS ( 20839 8 2 7e3a3a448db056851dd3d4424bba943718879a5ac5769d86f0a3726f8db2e5b3 ) belfius.be. 86400 IN RRSIG ( DS 13 2 86400 20260331115352 20260309025952 19214 be. f4KaXrwAzwT3fj2UJ/vBi3EHqKXc4PueuMew8jGN9txbex0lHrhGKU0piFBSfZrnUM6vSZVcFD+R dc4TjNFgNA== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a.nsset.be for belfius.be/DNSKEY
	Received 232 bytes from 194.0.6.1
	;; Response received from [194.0.6.1] 232 octets ;; HEADER SECTION ;; id = 37971 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; belfius.be. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) belfius.be. 86400 IN NS ns1.belfius.com. belfius.be. 86400 IN NS ns2.belfius.com. belfius.be. 86400 IN DS ( 20839 8 2 7e3a3a448db056851dd3d4424bba943718879a5ac5769d86f0a3726f8db2e5b3 ) belfius.be. 86400 IN RRSIG ( DS 13 2 86400 20260331115352 20260309025952 19214 be. f4KaXrwAzwT3fj2UJ/vBi3EHqKXc4PueuMew8jGN9txbex0lHrhGKU0piFBSfZrnUM6vSZVcFD+R dc4TjNFgNA== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone belfius.be

belfius.be

	Checking DS between be and belfius.be
	Query to a.nsset.be for belfius.be/DS
	Received 185 bytes from 194.0.6.1
	;; Response received from [194.0.6.1] 185 octets ;; HEADER SECTION ;; id = 41830 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; belfius.be. IN DS ;; ANSWER SECTION (2 records) belfius.be. 86400 IN DS ( 20839 8 2 7e3a3a448db056851dd3d4424bba943718879a5ac5769d86f0a3726f8db2e5b3 ) belfius.be. 86400 IN RRSIG ( DS 13 2 86400 20260331115352 20260309025952 19214 be. f4KaXrwAzwT3fj2UJ/vBi3EHqKXc4PueuMew8jGN9txbex0lHrhGKU0piFBSfZrnUM6vSZVcFD+R dc4TjNFgNA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for belfius.be in the be zone
	DS=20839/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`belfius.be. 86400 IN RRSIG ( DS 13 2 86400 20260331115352 20260309025952 19214 be. f4KaXrwAzwT3fj2UJ/vBi3EHqKXc4PueuMew8jGN9txbex0lHrhGKU0piFBSfZrnUM6vSZVcFD+R dc4TjNFgNA== )`
	RRSIG=19214 and DNSKEY=19214 verifies the DS RRset
	DS=20839/SHA-256 is now in the chain-of-trust
	`belfius.be. 86400 IN DS ( 20839 8 2 7e3a3a448db056851dd3d4424bba943718879a5ac5769d86f0a3726f8db2e5b3 )`
	Query to ns2.belfius.com for belfius.be/DNSKEY
	Received 931 bytes from 141.96.12.122
	;; Response received from [141.96.12.122] 931 octets ;; HEADER SECTION ;; id = 34724 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; belfius.be. IN DNSKEY ;; ANSWER SECTION (4 records) belfius.be. 302400 IN DNSKEY ( 257 3 8 AwEAAb4G8xtzsk9tnxZdmnFqrPLxqra3SYc555CwZtarqrRXi2WZmyO+2Tx/49/LMWCeosHbNQpf k0PEu4yTjGRB3N5aBkH/0h0N4KzZIoPjGP0saWVH+QoQ3g5+ylbXGTZlXV+OAmP897A7Xik9Bk6N aqDG3PgMwsEO3mGPQet/muZjSKLDwSSSxgF/pmHmxb01LVr7kp0VEAlteX3ZdaMyDfx80blwWXUX J6MNWCdob0tq4MGF5nQ9GfOu8r8FKiKOj/o5Q0Yj5Gv1tHVlSVj4XoU31LtyqyBQUAPy70qm2EeK 5Y4MuHt2l6D58LC8YPikZCMrXmGCDFtUH1l3bOxZSTE= ) ; keytag 20839 belfius.be. 302400 IN DNSKEY ( 256 3 8 AwEAAcIRgyYY95LSRcnYyZFlchfLA6uadSMsGdfiZuMYS8zu3R5Ha5IrTYJBLW1UPCO7832hWGgJ yzEG6ILhHvmsLx+FhWGYUJG+Q20NoOapFg2Oc29fiOmUQ7QPnvTU5rm+n3GWy1S9mgEMWsTtZthT jV4u6zecEvXuaJo8/tlLumEP ) ; keytag 49119 belfius.be. 302400 IN RRSIG ( DNSKEY 8 2 302400 20260322120823 20260315120547 20839 belfius.be. o0s8KITyXwe3DAGfX1IvX1Atj8a/e5cjUZ7KxvKBpJ84mPbuSCI4o4U/ox3gLHdUXSMFz70mpA0T KeOmYeqzqYaYNzpb2J+pP0SPKAnEqm5k2nAoMqd+XkNmFIc1FNjbY1rYnjmQCKItVSdGBY66gCM9 qZK8XN8AY4VNJ23KcPA4k1ClWj0JhDP5OPoqptMR4hJN0rzo1DVzzta9A7yT6ph/9ef18iFFhO/M Z3WXMUZ2UQKphyDRcTr/RQ5faB/iWzztT/vUVcDs4ly6I1mAVPRKHVoVQZXKJiA6UKIl346yTMzj VHUY7/05SckK9VLrG+p3iZ7TZ538k+d45AeH2g== ) belfius.be. 302400 IN RRSIG ( DNSKEY 8 2 302400 20260322120823 20260315120547 49119 belfius.be. qIhXjO6CwHi8eg/xFlGIH3lwD/rK6QpbWLPxOtEBmOLFX8hN5WtKzMDaRkT66dPZzWX8Ym//Mkgt yzqNM83MLhlD2kaTtQ4CqrfCxkXHKTudz/M/G1UBvyHQJJ8YhUgIOD49nGqIdr9+T/JTzrEUZ+3T ieruq3WBAji0ZeMFNzM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for belfius.be
	`belfius.be. 302400 IN DNSKEY ( 257 3 8 AwEAAb4G8xtzsk9tnxZdmnFqrPLxqra3SYc555CwZtarqrRXi2WZmyO+2Tx/49/LMWCeosHbNQpf k0PEu4yTjGRB3N5aBkH/0h0N4KzZIoPjGP0saWVH+QoQ3g5+ylbXGTZlXV+OAmP897A7Xik9Bk6N aqDG3PgMwsEO3mGPQet/muZjSKLDwSSSxgF/pmHmxb01LVr7kp0VEAlteX3ZdaMyDfx80blwWXUX J6MNWCdob0tq4MGF5nQ9GfOu8r8FKiKOj/o5Q0Yj5Gv1tHVlSVj4XoU31LtyqyBQUAPy70qm2EeK 5Y4MuHt2l6D58LC8YPikZCMrXmGCDFtUH1l3bOxZSTE= ) ; keytag 20839`
	`belfius.be. 302400 IN DNSKEY ( 256 3 8 AwEAAcIRgyYY95LSRcnYyZFlchfLA6uadSMsGdfiZuMYS8zu3R5Ha5IrTYJBLW1UPCO7832hWGgJ yzEG6ILhHvmsLx+FhWGYUJG+Q20NoOapFg2Oc29fiOmUQ7QPnvTU5rm+n3GWy1S9mgEMWsTtZthT jV4u6zecEvXuaJo8/tlLumEP ) ; keytag 49119`
	DNSKEY=20839/SEP is now in the chain-of-trust
	DS=20839/SHA-256 verifies DNSKEY=20839/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`belfius.be. 302400 IN RRSIG ( DNSKEY 8 2 302400 20260322120823 20260315120547 20839 belfius.be. o0s8KITyXwe3DAGfX1IvX1Atj8a/e5cjUZ7KxvKBpJ84mPbuSCI4o4U/ox3gLHdUXSMFz70mpA0T KeOmYeqzqYaYNzpb2J+pP0SPKAnEqm5k2nAoMqd+XkNmFIc1FNjbY1rYnjmQCKItVSdGBY66gCM9 qZK8XN8AY4VNJ23KcPA4k1ClWj0JhDP5OPoqptMR4hJN0rzo1DVzzta9A7yT6ph/9ef18iFFhO/M Z3WXMUZ2UQKphyDRcTr/RQ5faB/iWzztT/vUVcDs4ly6I1mAVPRKHVoVQZXKJiA6UKIl346yTMzj VHUY7/05SckK9VLrG+p3iZ7TZ538k+d45AeH2g== )`
	`belfius.be. 302400 IN RRSIG ( DNSKEY 8 2 302400 20260322120823 20260315120547 49119 belfius.be. qIhXjO6CwHi8eg/xFlGIH3lwD/rK6QpbWLPxOtEBmOLFX8hN5WtKzMDaRkT66dPZzWX8Ym//Mkgt yzqNM83MLhlD2kaTtQ4CqrfCxkXHKTudz/M/G1UBvyHQJJ8YhUgIOD49nGqIdr9+T/JTzrEUZ+3T ieruq3WBAji0ZeMFNzM= )`
	RRSIG=20839 and DNSKEY=20839/SEP verifies the DNSKEY RRset
	RRSIG=49119 and DNSKEY=49119 verifies the DNSKEY RRset
	DNSKEY=49119 is now in the chain-of-trust
	Query to ns2.belfius.com for belfius.be/A
	Received 225 bytes from 141.96.12.122
	;; Response received from [141.96.12.122] 225 octets ;; HEADER SECTION ;; id = 11227 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; belfius.be. IN A ;; ANSWER SECTION (2 records) belfius.be. 300 IN A 141.96.1.13 belfius.be. 300 IN RRSIG ( A 8 2 300 20260322124008 20260315123209 49119 belfius.be. bXsArDv+RnVKN4m5GdQBGORmkUZk8fp268oyJPPeGo8PDvoKeCCf0QaCXlQZXNyYwNmu8y+Av+XE BudnKMTbyUyocfBYHgDVKhiLPfNHcXeH5WvgmU28ZDnjisN57XThBFfZQJueJES5sFrtLwox6WDp JP4dqgcqCnkDDAskCwE= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns2.belfius.com is authoritative for belfius.be
	Found RRSIG signed by belfius.be zone
	Query to ns1.belfius.com for belfius.be/SOA
	Received 272 bytes from 141.96.12.58
	;; Response received from [141.96.12.58] 272 octets ;; HEADER SECTION ;; id = 30435 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; belfius.be. IN SOA ;; ANSWER SECTION (2 records) belfius.be. 3600 IN SOA ( ns1.belfius.com. dns.is4f.com. 2020307708 ;serial 10800 ;refresh 1080 ;retry 1209600 ;expire 3600 ;minimum ) belfius.be. 3600 IN RRSIG ( SOA 8 2 3600 20260322171210 20260315161210 49119 belfius.be. cLEPZy8wNcBPphDpi1QseQ3mgfX4DlzBsuTGOSCTZrqdt7IKlzk6fu2+/IclG2fAumbmvAxPhYCZ VBEHPYCUAPePUCgzWsJx9PSbv+eaUz6aKwJYAMPgBwW5xn+kcV0CXE1AjjngojBxOpDZwWC23DUz gONwhMFnWMMYGf+7bRQ= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns2.belfius.com for belfius.be/A
	Received 225 bytes from 141.96.12.122
	;; Response received from [141.96.12.122] 225 octets ;; HEADER SECTION ;; id = 56448 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; belfius.be. IN A ;; ANSWER SECTION (2 records) belfius.be. 300 IN A 141.96.1.13 belfius.be. 300 IN RRSIG ( A 8 2 300 20260322124008 20260315123209 49119 belfius.be. bXsArDv+RnVKN4m5GdQBGORmkUZk8fp268oyJPPeGo8PDvoKeCCf0QaCXlQZXNyYwNmu8y+Av+XE BudnKMTbyUyocfBYHgDVKhiLPfNHcXeH5WvgmU28ZDnjisN57XThBFfZQJueJES5sFrtLwox6WDp JP4dqgcqCnkDDAskCwE= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	belfius.be A RR has value 141.96.1.13
	Found 1 RRSIGs over A RRset
	`belfius.be. 300 IN RRSIG ( A 8 2 300 20260322124008 20260315123209 49119 belfius.be. bXsArDv+RnVKN4m5GdQBGORmkUZk8fp268oyJPPeGo8PDvoKeCCf0QaCXlQZXNyYwNmu8y+Av+XE BudnKMTbyUyocfBYHgDVKhiLPfNHcXeH5WvgmU28ZDnjisN57XThBFfZQJueJES5sFrtLwox6WDp JP4dqgcqCnkDDAskCwE= )`
	RRSIG=49119 and DNSKEY=49119 verifies the A RRset

belfius.be

	Query to ns1.belfius.com for belfius.be/A
	Received 225 bytes from 141.96.12.58
	;; Response received from [141.96.12.58] 225 octets ;; HEADER SECTION ;; id = 40801 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; belfius.be. IN A ;; ANSWER SECTION (2 records) belfius.be. 300 IN A 141.96.1.13 belfius.be. 300 IN RRSIG ( A 8 2 300 20260322124008 20260315123209 49119 belfius.be. bXsArDv+RnVKN4m5GdQBGORmkUZk8fp268oyJPPeGo8PDvoKeCCf0QaCXlQZXNyYwNmu8y+Av+XE BudnKMTbyUyocfBYHgDVKhiLPfNHcXeH5WvgmU28ZDnjisN57XThBFfZQJueJES5sFrtLwox6WDp JP4dqgcqCnkDDAskCwE= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns1.belfius.com is authoritative for belfius.be
	Found RRSIG signed by belfius.be zone
	Query to ns1.belfius.com for belfius.be/A
	Received 225 bytes from 141.96.12.58
	;; Response received from [141.96.12.58] 225 octets ;; HEADER SECTION ;; id = 58610 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; belfius.be. IN A ;; ANSWER SECTION (2 records) belfius.be. 300 IN A 141.96.1.13 belfius.be. 300 IN RRSIG ( A 8 2 300 20260322124008 20260315123209 49119 belfius.be. bXsArDv+RnVKN4m5GdQBGORmkUZk8fp268oyJPPeGo8PDvoKeCCf0QaCXlQZXNyYwNmu8y+Av+XE BudnKMTbyUyocfBYHgDVKhiLPfNHcXeH5WvgmU28ZDnjisN57XThBFfZQJueJES5sFrtLwox6WDp JP4dqgcqCnkDDAskCwE= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	belfius.be A RR has value 141.96.1.13
	Found 1 RRSIGs over A RRset
	`belfius.be. 300 IN RRSIG ( A 8 2 300 20260322124008 20260315123209 49119 belfius.be. bXsArDv+RnVKN4m5GdQBGORmkUZk8fp268oyJPPeGo8PDvoKeCCf0QaCXlQZXNyYwNmu8y+Av+XE BudnKMTbyUyocfBYHgDVKhiLPfNHcXeH5WvgmU28ZDnjisN57XThBFfZQJueJES5sFrtLwox6WDp JP4dqgcqCnkDDAskCwE= )`
	RRSIG=49119 and DNSKEY=49119 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test belfius.be at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: