DNSSEC Analyzer - bogus.d2a1n1.rootcanary.net

Domain Name:

Time: 2022-10-07 02:42:11 UTC, NTP stratum 16

Analyzing DNSSEC problems for bogus.d2a1n1.rootcanary.net

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to f.root-servers.net for ./DNSKEY
	Received 1139 bytes from 192.5.5.241
	;; Response received from 192.5.5.241 (1139 octets) ;; HEADER SECTION ;; id = 59932 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAaQVKIqdmeLCaF4lq+IoKpejId9qqoIbZJ6cjB5MfyJYX3KVFXYyJ9rt4jKOwf4m2BoDOY66 V1upRumF+eu502HXzdOdJlioRLA9YiRyLgvfjzyfUYrExYT4/TDTS4XfQX2UcJDN5C7SQ9UxebZk /VjQfPAUU+hZKOcjOVRFbAHom4tIi+Rin0laGlAi8ZY5WUZypYKR0xvprtG0eXeOBMjbUt1EnhmO 2Bs52zC8B0cMjq6fMiYFUqtziALccsQczGngIDR0dIvvL54ky1JNNp19Ldy9ir27s7eRCYGbYI1W zR05/d4/nCmDSHkQS2BiesYufuWZZwm+FsitupCciwE= ) ; Key ID = 20826 . 172800 IN DNSKEY ( 256 3 8 AwEAAeB54o2xvW6vY4qQZ0krDsEZCe6MsRWCqsXd4+cNJZMePnlV/xwDrIbbeH1SJzv742rOHzgA KM1/3SQHHSkoEIPx8XQdHAZBxfhaXl3e8c5WrE3aGXS5AeTWAkt85ccqWgKyitxjFmJEOol0BqS2 xueltaDwgWcC10nPUY+y5l/kTOYyptYQS4gg1uJNXIob/R1XIEJ10ZCurkYqZxgqyHc7tZv09N23 o9rnGdjnYiArH7FjlXD8Rvjde8YWkmfdbCEWnchrnxDK8KV2/ZvBpG/WYnRKXYPUceGCw59OJdJ5 M7utkm547RB3eEd8CVVhbXopZlsKq3GCrBwaIVe9ci0= ) ; Key ID = 18733 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20221022000000 20221001000000 20326 . J39bVSJaNAI0vdz8qBWGjXuc39IV5rNXi+3lX7cVHtcdZJ/APXxdBXKI1vD0AEJjBg31iE/r+8Vk 8PQQklaWtlJ9YBFM5sVUBozVl9WL6x0P7JcZbBvgotfNfuvx0mt3BE/myzw5+kJV0OuG6nBZcD6B QZP3aIbQbVe64Hj3TeMGowQTcdTIfWsPpKB5GvxEY2XhRdahhftG2c8aVJZsub86jUjpTSZn8Dp1 S8BS3+ZBbbqHcQGqf4cmwS1QZYHjOsa86889IPcKmQ4EBQUlLihv3qRrGILkC1fhPhsyj/r8HX3v hM+Wamz8hF1QjhOUSvUD01iBl5PdTXacgAZ3mw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option:
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAaQVKIqdmeLCaF4lq+IoKpejId9qqoIbZJ6cjB5MfyJYX3KVFXYyJ9rt4jKOwf4m2BoDOY66 V1upRumF+eu502HXzdOdJlioRLA9YiRyLgvfjzyfUYrExYT4/TDTS4XfQX2UcJDN5C7SQ9UxebZk /VjQfPAUU+hZKOcjOVRFbAHom4tIi+Rin0laGlAi8ZY5WUZypYKR0xvprtG0eXeOBMjbUt1EnhmO 2Bs52zC8B0cMjq6fMiYFUqtziALccsQczGngIDR0dIvvL54ky1JNNp19Ldy9ir27s7eRCYGbYI1W zR05/d4/nCmDSHkQS2BiesYufuWZZwm+FsitupCciwE= ) ; Key ID = 20826`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAeB54o2xvW6vY4qQZ0krDsEZCe6MsRWCqsXd4+cNJZMePnlV/xwDrIbbeH1SJzv742rOHzgA KM1/3SQHHSkoEIPx8XQdHAZBxfhaXl3e8c5WrE3aGXS5AeTWAkt85ccqWgKyitxjFmJEOol0BqS2 xueltaDwgWcC10nPUY+y5l/kTOYyptYQS4gg1uJNXIob/R1XIEJ10ZCurkYqZxgqyHc7tZv09N23 o9rnGdjnYiArH7FjlXD8Rvjde8YWkmfdbCEWnchrnxDK8KV2/ZvBpG/WYnRKXYPUceGCw59OJdJ5 M7utkm547RB3eEd8CVVhbXopZlsKq3GCrBwaIVe9ci0= ) ; Key ID = 18733`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20221022000000 20221001000000 20326 . J39bVSJaNAI0vdz8qBWGjXuc39IV5rNXi+3lX7cVHtcdZJ/APXxdBXKI1vD0AEJjBg31iE/r+8Vk 8PQQklaWtlJ9YBFM5sVUBozVl9WL6x0P7JcZbBvgotfNfuvx0mt3BE/myzw5+kJV0OuG6nBZcD6B QZP3aIbQbVe64Hj3TeMGowQTcdTIfWsPpKB5GvxEY2XhRdahhftG2c8aVJZsub86jUjpTSZn8Dp1 S8BS3+ZBbbqHcQGqf4cmwS1QZYHjOsa86889IPcKmQ4EBQUlLihv3qRrGILkC1fhPhsyj/r8HX3v hM+Wamz8hF1QjhOUSvUD01iBl5PdTXacgAZ3mw== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=20826 is now in the chain-of-trust
	DNSKEY=18733 is now in the chain-of-trust
	Query to l.root-servers.net for bogus.d2a1n1.rootcanary.net/A
	Received 1184 bytes from 199.7.83.42
	;; Response received from 199.7.83.42 (1184 octets) ;; HEADER SECTION ;; id = 38830 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 15 arcount = 27 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; bogus.d2a1n1.rootcanary.net. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) net. 172800 IN NS a.gtld-servers.net. net. 172800 IN NS b.gtld-servers.net. net. 172800 IN NS c.gtld-servers.net. net. 172800 IN NS d.gtld-servers.net. net. 172800 IN NS e.gtld-servers.net. net. 172800 IN NS f.gtld-servers.net. net. 172800 IN NS g.gtld-servers.net. net. 172800 IN NS h.gtld-servers.net. net. 172800 IN NS i.gtld-servers.net. net. 172800 IN NS j.gtld-servers.net. net. 172800 IN NS k.gtld-servers.net. net. 172800 IN NS l.gtld-servers.net. net. 172800 IN NS m.gtld-servers.net. net. 86400 IN DS ( 35886 8 2 7862b27f5f516ebe19680444d4ce5e762981931842c465f00236401d8bd973ee ) net. 86400 IN RRSIG ( DS 8 1 86400 20221019200000 20221006190000 18733 . lvRKdTmmivnrQiBxu16gM4muYi3UcZkX/8Eb5Vb+N9jo6p7SqKsjX03JOpulBa+dfCWxXBlTFD3d k33mTJw9L5LBtvfyZaa2bl7/tV8osUqmkcqQFOMehJVawCKT8IhMKfbs9w2P8UioK0X/2aqbdnNq 8Dg0GHK4g5L3BhqevZiMKJtkCdR9qGeV5hWYydQirt0HgO8jtysCPEOgMrmiI/mhQHWMJFf9tomN /KlGPFgbt9+uCBVMzZYvjclpDvRcmtk9Xx9HrhIbhf1hFW/vUoNkpWtuPlGKQxFURbI4kUKsqToa k8lo1bChEwbp7w0h3Y/Ugh0/YpKkpzWx1l30vA== ) ;; ADDITIONAL SECTION (27 records) a.gtld-servers.net. 172800 IN A 192.5.6.30 b.gtld-servers.net. 172800 IN A 192.33.14.30 c.gtld-servers.net. 172800 IN A 192.26.92.30 d.gtld-servers.net. 172800 IN A 192.31.80.30 e.gtld-servers.net. 172800 IN A 192.12.94.30 f.gtld-servers.net. 172800 IN A 192.35.51.30 g.gtld-servers.net. 172800 IN A 192.42.93.30 h.gtld-servers.net. 172800 IN A 192.54.112.30 i.gtld-servers.net. 172800 IN A 192.43.172.30 j.gtld-servers.net. 172800 IN A 192.48.79.30 k.gtld-servers.net. 172800 IN A 192.52.178.30 l.gtld-servers.net. 172800 IN A 192.41.162.30 m.gtld-servers.net. 172800 IN A 192.55.83.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to l.root-servers.net for net/DNSKEY
	Received 1160 bytes from 199.7.83.42
	;; Response received from 199.7.83.42 (1160 octets) ;; HEADER SECTION ;; id = 2474 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 15 arcount = 27 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) net. 172800 IN NS a.gtld-servers.net. net. 172800 IN NS b.gtld-servers.net. net. 172800 IN NS c.gtld-servers.net. net. 172800 IN NS d.gtld-servers.net. net. 172800 IN NS e.gtld-servers.net. net. 172800 IN NS f.gtld-servers.net. net. 172800 IN NS g.gtld-servers.net. net. 172800 IN NS h.gtld-servers.net. net. 172800 IN NS i.gtld-servers.net. net. 172800 IN NS j.gtld-servers.net. net. 172800 IN NS k.gtld-servers.net. net. 172800 IN NS l.gtld-servers.net. net. 172800 IN NS m.gtld-servers.net. net. 86400 IN DS ( 35886 8 2 7862b27f5f516ebe19680444d4ce5e762981931842c465f00236401d8bd973ee ) net. 86400 IN RRSIG ( DS 8 1 86400 20221019200000 20221006190000 18733 . lvRKdTmmivnrQiBxu16gM4muYi3UcZkX/8Eb5Vb+N9jo6p7SqKsjX03JOpulBa+dfCWxXBlTFD3d k33mTJw9L5LBtvfyZaa2bl7/tV8osUqmkcqQFOMehJVawCKT8IhMKfbs9w2P8UioK0X/2aqbdnNq 8Dg0GHK4g5L3BhqevZiMKJtkCdR9qGeV5hWYydQirt0HgO8jtysCPEOgMrmiI/mhQHWMJFf9tomN /KlGPFgbt9+uCBVMzZYvjclpDvRcmtk9Xx9HrhIbhf1hFW/vUoNkpWtuPlGKQxFURbI4kUKsqToa k8lo1bChEwbp7w0h3Y/Ugh0/YpKkpzWx1l30vA== ) ;; ADDITIONAL SECTION (27 records) a.gtld-servers.net. 172800 IN A 192.5.6.30 b.gtld-servers.net. 172800 IN A 192.33.14.30 c.gtld-servers.net. 172800 IN A 192.26.92.30 d.gtld-servers.net. 172800 IN A 192.31.80.30 e.gtld-servers.net. 172800 IN A 192.12.94.30 f.gtld-servers.net. 172800 IN A 192.35.51.30 g.gtld-servers.net. 172800 IN A 192.42.93.30 h.gtld-servers.net. 172800 IN A 192.54.112.30 i.gtld-servers.net. 172800 IN A 192.43.172.30 j.gtld-servers.net. 172800 IN A 192.48.79.30 k.gtld-servers.net. 172800 IN A 192.52.178.30 l.gtld-servers.net. 172800 IN A 192.41.162.30 m.gtld-servers.net. 172800 IN A 192.55.83.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone net

net

	Checking DS between . and net
	Query to h.root-servers.net for net/DS
	Received 367 bytes from 198.97.190.53
	;; Response received from 198.97.190.53 (367 octets) ;; HEADER SECTION ;; id = 65332 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; net. IN DS ;; ANSWER SECTION (2 records) net. 86400 IN DS ( 35886 8 2 7862b27f5f516ebe19680444d4ce5e762981931842c465f00236401d8bd973ee ) net. 86400 IN RRSIG ( DS 8 1 86400 20221019200000 20221006190000 18733 . lvRKdTmmivnrQiBxu16gM4muYi3UcZkX/8Eb5Vb+N9jo6p7SqKsjX03JOpulBa+dfCWxXBlTFD3d k33mTJw9L5LBtvfyZaa2bl7/tV8osUqmkcqQFOMehJVawCKT8IhMKfbs9w2P8UioK0X/2aqbdnNq 8Dg0GHK4g5L3BhqevZiMKJtkCdR9qGeV5hWYydQirt0HgO8jtysCPEOgMrmiI/mhQHWMJFf9tomN /KlGPFgbt9+uCBVMzZYvjclpDvRcmtk9Xx9HrhIbhf1hFW/vUoNkpWtuPlGKQxFURbI4kUKsqToa k8lo1bChEwbp7w0h3Y/Ugh0/YpKkpzWx1l30vA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 1 DS records for net in the . zone
	DS=35886/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`net. 86400 IN RRSIG ( DS 8 1 86400 20221019200000 20221006190000 18733 . lvRKdTmmivnrQiBxu16gM4muYi3UcZkX/8Eb5Vb+N9jo6p7SqKsjX03JOpulBa+dfCWxXBlTFD3d k33mTJw9L5LBtvfyZaa2bl7/tV8osUqmkcqQFOMehJVawCKT8IhMKfbs9w2P8UioK0X/2aqbdnNq 8Dg0GHK4g5L3BhqevZiMKJtkCdR9qGeV5hWYydQirt0HgO8jtysCPEOgMrmiI/mhQHWMJFf9tomN /KlGPFgbt9+uCBVMzZYvjclpDvRcmtk9Xx9HrhIbhf1hFW/vUoNkpWtuPlGKQxFURbI4kUKsqToa k8lo1bChEwbp7w0h3Y/Ugh0/YpKkpzWx1l30vA== )`
	RRSIG=18733 and DNSKEY=18733 verifies the DS RRset
	DS=35886/SHA-256 is now in the chain-of-trust
	`net. 86400 IN DS ( 35886 8 2 7862b27f5f516ebe19680444d4ce5e762981931842c465f00236401d8bd973ee )`
	Query to k.gtld-servers.net for net/DNSKEY
	Received 775 bytes from 192.52.178.30
	;; Response received from 192.52.178.30 (775 octets) ;; HEADER SECTION ;; id = 32058 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; net. IN DNSKEY ;; ANSWER SECTION (3 records) net. 86400 IN DNSKEY ( 257 3 8 AQOYBnzqWXIEj6mlgXg4LWC0HP2n8eK8XqgHlmJ/69iuIHsa1TrHDG6TcOra/pyeGKwH0nKZhTmX SuUFGh9BCNiwVDuyyb6OBGy2Nte9Kr8NwWg4q+zhSoOf4D+gC9dEzg0yFdwT0DKEvmNPt0K4jbQD S4Yimb+uPKuF6yieWWrPYYCrv8C9KC8JMze2uT6NuWBfsl2fDUoV4l65qMww06D7n+p7RbdwWkAZ 0fA63mXVXBZF6kpDtsYD7SUB9jhhfLQE/r85bvg3FaSs5Wi2BaqN06SzGWI1DHu7axthIOeHwg00 zxlhTpoYCH0ldoQz+S65zWYi/fRJiyLSBb6JZOvn ) ; Key ID = 35886 net. 86400 IN DNSKEY ( 256 3 8 AQPuuUVTSKJQoAxi044ExZl7F8F4r9HWKE5hisOw5UQcXEF65G2sVNqf2G3EVz5qJ9kLnpyBys5Y bbSG3tnyaLqJirtPLWLA0zqcgF05AdJtwlzoIdsVG6mhcB0n9mQ2N9Zs3McSSKzIrf0CzRAzEXVp RU3NiRWIf9yDC085RQyHsNODiso7QAGjKMDJQOTs4nHfxuIbCa1AbyFjpdzieF9v ) ; Key ID = 4403 net. 86400 IN RRSIG ( DNSKEY 8 1 86400 20221016162830 20221001162330 35886 net. EHnUfreJvviwKHIx2c48TvPr7dd5KjwVzjvd27/S0FjpEIiKX1LQy7glx6Qi/sIfLAh/Z2dsub+6 ftVpeSb6c54lW353vb9ZoydSNg8Yut6p6P++Ym8reoB7Qvd8Caw/hkjR8dvHpmHFtutbW6XIh8Sw PNuv4No8c3hXMaKyg7LKZJyhRbbGStrOXVr+tQO8u7nIwJBFEA8tSwHm1iDHaEH/1s3KmZdE9x6k pdn184LQq4RK2YHKgK0umOnVDzSzYK0EKE/VjzsDFa44h2csTGOQLAlem5Cf0Jf0Jky4FbTd5F04 jde6+E/UiObE3cPOLyi6atvwldaQIWW+D6Sa5A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DNSKEY records for net
	`net. 86400 IN DNSKEY ( 257 3 8 AQOYBnzqWXIEj6mlgXg4LWC0HP2n8eK8XqgHlmJ/69iuIHsa1TrHDG6TcOra/pyeGKwH0nKZhTmX SuUFGh9BCNiwVDuyyb6OBGy2Nte9Kr8NwWg4q+zhSoOf4D+gC9dEzg0yFdwT0DKEvmNPt0K4jbQD S4Yimb+uPKuF6yieWWrPYYCrv8C9KC8JMze2uT6NuWBfsl2fDUoV4l65qMww06D7n+p7RbdwWkAZ 0fA63mXVXBZF6kpDtsYD7SUB9jhhfLQE/r85bvg3FaSs5Wi2BaqN06SzGWI1DHu7axthIOeHwg00 zxlhTpoYCH0ldoQz+S65zWYi/fRJiyLSBb6JZOvn ) ; Key ID = 35886`
	`net. 86400 IN DNSKEY ( 256 3 8 AQPuuUVTSKJQoAxi044ExZl7F8F4r9HWKE5hisOw5UQcXEF65G2sVNqf2G3EVz5qJ9kLnpyBys5Y bbSG3tnyaLqJirtPLWLA0zqcgF05AdJtwlzoIdsVG6mhcB0n9mQ2N9Zs3McSSKzIrf0CzRAzEXVp RU3NiRWIf9yDC085RQyHsNODiso7QAGjKMDJQOTs4nHfxuIbCa1AbyFjpdzieF9v ) ; Key ID = 4403`
	DNSKEY=35886/SEP is now in the chain-of-trust
	DS=35886/SHA-256 verifies DNSKEY=35886/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`net. 86400 IN RRSIG ( DNSKEY 8 1 86400 20221016162830 20221001162330 35886 net. EHnUfreJvviwKHIx2c48TvPr7dd5KjwVzjvd27/S0FjpEIiKX1LQy7glx6Qi/sIfLAh/Z2dsub+6 ftVpeSb6c54lW353vb9ZoydSNg8Yut6p6P++Ym8reoB7Qvd8Caw/hkjR8dvHpmHFtutbW6XIh8Sw PNuv4No8c3hXMaKyg7LKZJyhRbbGStrOXVr+tQO8u7nIwJBFEA8tSwHm1iDHaEH/1s3KmZdE9x6k pdn184LQq4RK2YHKgK0umOnVDzSzYK0EKE/VjzsDFa44h2csTGOQLAlem5Cf0Jf0Jky4FbTd5F04 jde6+E/UiObE3cPOLyi6atvwldaQIWW+D6Sa5A== )`
	RRSIG=35886 and DNSKEY=35886/SEP verifies the DNSKEY RRset
	DNSKEY=4403 is now in the chain-of-trust
	Query to b.gtld-servers.net for bogus.d2a1n1.rootcanary.net/A
	Received 437 bytes from 192.33.14.30
	;; Response received from 192.33.14.30 (437 octets) ;; HEADER SECTION ;; id = 20052 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 3 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; bogus.d2a1n1.rootcanary.net. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) rootcanary.net. 172800 IN NS ns1.surfnet.nl. rootcanary.net. 172800 IN NS ns2.surfnet.nl. rootcanary.net. 172800 IN NS ns3.surfnet.nl. rootcanary.net. 172800 IN NS ns1.zurich.surf.net. rootcanary.net. 86400 IN DS ( 64786 8 2 5cd8f125f5487708121a497bd0b1079406add42002b3c195ee0669d2aeb763c9 ) rootcanary.net. 86400 IN RRSIG ( DS 8 2 86400 20221010061821 20221003050821 4403 net. WqV+oflii5iEtWHJnlxSFegOffpNtGTOwS3zjYlVM0nfd/JVe8WXAnXKCZXqOv5dtZzGVLgbgMLE nAqG5nJkk6krVFQo80Qjs3HhNnyG4FT0qEv4elOIquInfHrZPk2AdqHEXTePE4VDDc3xC/qtKX/v xZi/xbY3LelRBlUq8gCTiwKH2FIETvbUKChDeFSC5I6z1YyeJOleapcV9OnSSA== ) ;; ADDITIONAL SECTION (3 records) ns1.zurich.surf.net. 172800 IN A 195.176.255.9 ns1.zurich.surf.net. 172800 IN AAAA 2001:620:0:9::1103 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to g.gtld-servers.net for rootcanary.net/DNSKEY
	Received 424 bytes from 192.42.93.30
	;; Response received from 192.42.93.30 (424 octets) ;; HEADER SECTION ;; id = 30953 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 3 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; rootcanary.net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) rootcanary.net. 172800 IN NS ns1.surfnet.nl. rootcanary.net. 172800 IN NS ns2.surfnet.nl. rootcanary.net. 172800 IN NS ns3.surfnet.nl. rootcanary.net. 172800 IN NS ns1.zurich.surf.net. rootcanary.net. 86400 IN DS ( 64786 8 2 5cd8f125f5487708121a497bd0b1079406add42002b3c195ee0669d2aeb763c9 ) rootcanary.net. 86400 IN RRSIG ( DS 8 2 86400 20221010061821 20221003050821 4403 net. WqV+oflii5iEtWHJnlxSFegOffpNtGTOwS3zjYlVM0nfd/JVe8WXAnXKCZXqOv5dtZzGVLgbgMLE nAqG5nJkk6krVFQo80Qjs3HhNnyG4FT0qEv4elOIquInfHrZPk2AdqHEXTePE4VDDc3xC/qtKX/v xZi/xbY3LelRBlUq8gCTiwKH2FIETvbUKChDeFSC5I6z1YyeJOleapcV9OnSSA== ) ;; ADDITIONAL SECTION (3 records) ns1.zurich.surf.net. 172800 IN A 195.176.255.9 ns1.zurich.surf.net. 172800 IN AAAA 2001:620:0:9::1103 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone rootcanary.net

rootcanary.net

	Checking DS between net and rootcanary.net
	Query to j.gtld-servers.net for rootcanary.net/DS
	Received 1186 bytes from 192.48.79.30
	;; Response received from 192.48.79.30 (1186 octets) ;; HEADER SECTION ;; id = 43036 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 14 arcount = 23 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; rootcanary.net. IN DS ;; ANSWER SECTION (2 records) rootcanary.net. 86400 IN DS ( 64786 8 2 5cd8f125f5487708121a497bd0b1079406add42002b3c195ee0669d2aeb763c9 ) rootcanary.net. 86400 IN RRSIG ( DS 8 2 86400 20221010061821 20221003050821 4403 net. WqV+oflii5iEtWHJnlxSFegOffpNtGTOwS3zjYlVM0nfd/JVe8WXAnXKCZXqOv5dtZzGVLgbgMLE nAqG5nJkk6krVFQo80Qjs3HhNnyG4FT0qEv4elOIquInfHrZPk2AdqHEXTePE4VDDc3xC/qtKX/v xZi/xbY3LelRBlUq8gCTiwKH2FIETvbUKChDeFSC5I6z1YyeJOleapcV9OnSSA== ) ;; AUTHORITY SECTION (14 records) net. 172800 IN NS e.gtld-servers.net. net. 172800 IN NS f.gtld-servers.net. net. 172800 IN NS j.gtld-servers.net. net. 172800 IN NS h.gtld-servers.net. net. 172800 IN NS m.gtld-servers.net. net. 172800 IN NS l.gtld-servers.net. net. 172800 IN NS i.gtld-servers.net. net. 172800 IN NS g.gtld-servers.net. net. 172800 IN NS b.gtld-servers.net. net. 172800 IN NS d.gtld-servers.net. net. 172800 IN NS c.gtld-servers.net. net. 172800 IN NS k.gtld-servers.net. net. 172800 IN NS a.gtld-servers.net. net. 172800 IN RRSIG ( NS 8 1 172800 20221012062816 20221005051816 4403 net. vbL7VP41ZPbJBGQw7uSiCv1JnOAnQE9P8yI3gGFKGbxXBdusHTswFgSOU2jCG+0jgVOJ+88fR5Pv w7IQGqqmmUFawyDYU59UJkkSBdLXI5Ivzuc9YnLxaeilWT58F89ZSP6/mZXUB5zaGRmjTxdEJbfP 4XzYFCvrUNF1DxOPNtRsvwRJFeykylJZdPkHtQpTp8mz95eJHbZnlzzFD/+Ehg== ) ;; ADDITIONAL SECTION (23 records) e.gtld-servers.net. 172800 IN A 192.12.94.30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 f.gtld-servers.net. 172800 IN A 192.35.51.30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 j.gtld-servers.net. 172800 IN A 192.48.79.30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 h.gtld-servers.net. 172800 IN A 192.54.112.30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 m.gtld-servers.net. 172800 IN A 192.55.83.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 l.gtld-servers.net. 172800 IN A 192.41.162.30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 i.gtld-servers.net. 172800 IN A 192.43.172.30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 g.gtld-servers.net. 172800 IN A 192.42.93.30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 b.gtld-servers.net. 172800 IN A 192.33.14.30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 d.gtld-servers.net. 172800 IN A 192.31.80.30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 c.gtld-servers.net. 172800 IN A 192.26.92.30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 1 DS records for rootcanary.net in the net zone
	DS=64786/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`rootcanary.net. 86400 IN RRSIG ( DS 8 2 86400 20221010061821 20221003050821 4403 net. WqV+oflii5iEtWHJnlxSFegOffpNtGTOwS3zjYlVM0nfd/JVe8WXAnXKCZXqOv5dtZzGVLgbgMLE nAqG5nJkk6krVFQo80Qjs3HhNnyG4FT0qEv4elOIquInfHrZPk2AdqHEXTePE4VDDc3xC/qtKX/v xZi/xbY3LelRBlUq8gCTiwKH2FIETvbUKChDeFSC5I6z1YyeJOleapcV9OnSSA== )`
	RRSIG=4403 and DNSKEY=4403 verifies the DS RRset
	DS=64786/SHA-256 is now in the chain-of-trust
	`rootcanary.net. 86400 IN DS ( 64786 8 2 5cd8f125f5487708121a497bd0b1079406add42002b3c195ee0669d2aeb763c9 )`
	Query to ns1.zurich.surf.net for rootcanary.net/DNSKEY
	Received 513 bytes from 195.176.255.9
	;; Response received from 195.176.255.9 (513 octets) ;; HEADER SECTION ;; id = 20263 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; rootcanary.net. IN DNSKEY ;; ANSWER SECTION (3 records) rootcanary.net. 60 IN DNSKEY ( 257 3 8 AwEAAdDk0xPx74/+J4BFAtodd6j2yTDoX9D+paSjzxVl+jMQmrsrQprdBxX3fale9f62j4oo7scf U+wabBXl56lehbw/wds6oVqDNun9ORQisXhIq9H+u3a9WtTAF+OQyPoSirRLYdNR7+wWvb88L27w 88+jL0gkFb8klGzr03EFrq6r ) ; Key ID = 64786 rootcanary.net. 60 IN DNSKEY ( 256 3 8 AwEAAbTt2EpLNxL2BJh6zgrhiEBK1sfxYPvEQgQkM1O53+lnT+c8W+9lYMhI1m2mLwecKvq7ePok 5d1XO11UKUXV5pRD9d66qXLwDxMJ4krEMlOvmMS/HWskybkREtMdPdcv5eNdtuT8VeCPTGZuoNe2 oEK4NFSUU5eG0pkWo27Kl3oV ) ; Key ID = 25188 rootcanary.net. 60 IN RRSIG ( DNSKEY 8 2 60 20221119063702 20221004063702 64786 rootcanary.net. VBDUV1sJ7HBE4Q/1sxljWuoeFr+mwepohRiDczk53Gy/EYkJpML7RnHb+AYbxE6A4bSBttK61LbJ hIaDnClbJFmT90sF12X98cCqMqwzn5yQQU1NLtwW4k5gjRDzzrgkicfMRhQipHBEEJ0/2j+9YRc5 0vMQl1qx6D4Y5QeXeHM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DNSKEY records for rootcanary.net
	`rootcanary.net. 60 IN DNSKEY ( 257 3 8 AwEAAdDk0xPx74/+J4BFAtodd6j2yTDoX9D+paSjzxVl+jMQmrsrQprdBxX3fale9f62j4oo7scf U+wabBXl56lehbw/wds6oVqDNun9ORQisXhIq9H+u3a9WtTAF+OQyPoSirRLYdNR7+wWvb88L27w 88+jL0gkFb8klGzr03EFrq6r ) ; Key ID = 64786`
	`rootcanary.net. 60 IN DNSKEY ( 256 3 8 AwEAAbTt2EpLNxL2BJh6zgrhiEBK1sfxYPvEQgQkM1O53+lnT+c8W+9lYMhI1m2mLwecKvq7ePok 5d1XO11UKUXV5pRD9d66qXLwDxMJ4krEMlOvmMS/HWskybkREtMdPdcv5eNdtuT8VeCPTGZuoNe2 oEK4NFSUU5eG0pkWo27Kl3oV ) ; Key ID = 25188`
	DNSKEY=64786/SEP is now in the chain-of-trust
	DS=64786/SHA-256 verifies DNSKEY=64786/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`rootcanary.net. 60 IN RRSIG ( DNSKEY 8 2 60 20221119063702 20221004063702 64786 rootcanary.net. VBDUV1sJ7HBE4Q/1sxljWuoeFr+mwepohRiDczk53Gy/EYkJpML7RnHb+AYbxE6A4bSBttK61LbJ hIaDnClbJFmT90sF12X98cCqMqwzn5yQQU1NLtwW4k5gjRDzzrgkicfMRhQipHBEEJ0/2j+9YRc5 0vMQl1qx6D4Y5QeXeHM= )`
	RRSIG=64786 and DNSKEY=64786/SEP verifies the DNSKEY RRset
	DNSKEY=25188 is now in the chain-of-trust
	Query to ns1.zurich.surf.net for bogus.d2a1n1.rootcanary.net/A
	Received 253 bytes from 195.176.255.9
	;; Response received from 195.176.255.9 (253 octets) ;; HEADER SECTION ;; id = 4214 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; bogus.d2a1n1.rootcanary.net. IN A ;; ANSWER SECTION (2 records) bogus.d2a1n1.rootcanary.net. 60 IN A 145.97.20.20 bogus.d2a1n1.rootcanary.net. 60 IN RRSIG ( A 1 4 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. k/gqZ1XZbOi0HDm5uqy7yLZjJ2AHZlQkUkiTZjIpFxXNUpKzFxjmW2A6m5DxGwtIgP4BSLT5nL0z LpYJ3gaZnJF6PbdKP84f05ZPu5wqYGcn5XCt8KKq/x5XnYl0/B7tan0oWuGKI+gk34YHm9uH6aXL g3n9kjOfNUnqIEcTE5A= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	ns1.zurich.surf.net is authoritative for bogus.d2a1n1.rootcanary.net
	Query to ns3.surfnet.nl for d2a1n1.rootcanary.net/DNSKEY
	Received 379 bytes from 195.169.124.71
	;; Response received from 195.169.124.71 (379 octets) ;; HEADER SECTION ;; id = 43732 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; d2a1n1.rootcanary.net. IN DNSKEY ;; ANSWER SECTION (2 records) d2a1n1.rootcanary.net. 60 IN DNSKEY ( 257 3 1 AwEAAdXdLh4S/z+hiYnykt3tRC2jUcdhRto7PbSxyz20iS+WSJrPCVM6KyeCRYO3/2RxOruwD02M /WO3b1bUgnj+XhTn+oAxV2pZPxulTVmqmuQccE+2FocU83c7VQYje+Q2i2AW95YTPD7AEMLreC3x 8A7aRFVxwXXwvkjmaNu0K14x ) ; Key ID = 11102 d2a1n1.rootcanary.net. 60 IN RRSIG ( DNSKEY 1 3 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. cw24B+dIeDlj6VplKKqekInEMH+FWkO/l1ocjlh6GaIc20szR09nb/JUq/9FVIy7RXp9cU+iky1R 2OlWogWbeODAwESOTffvSUU3VYkljzH8VlqvL8tw7gaovnu48zZUOAZdtLkFfEkX1w79GjIKs1+r Uq28Q4GDF8a26Vv3WuY= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone d2a1n1.rootcanary.net
	Attempting to learn nameservers for d2a1n1.rootcanary.net
	Query to ns3.surfnet.nl for d2a1n1.rootcanary.net/NS
	Received 276 bytes from 195.169.124.71
	;; Response received from 195.169.124.71 (276 octets) ;; HEADER SECTION ;; id = 22665 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; d2a1n1.rootcanary.net. IN NS ;; ANSWER SECTION (3 records) d2a1n1.rootcanary.net. 60 IN NS sec1.rcode0.net. d2a1n1.rootcanary.net. 60 IN NS sec2.rcode0.net. d2a1n1.rootcanary.net. 60 IN RRSIG ( NS 1 3 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. r6xLvviT/Jk6cr/OgFDMKpIggstcra8hlJYESz6A77XSazP5no934ekniYGZQLM5Yk52XMi9lBkC UDKNBPHQb7cwCjSKw3xzuQ6qo3R+DlKOZB5LoysfgSd3tSEyAEnzqP0ntglyqyXugaq32THAwUZo vFh/IAiaRMS2tr0lF1E= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found d2a1n1.rootcanary.net nameservers: sec1.rcode0.net, sec2.rcode0.net

d2a1n1.rootcanary.net

	Checking DS between rootcanary.net and d2a1n1.rootcanary.net
	Query to ns3.surfnet.nl for d2a1n1.rootcanary.net/DS
	Received 272 bytes from 195.169.124.71
	;; Response received from 195.169.124.71 (272 octets) ;; HEADER SECTION ;; id = 19995 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; d2a1n1.rootcanary.net. IN DS ;; ANSWER SECTION (2 records) d2a1n1.rootcanary.net. 60 IN DS ( 11102 1 2 61a8b809ca2e35b9a082a9998c2b33cb1657b1151d65bdb92805592b181c9382 ) d2a1n1.rootcanary.net. 60 IN RRSIG ( DS 8 3 60 20221119063702 20221004063702 25188 rootcanary.net. EcKz7/r3j5ayrOICGx9vZftlmS/QW/qqiLX3g418ffTQ21YFiAU/pQEcwDAU3i/z/c3OVCeP/3xN DZcNLGPYFmnY6K7l2ce7mRMJ3TCwXobgjsqlwYyDqtZu/NAv3hUiBUUIdI5q/WulfFYb6DkQENdk CWQTl+9wpsLQmi/nLfg= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 1 DS records for d2a1n1.rootcanary.net in the rootcanary.net zone
	DS=11102/SHA-256 has algorithm RSAMD5
	Found 1 RRSIGs over DS RRset
	`d2a1n1.rootcanary.net. 60 IN RRSIG ( DS 8 3 60 20221119063702 20221004063702 25188 rootcanary.net. EcKz7/r3j5ayrOICGx9vZftlmS/QW/qqiLX3g418ffTQ21YFiAU/pQEcwDAU3i/z/c3OVCeP/3xN DZcNLGPYFmnY6K7l2ce7mRMJ3TCwXobgjsqlwYyDqtZu/NAv3hUiBUUIdI5q/WulfFYb6DkQENdk CWQTl+9wpsLQmi/nLfg= )`
	RRSIG=25188 and DNSKEY=25188 verifies the DS RRset
	DS=11102/SHA-256 is now in the chain-of-trust
	`d2a1n1.rootcanary.net. 60 IN DS ( 11102 1 2 61a8b809ca2e35b9a082a9998c2b33cb1657b1151d65bdb92805592b181c9382 )`
	Query to sec2.rcode0.net for d2a1n1.rootcanary.net/DNSKEY
	Received 379 bytes from 176.97.158.100
	;; Response received from 176.97.158.100 (379 octets) ;; HEADER SECTION ;; id = 8624 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option: ;; QUESTION SECTION (1 record) ;; d2a1n1.rootcanary.net. IN DNSKEY ;; ANSWER SECTION (2 records) d2a1n1.rootcanary.net. 60 IN RRSIG ( DNSKEY 1 3 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. cw24B+dIeDlj6VplKKqekInEMH+FWkO/l1ocjlh6GaIc20szR09nb/JUq/9FVIy7RXp9cU+iky1R 2OlWogWbeODAwESOTffvSUU3VYkljzH8VlqvL8tw7gaovnu48zZUOAZdtLkFfEkX1w79GjIKs1+r Uq28Q4GDF8a26Vv3WuY= ) d2a1n1.rootcanary.net. 60 IN DNSKEY ( 257 3 1 AwEAAdXdLh4S/z+hiYnykt3tRC2jUcdhRto7PbSxyz20iS+WSJrPCVM6KyeCRYO3/2RxOruwD02M /WO3b1bUgnj+XhTn+oAxV2pZPxulTVmqmuQccE+2FocU83c7VQYje+Q2i2AW95YTPD7AEMLreC3x 8A7aRFVxwXXwvkjmaNu0K14x ) ; Key ID = 11102 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option:
	Found 1 DNSKEY records for d2a1n1.rootcanary.net
	`d2a1n1.rootcanary.net. 60 IN DNSKEY ( 257 3 1 AwEAAdXdLh4S/z+hiYnykt3tRC2jUcdhRto7PbSxyz20iS+WSJrPCVM6KyeCRYO3/2RxOruwD02M /WO3b1bUgnj+XhTn+oAxV2pZPxulTVmqmuQccE+2FocU83c7VQYje+Q2i2AW95YTPD7AEMLreC3x 8A7aRFVxwXXwvkjmaNu0K14x ) ; Key ID = 11102`
	DNSKEY=11102/SEP is now in the chain-of-trust
	DS=11102/SHA-256 verifies DNSKEY=11102/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`d2a1n1.rootcanary.net. 60 IN RRSIG ( DNSKEY 1 3 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. cw24B+dIeDlj6VplKKqekInEMH+FWkO/l1ocjlh6GaIc20szR09nb/JUq/9FVIy7RXp9cU+iky1R 2OlWogWbeODAwESOTffvSUU3VYkljzH8VlqvL8tw7gaovnu48zZUOAZdtLkFfEkX1w79GjIKs1+r Uq28Q4GDF8a26Vv3WuY= )`
	RRSIG=11102 and DNSKEY=11102/SEP verifies the DNSKEY RRset
	Query to sec2.rcode0.net for bogus.d2a1n1.rootcanary.net/A
	Received 253 bytes from 176.97.158.100
	;; Response received from 176.97.158.100 (253 octets) ;; HEADER SECTION ;; id = 17353 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option: ;; QUESTION SECTION (1 record) ;; bogus.d2a1n1.rootcanary.net. IN A ;; ANSWER SECTION (2 records) bogus.d2a1n1.rootcanary.net. 60 IN RRSIG ( A 1 4 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. k/gqZ1XZbOi0HDm5uqy7yLZjJ2AHZlQkUkiTZjIpFxXNUpKzFxjmW2A6m5DxGwtIgP4BSLT5nL0z LpYJ3gaZnJF6PbdKP84f05ZPu5wqYGcn5XCt8KKq/x5XnYl0/B7tan0oWuGKI+gk34YHm9uH6aXL g3n9kjOfNUnqIEcTE5A= ) bogus.d2a1n1.rootcanary.net. 60 IN A 145.97.20.20 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option:
	sec2.rcode0.net is authoritative for bogus.d2a1n1.rootcanary.net
	Query to sec1.rcode0.net for bogus.d2a1n1.rootcanary.net/DNSKEY
	Received 530 bytes from 192.174.68.100
	;; Response received from 192.174.68.100 (530 octets) ;; HEADER SECTION ;; id = 3828 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option: ;; QUESTION SECTION (1 record) ;; bogus.d2a1n1.rootcanary.net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) d2a1n1.rootcanary.net. 60 IN SOA ( ns1.surfnet.nl. dns-beheer.surfnet.nl. 2022100505 ;serial 10800 ;refresh 3600 ;retry 604800 ;expire 86400 ;minimum ) d2a1n1.rootcanary.net. 60 IN RRSIG ( SOA 1 3 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. VBYT5Eg+mlW9kaERQvvHSRFX3ocRvktzp+i5v3IbMASyfhSEMn0Xpdph4bNbRYe6HmISEKc3Jom9 EJnLI9XWUok5AyWF7721AXNQ92ujphmq8gFOP2aLG7CEjXtngvWg2UWE8JUHBLCsOriliQ2Yajc5 Ps55WnxIFsCTsdJr/oQ= ) bogus.d2a1n1.rootcanary.net. 60 IN NSEC ( *.bogus.d2a1n1.rootcanary.net. A AAAA RRSIG NSEC ) bogus.d2a1n1.rootcanary.net. 60 IN RRSIG ( NSEC 1 4 86400 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. X+/J0dnhI8/jiPYDlKivR6YyAUf5cj2zC8l4tOtcYV6M73gWvd9oPt+ccHHo2bHAcoZcgrUVmUiq 5SGD2/iEN4vGk/yMWCa3rYCbAZJaobc00TBQ9rPqtaTRlI8bfpw0ATtBMjKSCLczuhXFrQArHZ4Z jqOZqcimdmBJxeaLJM0= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option:
	Found RRSIG signed by d2a1n1.rootcanary.net zone
	Query to sec1.rcode0.net for d2a1n1.rootcanary.net/SOA
	Received 292 bytes from 192.174.68.100
	;; Response received from 192.174.68.100 (292 octets) ;; HEADER SECTION ;; id = 42132 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option: ;; QUESTION SECTION (1 record) ;; d2a1n1.rootcanary.net. IN SOA ;; ANSWER SECTION (2 records) d2a1n1.rootcanary.net. 60 IN SOA ( ns1.surfnet.nl. dns-beheer.surfnet.nl. 2022100505 ;serial 10800 ;refresh 3600 ;retry 604800 ;expire 86400 ;minimum ) d2a1n1.rootcanary.net. 60 IN RRSIG ( SOA 1 3 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. VBYT5Eg+mlW9kaERQvvHSRFX3ocRvktzp+i5v3IbMASyfhSEMn0Xpdph4bNbRYe6HmISEKc3Jom9 EJnLI9XWUok5AyWF7721AXNQ92ujphmq8gFOP2aLG7CEjXtngvWg2UWE8JUHBLCsOriliQ2Yajc5 Ps55WnxIFsCTsdJr/oQ= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option:
	Query to sec2.rcode0.net for bogus.d2a1n1.rootcanary.net/A
	Received 253 bytes from 176.97.158.100
	;; Response received from 176.97.158.100 (253 octets) ;; HEADER SECTION ;; id = 21838 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option: ;; QUESTION SECTION (1 record) ;; bogus.d2a1n1.rootcanary.net. IN A ;; ANSWER SECTION (2 records) bogus.d2a1n1.rootcanary.net. 60 IN RRSIG ( A 1 4 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. k/gqZ1XZbOi0HDm5uqy7yLZjJ2AHZlQkUkiTZjIpFxXNUpKzFxjmW2A6m5DxGwtIgP4BSLT5nL0z LpYJ3gaZnJF6PbdKP84f05ZPu5wqYGcn5XCt8KKq/x5XnYl0/B7tan0oWuGKI+gk34YHm9uH6aXL g3n9kjOfNUnqIEcTE5A= ) bogus.d2a1n1.rootcanary.net. 60 IN A 145.97.20.20 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option:
	bogus.d2a1n1.rootcanary.net A RR has value 145.97.20.20
	Found 1 RRSIGs over A RRset
	`bogus.d2a1n1.rootcanary.net. 60 IN RRSIG ( A 1 4 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. k/gqZ1XZbOi0HDm5uqy7yLZjJ2AHZlQkUkiTZjIpFxXNUpKzFxjmW2A6m5DxGwtIgP4BSLT5nL0z LpYJ3gaZnJF6PbdKP84f05ZPu5wqYGcn5XCt8KKq/x5XnYl0/B7tan0oWuGKI+gk34YHm9uH6aXL g3n9kjOfNUnqIEcTE5A= )`
	RRSIG=11102 and DNSKEY=11102/SEP does not verify the A RRset (signature verification failed)
	None of the 1 RRSIG and 1 DNSKEY records validate the A RRset
	The A RRset was not signed by any trusted keys

d2a1n1.rootcanary.net

	Query to sec1.rcode0.net for bogus.d2a1n1.rootcanary.net/A
	Received 253 bytes from 192.174.68.100
	;; Response received from 192.174.68.100 (253 octets) ;; HEADER SECTION ;; id = 44595 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option: ;; QUESTION SECTION (1 record) ;; bogus.d2a1n1.rootcanary.net. IN A ;; ANSWER SECTION (2 records) bogus.d2a1n1.rootcanary.net. 60 IN RRSIG ( A 1 4 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. k/gqZ1XZbOi0HDm5uqy7yLZjJ2AHZlQkUkiTZjIpFxXNUpKzFxjmW2A6m5DxGwtIgP4BSLT5nL0z LpYJ3gaZnJF6PbdKP84f05ZPu5wqYGcn5XCt8KKq/x5XnYl0/B7tan0oWuGKI+gk34YHm9uH6aXL g3n9kjOfNUnqIEcTE5A= ) bogus.d2a1n1.rootcanary.net. 60 IN A 145.97.20.20 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option:
	sec1.rcode0.net is authoritative for bogus.d2a1n1.rootcanary.net
	Query to sec1.rcode0.net for bogus.d2a1n1.rootcanary.net/DNSKEY
	Received 530 bytes from 192.174.68.100
	;; Response received from 192.174.68.100 (530 octets) ;; HEADER SECTION ;; id = 13736 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option: ;; QUESTION SECTION (1 record) ;; bogus.d2a1n1.rootcanary.net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) d2a1n1.rootcanary.net. 60 IN SOA ( ns1.surfnet.nl. dns-beheer.surfnet.nl. 2022100505 ;serial 10800 ;refresh 3600 ;retry 604800 ;expire 86400 ;minimum ) d2a1n1.rootcanary.net. 60 IN RRSIG ( SOA 1 3 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. VBYT5Eg+mlW9kaERQvvHSRFX3ocRvktzp+i5v3IbMASyfhSEMn0Xpdph4bNbRYe6HmISEKc3Jom9 EJnLI9XWUok5AyWF7721AXNQ92ujphmq8gFOP2aLG7CEjXtngvWg2UWE8JUHBLCsOriliQ2Yajc5 Ps55WnxIFsCTsdJr/oQ= ) bogus.d2a1n1.rootcanary.net. 60 IN NSEC ( *.bogus.d2a1n1.rootcanary.net. A AAAA RRSIG NSEC ) bogus.d2a1n1.rootcanary.net. 60 IN RRSIG ( NSEC 1 4 86400 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. X+/J0dnhI8/jiPYDlKivR6YyAUf5cj2zC8l4tOtcYV6M73gWvd9oPt+ccHHo2bHAcoZcgrUVmUiq 5SGD2/iEN4vGk/yMWCa3rYCbAZJaobc00TBQ9rPqtaTRlI8bfpw0ATtBMjKSCLczuhXFrQArHZ4Z jqOZqcimdmBJxeaLJM0= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option:
	Found RRSIG signed by d2a1n1.rootcanary.net zone
	Query to sec1.rcode0.net for bogus.d2a1n1.rootcanary.net/A
	Received 253 bytes from 192.174.68.100
	;; Response received from 192.174.68.100 (253 octets) ;; HEADER SECTION ;; id = 42012 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option: ;; QUESTION SECTION (1 record) ;; bogus.d2a1n1.rootcanary.net. IN A ;; ANSWER SECTION (2 records) bogus.d2a1n1.rootcanary.net. 60 IN RRSIG ( A 1 4 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. k/gqZ1XZbOi0HDm5uqy7yLZjJ2AHZlQkUkiTZjIpFxXNUpKzFxjmW2A6m5DxGwtIgP4BSLT5nL0z LpYJ3gaZnJF6PbdKP84f05ZPu5wqYGcn5XCt8KKq/x5XnYl0/B7tan0oWuGKI+gk34YHm9uH6aXL g3n9kjOfNUnqIEcTE5A= ) bogus.d2a1n1.rootcanary.net. 60 IN A 145.97.20.20 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1400 ;; option:
	bogus.d2a1n1.rootcanary.net A RR has value 145.97.20.20
	Found 1 RRSIGs over A RRset
	`bogus.d2a1n1.rootcanary.net. 60 IN RRSIG ( A 1 4 60 20221119063702 20221004063702 11102 d2a1n1.rootcanary.net. k/gqZ1XZbOi0HDm5uqy7yLZjJ2AHZlQkUkiTZjIpFxXNUpKzFxjmW2A6m5DxGwtIgP4BSLT5nL0z LpYJ3gaZnJF6PbdKP84f05ZPu5wqYGcn5XCt8KKq/x5XnYl0/B7tan0oWuGKI+gk34YHm9uH6aXL g3n9kjOfNUnqIEcTE5A= )`
	RRSIG=11102 and DNSKEY=11102/SEP does not verify the A RRset (signature verification failed)
	None of the 1 RRSIG and 1 DNSKEY records validate the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test bogus.d2a1n1.rootcanary.net at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: