DNSSEC Debugger - disa.mil

Domain Name:

Time: 2025-05-21 15:11:53 UTC

Analyzing DNSSEC problems for disa.mil

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to k.root-servers.net for ./DNSKEY
	Received 1139 bytes from 193.0.14.129
	;; Response received from [193.0.14.129] 1139 octets ;; HEADER SECTION ;; id = 43523 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAbEbGCpGTDrcZTWqWWE72nphyshpRcILdzCVlBGU9Ln1Fui9kkseUOP+g5GLUeVFKdTloeRT A9+EYiQdXgWXmXmuW/nGxZjAikluF/O9NzLVrr5iZnth2xu+F48nrJlAgWWiMNau54NI5sZ3iVQf hFsq2pZmf43RauRPniYMShOLO7EBWWXr5glDSgZGS9fSm6xHwwF+g8D4m8oanjvdCBNxXzSEKS31 ibxjLifTfvwCg3y4XXcNW9U6Nu3JmoKUdxqpPPIkBvVQbIz4UO2FwaR13uXC03ALP1Yx2QNSS4SZ lcIMtAftQR9wtCiuPWQnFv4jkzWqlhp1Lmf7bcoL9yk= ) ; keytag 53148 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20250611000000 20250521000000 20326 . ki8fK9M8rb/I+LSCC+6ZKil/CLh4jxV//8F/PDAFtzupjzeyCotFHL+Tm6kwL2wEOrZaz0a6rEba ZFhLGP+Z1XV0WJb45V0ajLFhU+IV4VCDVbzlXKQ3isrKymu8U7zrj3d/NoPbZAbxGkMfI56xv6Ev FvRYa9bjnIm0Id94ONqFclrlQTNEL25Nq+tDOH/Ro709M4j0NOcW5Ui6gIlILfsvEma+g+rHVMeJ N7Yu5FpOzaCvajJKdDGf4O3e1BI4UGrvxsLaZZGSUkeUifobG6FrTpewm9vDkU0kHfGKPqZurEuk mXcfCb/jevjBQhGG8HwoAQy4nS6IjWGfCjK3CQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbEbGCpGTDrcZTWqWWE72nphyshpRcILdzCVlBGU9Ln1Fui9kkseUOP+g5GLUeVFKdTloeRT A9+EYiQdXgWXmXmuW/nGxZjAikluF/O9NzLVrr5iZnth2xu+F48nrJlAgWWiMNau54NI5sZ3iVQf hFsq2pZmf43RauRPniYMShOLO7EBWWXr5glDSgZGS9fSm6xHwwF+g8D4m8oanjvdCBNxXzSEKS31 ibxjLifTfvwCg3y4XXcNW9U6Nu3JmoKUdxqpPPIkBvVQbIz4UO2FwaR13uXC03ALP1Yx2QNSS4SZ lcIMtAftQR9wtCiuPWQnFv4jkzWqlhp1Lmf7bcoL9yk= ) ; keytag 53148`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20250611000000 20250521000000 20326 . ki8fK9M8rb/I+LSCC+6ZKil/CLh4jxV//8F/PDAFtzupjzeyCotFHL+Tm6kwL2wEOrZaz0a6rEba ZFhLGP+Z1XV0WJb45V0ajLFhU+IV4VCDVbzlXKQ3isrKymu8U7zrj3d/NoPbZAbxGkMfI56xv6Ev FvRYa9bjnIm0Id94ONqFclrlQTNEL25Nq+tDOH/Ro709M4j0NOcW5Ui6gIlILfsvEma+g+rHVMeJ N7Yu5FpOzaCvajJKdDGf4O3e1BI4UGrvxsLaZZGSUkeUifobG6FrTpewm9vDkU0kHfGKPqZurEuk mXcfCb/jevjBQhGG8HwoAQy4nS6IjWGfCjK3CQ== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=53148 is now in the chain-of-trust
	DNSKEY=38696/SEP is now in the chain-of-trust
	Query to a.root-servers.net for disa.mil/A
	Received 755 bytes from 198.41.0.4
	;; Response received from [198.41.0.4] 755 octets ;; HEADER SECTION ;; id = 27080 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) mil. 172800 IN NS con1.nipr.mil. mil. 172800 IN NS eur1.nipr.mil. mil. 172800 IN NS pac2.nipr.mil. mil. 172800 IN NS con2.nipr.mil. mil. 172800 IN NS eur2.nipr.mil. mil. 172800 IN NS pac1.nipr.mil. mil. 86400 IN DS ( 63500 8 2 3baa83867103d6604a124282063f295e1b15c87cc13cb875a42f5754a912ebe0 ) mil. 86400 IN RRSIG ( DS 8 1 86400 20250603050000 20250521040000 53148 . KM/dVHAotw1pZjYQiZ9m9D1avdQBZTzZvXLTZfqXhDvoP8R2gDuYRx2SMxbV4zPJSCq5Gmbvwg4T Bi6pPOUMBTog9pJD0T46BNoUuUJrZZ3GjO0UA8ej6QWUdX+EsunGITPexbERJyTdg2g1DBGoB7ay pxUUqib/TJfoCNd+clCjaKl0vVEy9IOCc7KrUGA+w2fAHaxBB4NcIdUX1MypQvO7PTihvWD7n1n9 uHzmFRePboanSXCkQ2d3N7Up4FBXPDzf1SihQ/IMhHu9VBGS2hJEf285D9FEc/Z40DpXPy86fbr2 R3zJMzUtovkc9TzVPXTz9di3n02eltNaI5zxAQ== ) ;; ADDITIONAL SECTION (13 records) con1.nipr.mil. 172800 IN A 199.252.157.234 con1.nipr.mil. 172800 IN AAAA 2608:140:c:157::234 eur1.nipr.mil. 172800 IN A 199.252.154.234 eur1.nipr.mil. 172800 IN AAAA 2608:4122:2:154::234 pac2.nipr.mil. 172800 IN A 199.252.155.234 pac2.nipr.mil. 172800 IN AAAA 2608:c144:1:155::234 con2.nipr.mil. 172800 IN A 199.252.162.234 con2.nipr.mil. 172800 IN AAAA 2608:120:c:162::234 eur2.nipr.mil. 172800 IN A 199.252.143.234 eur2.nipr.mil. 172800 IN AAAA 2608:4163:1:143::234 pac1.nipr.mil. 172800 IN A 199.252.180.234 pac1.nipr.mil. 172800 IN AAAA 2608:c184:1:180::234 ;; { "EDNS-VERSION": 0 }
	Query to k.root-servers.net for mil/DNSKEY
	Received 750 bytes from 193.0.14.129
	;; Response received from [193.0.14.129] 750 octets ;; HEADER SECTION ;; id = 52273 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mil. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) mil. 172800 IN NS con1.nipr.mil. mil. 172800 IN NS con2.nipr.mil. mil. 172800 IN NS eur1.nipr.mil. mil. 172800 IN NS eur2.nipr.mil. mil. 172800 IN NS pac1.nipr.mil. mil. 172800 IN NS pac2.nipr.mil. mil. 86400 IN DS ( 63500 8 2 3baa83867103d6604a124282063f295e1b15c87cc13cb875a42f5754a912ebe0 ) mil. 86400 IN RRSIG ( DS 8 1 86400 20250603050000 20250521040000 53148 . KM/dVHAotw1pZjYQiZ9m9D1avdQBZTzZvXLTZfqXhDvoP8R2gDuYRx2SMxbV4zPJSCq5Gmbvwg4T Bi6pPOUMBTog9pJD0T46BNoUuUJrZZ3GjO0UA8ej6QWUdX+EsunGITPexbERJyTdg2g1DBGoB7ay pxUUqib/TJfoCNd+clCjaKl0vVEy9IOCc7KrUGA+w2fAHaxBB4NcIdUX1MypQvO7PTihvWD7n1n9 uHzmFRePboanSXCkQ2d3N7Up4FBXPDzf1SihQ/IMhHu9VBGS2hJEf285D9FEc/Z40DpXPy86fbr2 R3zJMzUtovkc9TzVPXTz9di3n02eltNaI5zxAQ== ) ;; ADDITIONAL SECTION (13 records) con1.nipr.mil. 172800 IN A 199.252.157.234 con2.nipr.mil. 172800 IN A 199.252.162.234 eur1.nipr.mil. 172800 IN A 199.252.154.234 eur2.nipr.mil. 172800 IN A 199.252.143.234 pac1.nipr.mil. 172800 IN A 199.252.180.234 pac2.nipr.mil. 172800 IN A 199.252.155.234 con1.nipr.mil. 172800 IN AAAA 2608:140:c:157::234 con2.nipr.mil. 172800 IN AAAA 2608:120:c:162::234 eur1.nipr.mil. 172800 IN AAAA 2608:4122:2:154::234 eur2.nipr.mil. 172800 IN AAAA 2608:4163:1:143::234 pac1.nipr.mil. 172800 IN AAAA 2608:c184:1:180::234 pac2.nipr.mil. 172800 IN AAAA 2608:c144:1:155::234 ;; { "EDNS-VERSION": 0 }
	Found child zone mil

mil

	Checking DS between . and mil
	Query to d.root-servers.net for mil/DS
	Received 367 bytes from 199.7.91.13
	;; Response received from [199.7.91.13] 367 octets ;; HEADER SECTION ;; id = 60408 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1450, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mil. IN DS ;; ANSWER SECTION (2 records) mil. 86400 IN DS ( 63500 8 2 3baa83867103d6604a124282063f295e1b15c87cc13cb875a42f5754a912ebe0 ) mil. 86400 IN RRSIG ( DS 8 1 86400 20250603050000 20250521040000 53148 . KM/dVHAotw1pZjYQiZ9m9D1avdQBZTzZvXLTZfqXhDvoP8R2gDuYRx2SMxbV4zPJSCq5Gmbvwg4T Bi6pPOUMBTog9pJD0T46BNoUuUJrZZ3GjO0UA8ej6QWUdX+EsunGITPexbERJyTdg2g1DBGoB7ay pxUUqib/TJfoCNd+clCjaKl0vVEy9IOCc7KrUGA+w2fAHaxBB4NcIdUX1MypQvO7PTihvWD7n1n9 uHzmFRePboanSXCkQ2d3N7Up4FBXPDzf1SihQ/IMhHu9VBGS2hJEf285D9FEc/Z40DpXPy86fbr2 R3zJMzUtovkc9TzVPXTz9di3n02eltNaI5zxAQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for mil in the . zone
	DS=63500/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`mil. 86400 IN RRSIG ( DS 8 1 86400 20250603050000 20250521040000 53148 . KM/dVHAotw1pZjYQiZ9m9D1avdQBZTzZvXLTZfqXhDvoP8R2gDuYRx2SMxbV4zPJSCq5Gmbvwg4T Bi6pPOUMBTog9pJD0T46BNoUuUJrZZ3GjO0UA8ej6QWUdX+EsunGITPexbERJyTdg2g1DBGoB7ay pxUUqib/TJfoCNd+clCjaKl0vVEy9IOCc7KrUGA+w2fAHaxBB4NcIdUX1MypQvO7PTihvWD7n1n9 uHzmFRePboanSXCkQ2d3N7Up4FBXPDzf1SihQ/IMhHu9VBGS2hJEf285D9FEc/Z40DpXPy86fbr2 R3zJMzUtovkc9TzVPXTz9di3n02eltNaI5zxAQ== )`
	RRSIG=53148 and DNSKEY=53148 verifies the DS RRset
	DS=63500/SHA-256 is now in the chain-of-trust
	`mil. 86400 IN DS ( 63500 8 2 3baa83867103d6604a124282063f295e1b15c87cc13cb875a42f5754a912ebe0 )`
	Query to pac1.nipr.mil for mil/DNSKEY
	Received 1061 bytes from 199.252.180.234
	;; Response received from [199.252.180.234] 1061 octets ;; HEADER SECTION ;; id = 23574 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 5 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mil. IN DNSKEY ;; ANSWER SECTION (5 records) MIL. 10800 IN DNSKEY ( 256 3 8 AwEAAbFY1ta/7QSIvICNEg3PAMiGYuVYwyVIMF3VAwswdjlef+JhCRJ6zLKhehjNh4fVShy1Fypi oScis9X47JCpZwhAveF7vAJPPxOJOR+O0Vyph4Jn/MgnW3Ctk0MBA1oG133MNo2dl8P40gfMK1Ri ZpZrquSew31yUw8LdmQpsvh3 ) ; keytag 14128 MIL. 10800 IN DNSKEY ( 257 3 8 AwEAAaVYoXAtb7EHYO8afpfixahO02I/ozDEndNc/odNBgN21DKJbo8AY5LLPsX69GLlMN9aDCQa RfGyG/ggux0iWxxEmtl1xZjeupp5OZi7XCxLnEJcXHoexTPU7PmS4BlRaZKNOcpXhfG9noZJqFM/ DWxLsnzqCFyEzjOPIDOt4sjPtgz0uPe0AevU5+pGsRGpb160bDtmXRGJCe7QJYjU8hI/zj5lO1jH pkdrJ3p+UhKO/a/kqrd6DCam+GMabK06zXfh7pACFBQi+puYu/wU4VJb0cuwwu+Qf+p4/bMJZ/Hq gUsYep03l3r3iVmUo58F1LnbyQ14oNzG+T2uZZLLxU0= ) ; keytag 63500 MIL. 10800 IN DNSKEY ( 256 3 8 AwEAAdMKFuRf2WnTOPuYPW66iQIsPnxjugRBz3F3kK8o9cUPc3IRy6wwxg/XTzJUBJF8irM+QsUj 7iQvPZrWVEcxzLpH/nqE2Buj5ov7Psjdr/TJcHdH8GczQIzMyweUczqpDbyYv2A5dqEscnQU3bBA YnY5UUDg52j9FqXfE+s5KWq9 ) ; keytag 55824 MIL. 10800 IN RRSIG ( DNSKEY 8 1 10800 20250528111224 20250521111224 55824 mil. fJWWsjnme1ArI3Pr+7h5AYUwZOdqxEtoHrRH3Nn85XKFZdKhzwWoJH5usHnBvRVSz9UJy+EEPmOX 409NrGmyRAPfI6tBblyAydrjbI5gcwslA3QFsk8FH3ozUiOX/RtVs8mpn1tLJtdmliOr2LIWJYcV SzzUl7q8ZcvA/gZqpJc= ) MIL. 10800 IN RRSIG ( DNSKEY 8 1 10800 20250528111224 20250521111224 63500 mil. kkKzVIdVBo42zpGO+ud50SGhiCbOtV4zpvfqu1LgZNoBRTxX1cxcSWkPc2Xm5UVogZulZh9XvZmV PBxn1UD4/dLmZdigMoztMGBn0xdJWU4KzCkSTUJOYBtjdeEDYkYZJf8YAwAJIq78Zp4LTAc7W76o hM5TADTVPicAJysBlMwc41yqNPcb0RLXNS0HT6Nt9mknsbfMUXwBQkzQytDD8z100qFODNJiKvaP WuAHbgKU6ibEJ7nMvF6Z8J7aHf6XiaiFmsvRpWlwPVCMXWcd+1ILshnUWrwb3gQMLk7VjZ4IPmF3 teAS65kpfBKluPeSBWCPKeYqBDjaadY1CnoJdA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for mil
	`MIL. 10800 IN DNSKEY ( 256 3 8 AwEAAbFY1ta/7QSIvICNEg3PAMiGYuVYwyVIMF3VAwswdjlef+JhCRJ6zLKhehjNh4fVShy1Fypi oScis9X47JCpZwhAveF7vAJPPxOJOR+O0Vyph4Jn/MgnW3Ctk0MBA1oG133MNo2dl8P40gfMK1Ri ZpZrquSew31yUw8LdmQpsvh3 ) ; keytag 14128`
	`MIL. 10800 IN DNSKEY ( 257 3 8 AwEAAaVYoXAtb7EHYO8afpfixahO02I/ozDEndNc/odNBgN21DKJbo8AY5LLPsX69GLlMN9aDCQa RfGyG/ggux0iWxxEmtl1xZjeupp5OZi7XCxLnEJcXHoexTPU7PmS4BlRaZKNOcpXhfG9noZJqFM/ DWxLsnzqCFyEzjOPIDOt4sjPtgz0uPe0AevU5+pGsRGpb160bDtmXRGJCe7QJYjU8hI/zj5lO1jH pkdrJ3p+UhKO/a/kqrd6DCam+GMabK06zXfh7pACFBQi+puYu/wU4VJb0cuwwu+Qf+p4/bMJZ/Hq gUsYep03l3r3iVmUo58F1LnbyQ14oNzG+T2uZZLLxU0= ) ; keytag 63500`
	`MIL. 10800 IN DNSKEY ( 256 3 8 AwEAAdMKFuRf2WnTOPuYPW66iQIsPnxjugRBz3F3kK8o9cUPc3IRy6wwxg/XTzJUBJF8irM+QsUj 7iQvPZrWVEcxzLpH/nqE2Buj5ov7Psjdr/TJcHdH8GczQIzMyweUczqpDbyYv2A5dqEscnQU3bBA YnY5UUDg52j9FqXfE+s5KWq9 ) ; keytag 55824`
	DNSKEY=63500/SEP is now in the chain-of-trust
	DS=63500/SHA-256 verifies DNSKEY=63500/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`MIL. 10800 IN RRSIG ( DNSKEY 8 1 10800 20250528111224 20250521111224 55824 mil. fJWWsjnme1ArI3Pr+7h5AYUwZOdqxEtoHrRH3Nn85XKFZdKhzwWoJH5usHnBvRVSz9UJy+EEPmOX 409NrGmyRAPfI6tBblyAydrjbI5gcwslA3QFsk8FH3ozUiOX/RtVs8mpn1tLJtdmliOr2LIWJYcV SzzUl7q8ZcvA/gZqpJc= )`
	`MIL. 10800 IN RRSIG ( DNSKEY 8 1 10800 20250528111224 20250521111224 63500 mil. kkKzVIdVBo42zpGO+ud50SGhiCbOtV4zpvfqu1LgZNoBRTxX1cxcSWkPc2Xm5UVogZulZh9XvZmV PBxn1UD4/dLmZdigMoztMGBn0xdJWU4KzCkSTUJOYBtjdeEDYkYZJf8YAwAJIq78Zp4LTAc7W76o hM5TADTVPicAJysBlMwc41yqNPcb0RLXNS0HT6Nt9mknsbfMUXwBQkzQytDD8z100qFODNJiKvaP WuAHbgKU6ibEJ7nMvF6Z8J7aHf6XiaiFmsvRpWlwPVCMXWcd+1ILshnUWrwb3gQMLk7VjZ4IPmF3 teAS65kpfBKluPeSBWCPKeYqBDjaadY1CnoJdA== )`
	RRSIG=55824 and DNSKEY=55824 verifies the DNSKEY RRset
	RRSIG=63500 and DNSKEY=63500/SEP verifies the DNSKEY RRset
	DNSKEY=14128 is now in the chain-of-trust
	DNSKEY=55824 is now in the chain-of-trust
	Query to eur2.nipr.mil for disa.mil/A
	Error querying eur2.nipr.mil/199.252.143.234 for disa.mil/A: 'query timed out'
	All Queries to eur2.nipr.mil for disa.mil/A timed out or failed
	Query to con2.nipr.mil for disa.mil/A
	Received 467 bytes from 199.252.162.234
	;; Response received from [199.252.162.234] 467 octets ;; HEADER SECTION ;; id = 14673 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 6 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) DISA.MIL. 21600 IN NS DNS1.DISA.MIL. DISA.MIL. 21600 IN NS DNS4.DISA.MIL. DISA.MIL. 21600 IN NS DNS2.DISA.MIL. DISA.MIL. 21600 IN NS DNS3.DISA.MIL. DISA.MIL. 21600 IN NS DNS5.DISA.MIL. DISA.MIL. 10800 IN DS ( 33295 8 2 50b8f3c1d46ca46477c7e961c0d2eaa1ee7fd3ee45351af6cda745fa7afc42a6 ) DISA.MIL. 10800 IN DS 33295 8 1 6858ab695bc9ea385629f0e1bdeb1b1a89f06bdb DISA.MIL. 10800 IN RRSIG ( DS 8 2 10800 20250528111224 20250521111224 55824 mil. MB5crwR0GFTFy/rkJQTGURKZTt9o0NONpjDDrGgUrRJUuMvVNRVlWPGzj+tb7yndAwKO4+vSUNz8 UPSXKR5m1WsdUXOnR19jM0B7izhRuxVuY5NAOLKha1aTChiE2eHr69Z+fEQ+fY837i76uHxhTMRQ 9u4awu0GlAWGrrQBl6g= ) ;; ADDITIONAL SECTION (6 records) DNS5.DISA.MIL. 21600 IN A 215.65.126.185 DNS4.DISA.MIL. 21600 IN A 214.23.245.6 DNS3.DISA.MIL. 21600 IN A 214.3.125.232 DNS2.DISA.MIL. 21600 IN A 131.77.60.232 DNS1.DISA.MIL. 21600 IN A 152.229.110.232 ;; { "EDNS-VERSION": 0 }
	Query to pac2.nipr.mil for disa.mil/DNSKEY
	Received 467 bytes from 199.252.155.234
	;; Response received from [199.252.155.234] 467 octets ;; HEADER SECTION ;; id = 24505 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 6 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) DISA.MIL. 21600 IN NS DNS4.DISA.MIL. DISA.MIL. 21600 IN NS DNS1.DISA.MIL. DISA.MIL. 21600 IN NS DNS3.DISA.MIL. DISA.MIL. 21600 IN NS DNS2.DISA.MIL. DISA.MIL. 21600 IN NS DNS5.DISA.MIL. DISA.MIL. 10800 IN DS ( 33295 8 2 50b8f3c1d46ca46477c7e961c0d2eaa1ee7fd3ee45351af6cda745fa7afc42a6 ) DISA.MIL. 10800 IN DS 33295 8 1 6858ab695bc9ea385629f0e1bdeb1b1a89f06bdb DISA.MIL. 10800 IN RRSIG ( DS 8 2 10800 20250528111224 20250521111224 55824 mil. MB5crwR0GFTFy/rkJQTGURKZTt9o0NONpjDDrGgUrRJUuMvVNRVlWPGzj+tb7yndAwKO4+vSUNz8 UPSXKR5m1WsdUXOnR19jM0B7izhRuxVuY5NAOLKha1aTChiE2eHr69Z+fEQ+fY837i76uHxhTMRQ 9u4awu0GlAWGrrQBl6g= ) ;; ADDITIONAL SECTION (6 records) DNS5.DISA.MIL. 21600 IN A 215.65.126.185 DNS4.DISA.MIL. 21600 IN A 214.23.245.6 DNS3.DISA.MIL. 21600 IN A 214.3.125.232 DNS2.DISA.MIL. 21600 IN A 131.77.60.232 DNS1.DISA.MIL. 21600 IN A 152.229.110.232 ;; { "EDNS-VERSION": 0 }
	Found child zone disa.mil

disa.mil

	Checking DS between mil and disa.mil
	Query to pac2.nipr.mil for disa.mil/DS
	Received 292 bytes from 199.252.155.234
	;; Response received from [199.252.155.234] 292 octets ;; HEADER SECTION ;; id = 2051 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN DS ;; ANSWER SECTION (3 records) DISA.MIL. 10800 IN DS 33295 8 1 6858ab695bc9ea385629f0e1bdeb1b1a89f06bdb DISA.MIL. 10800 IN DS ( 33295 8 2 50b8f3c1d46ca46477c7e961c0d2eaa1ee7fd3ee45351af6cda745fa7afc42a6 ) DISA.MIL. 10800 IN RRSIG ( DS 8 2 10800 20250528111224 20250521111224 55824 mil. MB5crwR0GFTFy/rkJQTGURKZTt9o0NONpjDDrGgUrRJUuMvVNRVlWPGzj+tb7yndAwKO4+vSUNz8 UPSXKR5m1WsdUXOnR19jM0B7izhRuxVuY5NAOLKha1aTChiE2eHr69Z+fEQ+fY837i76uHxhTMRQ 9u4awu0GlAWGrrQBl6g= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DS records for disa.mil in the mil zone
	DS=33295/SHA-1 uses a deprecated digest algorithm
	DS=33295/SHA-1 has algorithm RSASHA256
	DS=33295/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`DISA.MIL. 10800 IN RRSIG ( DS 8 2 10800 20250528111224 20250521111224 55824 mil. MB5crwR0GFTFy/rkJQTGURKZTt9o0NONpjDDrGgUrRJUuMvVNRVlWPGzj+tb7yndAwKO4+vSUNz8 UPSXKR5m1WsdUXOnR19jM0B7izhRuxVuY5NAOLKha1aTChiE2eHr69Z+fEQ+fY837i76uHxhTMRQ 9u4awu0GlAWGrrQBl6g= )`
	RRSIG=55824 and DNSKEY=55824 verifies the DS RRset
	DS=33295/SHA-1 is now in the chain-of-trust
	`DISA.MIL. 10800 IN DS 33295 8 1 6858ab695bc9ea385629f0e1bdeb1b1a89f06bdb`
	`DISA.MIL. 10800 IN DS ( 33295 8 2 50b8f3c1d46ca46477c7e961c0d2eaa1ee7fd3ee45351af6cda745fa7afc42a6 )`
	Query to DNS3.DISA.MIL for disa.mil/DNSKEY
	Received 1073 bytes from 214.3.125.232
	;; Response received from [214.3.125.232] 1073 octets ;; HEADER SECTION ;; id = 1532 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 5 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN DNSKEY ;; ANSWER SECTION (5 records) disa.mil. 139860 IN DNSKEY ( 256 3 8 AwEAAdKLhe4XqraW7jrTNfrMNSaCfrkW/JeDeDOe3gPOdZihi8xgSUdNGjuSXE0drcEM/v2/EP9x Tu/lXzf+8Fb00e7OWNB8NKHfAJ8hUmpD5pk8J9GL7f7kDs+L4iUm6zR4x8WToIGAU6eDhTOT043M T7oMv5CMdbRkapQkKXInyBLp ) ; keytag 32298 disa.mil. 139860 IN DNSKEY ( 257 3 8 AwEAAd11hkQp4x1DkOBHB3TH/THRW9jZ2s0D6UYpjk9MH8jahdG1C1YRj1BJun7Nr+AiX13qfyCV JbjDfRwuS8vdPVc1cWndzD2Nws7lKFlZdrkUBweRuxTmSAhG5xDaJa3cTnbmzi0PLjjSWls8mTxr DNSlfZ2gSMqL95EURwoLebw8CgP8NebfwzESQzsQGn3WO53uoQwSHfDVfqFtdVWBtsQTE8a+HNZc 9c39SPNrOmtTRTf1/4GIHszJmRU3N8vKCVukKrKSufhVkTiFt5JW5OHqDpiGPLPMGjpp6HC9wcBt +eBJaA3raSHD3Y9YIDtvIsVhNof95hHdHko7rp8Qbjs= ) ; keytag 33295 disa.mil. 139860 IN DNSKEY ( 256 3 8 AwEAAeE5imSLrfjXbna+GBu5hBK+h4s9toADiTXL/FQIHbnA0UpwiK18iBBC3YnQbRw7zDdbdcrW vwX4OCofrPto4gZ7WuxAWD3WDSvoh9stEE1iR2kSkLEHUTqRLykdohEdAkjAskWYY8eNuN4qkW85 sqPEDBnAXprWAp30Bto8O0az ) ; keytag 39828 disa.mil. 139860 IN RRSIG ( DNSKEY 8 2 172800 20250525005137 20250521004634 33295 disa.mil. lyfx6dbKbfj7xWa7wFWPEJEHg5QV8UitdakJn6WlVspTaFNaz4qj7GQbvLHVnBhOo5g6IsLR0251 z2xsjb+Terx9c7ejMDNajtFspHOUJQ55+HoA2jR2t0KMTln/r/humEY44pWjR1r9o7SM5p5Nsley CeJawN8YLs71gfFEK3egDi6XdhfO9eRz6zHsjqhvlorJW5fRRMPz+4q+bmXqfKQa7A2aCrAxHLaK CbPySuqrsnn5TDvS/eoxzH4r9z+CfKhhWvObu6mNSpFLQ65kkIiDQivi/jVeoJw1YGF87QkQP58G CASZghExLrLpfXIzFUKWV7eAmjR3nK83QmfBOA== ) disa.mil. 139860 IN RRSIG ( DNSKEY 8 2 172800 20250525005137 20250521004634 39828 disa.mil. AutWTpJCIulFdQ/hZan2ZjtE8ob9jKmOCr09QXqNbwZuQAYoUby+ZnkX9MXUR621YJS6DxNX1Z+P hbm7niNKdgNlsDNkWSsinHemw/QwOfMPrTMSV3+6GoxX7NlDTqsvCx9aJrqKbzDQIc08T3feVK/T ySSFZvM4BJG39FG8xkM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for disa.mil
	`disa.mil. 139860 IN DNSKEY ( 256 3 8 AwEAAdKLhe4XqraW7jrTNfrMNSaCfrkW/JeDeDOe3gPOdZihi8xgSUdNGjuSXE0drcEM/v2/EP9x Tu/lXzf+8Fb00e7OWNB8NKHfAJ8hUmpD5pk8J9GL7f7kDs+L4iUm6zR4x8WToIGAU6eDhTOT043M T7oMv5CMdbRkapQkKXInyBLp ) ; keytag 32298`
	`disa.mil. 139860 IN DNSKEY ( 257 3 8 AwEAAd11hkQp4x1DkOBHB3TH/THRW9jZ2s0D6UYpjk9MH8jahdG1C1YRj1BJun7Nr+AiX13qfyCV JbjDfRwuS8vdPVc1cWndzD2Nws7lKFlZdrkUBweRuxTmSAhG5xDaJa3cTnbmzi0PLjjSWls8mTxr DNSlfZ2gSMqL95EURwoLebw8CgP8NebfwzESQzsQGn3WO53uoQwSHfDVfqFtdVWBtsQTE8a+HNZc 9c39SPNrOmtTRTf1/4GIHszJmRU3N8vKCVukKrKSufhVkTiFt5JW5OHqDpiGPLPMGjpp6HC9wcBt +eBJaA3raSHD3Y9YIDtvIsVhNof95hHdHko7rp8Qbjs= ) ; keytag 33295`
	`disa.mil. 139860 IN DNSKEY ( 256 3 8 AwEAAeE5imSLrfjXbna+GBu5hBK+h4s9toADiTXL/FQIHbnA0UpwiK18iBBC3YnQbRw7zDdbdcrW vwX4OCofrPto4gZ7WuxAWD3WDSvoh9stEE1iR2kSkLEHUTqRLykdohEdAkjAskWYY8eNuN4qkW85 sqPEDBnAXprWAp30Bto8O0az ) ; keytag 39828`
	DNSKEY=33295/SEP is now in the chain-of-trust
	DS=33295/SHA-1 verifies DNSKEY=33295/SEP
	DS=33295/SHA-256 verifies DNSKEY=33295/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`disa.mil. 139860 IN RRSIG ( DNSKEY 8 2 172800 20250525005137 20250521004634 33295 disa.mil. lyfx6dbKbfj7xWa7wFWPEJEHg5QV8UitdakJn6WlVspTaFNaz4qj7GQbvLHVnBhOo5g6IsLR0251 z2xsjb+Terx9c7ejMDNajtFspHOUJQ55+HoA2jR2t0KMTln/r/humEY44pWjR1r9o7SM5p5Nsley CeJawN8YLs71gfFEK3egDi6XdhfO9eRz6zHsjqhvlorJW5fRRMPz+4q+bmXqfKQa7A2aCrAxHLaK CbPySuqrsnn5TDvS/eoxzH4r9z+CfKhhWvObu6mNSpFLQ65kkIiDQivi/jVeoJw1YGF87QkQP58G CASZghExLrLpfXIzFUKWV7eAmjR3nK83QmfBOA== )`
	`disa.mil. 139860 IN RRSIG ( DNSKEY 8 2 172800 20250525005137 20250521004634 39828 disa.mil. AutWTpJCIulFdQ/hZan2ZjtE8ob9jKmOCr09QXqNbwZuQAYoUby+ZnkX9MXUR621YJS6DxNX1Z+P hbm7niNKdgNlsDNkWSsinHemw/QwOfMPrTMSV3+6GoxX7NlDTqsvCx9aJrqKbzDQIc08T3feVK/T ySSFZvM4BJG39FG8xkM= )`
	RRSIG=33295 and DNSKEY=33295/SEP verifies the DNSKEY RRset
	RRSIG=39828 and DNSKEY=39828 verifies the DNSKEY RRset
	DNSKEY=32298 is now in the chain-of-trust
	DNSKEY=39828 is now in the chain-of-trust
	Query to DNS3.DISA.MIL for disa.mil/A
	Received 221 bytes from 214.3.125.232
	;; Response received from [214.3.125.232] 221 octets ;; HEADER SECTION ;; id = 8024 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN A ;; ANSWER SECTION (2 records) disa.mil. 1472 IN A 156.112.108.76 disa.mil. 1472 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	DNS3.DISA.MIL is authoritative for disa.mil
	Found RRSIG signed by disa.mil zone
	Query to DNS5.DISA.MIL for disa.mil/SOA
	Received 282 bytes from 215.65.126.185
	;; Response received from [215.65.126.185] 282 octets ;; HEADER SECTION ;; id = 50780 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN SOA ;; ANSWER SECTION (2 records) disa.mil. 839 IN SOA ( dns1.disa.mil. disa\.tinker\.ie\.list\.dci-ii-dns.mail.mil. 2025702140 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) disa.mil. 839 IN RRSIG ( SOA 8 2 7200 20250525125304 20250521115304 39828 disa.mil. ybJBZmrL+Zonh1RFUIBxOhoxTbyg3EbEkrtaJGzAqkHWXqKcTA/FclauIiNFuS3hBD56ysGoIDrg vCs06jhuim7fr945GWHc9HE4/ioZ6XU9QNmWfsr8VgBpLKp5oUPvEW2pu6BrV+TGMfHSQpXj+tSa C5Px4DIRkGfNlzzQpZw= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to DNS1.DISA.MIL for disa.mil/SOA
	Received 282 bytes from 152.229.110.232
	;; Response received from [152.229.110.232] 282 octets ;; HEADER SECTION ;; id = 3519 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN SOA ;; ANSWER SECTION (2 records) disa.mil. 2590 IN SOA ( dns1.disa.mil. disa\.tinker\.ie\.list\.dci-ii-dns.mail.mil. 2025702145 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) disa.mil. 2590 IN RRSIG ( SOA 8 2 7200 20250525135125 20250521125125 39828 disa.mil. DAe7xBSG8svOF4YDfQCpze6D05ZzCNy4ujtO7ws2lBO5qobw7blU68Hh/nGaxXiDYj68N1F4zsZA GdksnAaX1YRVBqH79fJkL1fLfTVuX/5jssfAtaSSeFy47gbs1NSRJ7CM2hW2PR+aHTjCXRFOFLXg 4x+yOWc0z2z2CG86qck= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	DNS1.DISA.MIL serial (2025702145) differs from DNS5.DISA.MIL serial (2025702140)
	Query to DNS2.DISA.MIL for disa.mil/SOA
	Received 282 bytes from 131.77.60.232
	;; Response received from [131.77.60.232] 282 octets ;; HEADER SECTION ;; id = 62752 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN SOA ;; ANSWER SECTION (2 records) disa.mil. 2590 IN SOA ( dns1.disa.mil. disa\.tinker\.ie\.list\.dci-ii-dns.mail.mil. 2025702145 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) disa.mil. 2590 IN RRSIG ( SOA 8 2 7200 20250525135125 20250521125125 39828 disa.mil. DAe7xBSG8svOF4YDfQCpze6D05ZzCNy4ujtO7ws2lBO5qobw7blU68Hh/nGaxXiDYj68N1F4zsZA GdksnAaX1YRVBqH79fJkL1fLfTVuX/5jssfAtaSSeFy47gbs1NSRJ7CM2hW2PR+aHTjCXRFOFLXg 4x+yOWc0z2z2CG86qck= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	DNS2.DISA.MIL serial (2025702145) differs from DNS5.DISA.MIL serial (2025702140)
	Query to DNS4.DISA.MIL for disa.mil/SOA
	Received 282 bytes from 214.23.245.6
	;; Response received from [214.23.245.6] 282 octets ;; HEADER SECTION ;; id = 25847 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN SOA ;; ANSWER SECTION (2 records) disa.mil. 2590 IN SOA ( dns1.disa.mil. disa\.tinker\.ie\.list\.dci-ii-dns.mail.mil. 2025702145 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) disa.mil. 2590 IN RRSIG ( SOA 8 2 7200 20250525135125 20250521125125 39828 disa.mil. DAe7xBSG8svOF4YDfQCpze6D05ZzCNy4ujtO7ws2lBO5qobw7blU68Hh/nGaxXiDYj68N1F4zsZA GdksnAaX1YRVBqH79fJkL1fLfTVuX/5jssfAtaSSeFy47gbs1NSRJ7CM2hW2PR+aHTjCXRFOFLXg 4x+yOWc0z2z2CG86qck= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	DNS4.DISA.MIL serial (2025702145) differs from DNS5.DISA.MIL serial (2025702140)
	Query to DNS3.DISA.MIL for disa.mil/A
	Received 221 bytes from 214.3.125.232
	;; Response received from [214.3.125.232] 221 octets ;; HEADER SECTION ;; id = 21159 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN A ;; ANSWER SECTION (2 records) disa.mil. 1472 IN A 156.112.108.76 disa.mil. 1472 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	disa.mil A RR has value 156.112.108.76
	Found 1 RRSIGs over A RRset
	`disa.mil. 1472 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= )`
	RRSIG=39828 and DNSKEY=39828 verifies the A RRset

disa.mil

	Query to DNS4.DISA.MIL for disa.mil/A
	Received 221 bytes from 214.23.245.6
	;; Response received from [214.23.245.6] 221 octets ;; HEADER SECTION ;; id = 40235 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN A ;; ANSWER SECTION (2 records) disa.mil. 3627 IN A 156.112.108.76 disa.mil. 3627 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	DNS4.DISA.MIL is authoritative for disa.mil
	Found RRSIG signed by disa.mil zone
	Query to DNS4.DISA.MIL for disa.mil/A
	Received 221 bytes from 214.23.245.6
	;; Response received from [214.23.245.6] 221 octets ;; HEADER SECTION ;; id = 53618 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN A ;; ANSWER SECTION (2 records) disa.mil. 3627 IN A 156.112.108.76 disa.mil. 3627 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	disa.mil A RR has value 156.112.108.76
	Found 1 RRSIGs over A RRset
	`disa.mil. 3627 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= )`
	RRSIG=39828 and DNSKEY=39828 verifies the A RRset

disa.mil

	Query to DNS5.DISA.MIL for disa.mil/A
	Received 221 bytes from 215.65.126.185
	;; Response received from [215.65.126.185] 221 octets ;; HEADER SECTION ;; id = 57046 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN A ;; ANSWER SECTION (2 records) disa.mil. 1471 IN A 156.112.108.76 disa.mil. 1471 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	DNS5.DISA.MIL is authoritative for disa.mil
	Found RRSIG signed by disa.mil zone
	Query to DNS5.DISA.MIL for disa.mil/A
	Received 221 bytes from 215.65.126.185
	;; Response received from [215.65.126.185] 221 octets ;; HEADER SECTION ;; id = 49255 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN A ;; ANSWER SECTION (2 records) disa.mil. 1471 IN A 156.112.108.76 disa.mil. 1471 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	disa.mil A RR has value 156.112.108.76
	Found 1 RRSIGs over A RRset
	`disa.mil. 1471 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= )`
	RRSIG=39828 and DNSKEY=39828 verifies the A RRset

disa.mil

	Query to DNS2.DISA.MIL for disa.mil/A
	Received 221 bytes from 131.77.60.232
	;; Response received from [131.77.60.232] 221 octets ;; HEADER SECTION ;; id = 1140 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN A ;; ANSWER SECTION (2 records) disa.mil. 3627 IN A 156.112.108.76 disa.mil. 3627 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	DNS2.DISA.MIL is authoritative for disa.mil
	Found RRSIG signed by disa.mil zone
	Query to DNS2.DISA.MIL for disa.mil/A
	Received 221 bytes from 131.77.60.232
	;; Response received from [131.77.60.232] 221 octets ;; HEADER SECTION ;; id = 36893 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN A ;; ANSWER SECTION (2 records) disa.mil. 3627 IN A 156.112.108.76 disa.mil. 3627 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	disa.mil A RR has value 156.112.108.76
	Found 1 RRSIGs over A RRset
	`disa.mil. 3627 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= )`
	RRSIG=39828 and DNSKEY=39828 verifies the A RRset

disa.mil

	Query to DNS1.DISA.MIL for disa.mil/A
	Received 221 bytes from 152.229.110.232
	;; Response received from [152.229.110.232] 221 octets ;; HEADER SECTION ;; id = 59106 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN A ;; ANSWER SECTION (2 records) disa.mil. 3627 IN A 156.112.108.76 disa.mil. 3627 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	DNS1.DISA.MIL is authoritative for disa.mil
	Found RRSIG signed by disa.mil zone
	Query to DNS1.DISA.MIL for disa.mil/A
	Received 221 bytes from 152.229.110.232
	;; Response received from [152.229.110.232] 221 octets ;; HEADER SECTION ;; id = 5570 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; disa.mil. IN A ;; ANSWER SECTION (2 records) disa.mil. 3627 IN A 156.112.108.76 disa.mil. 3627 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	disa.mil A RR has value 156.112.108.76
	Found 1 RRSIGs over A RRset
	`disa.mil. 3627 IN RRSIG ( A 8 2 7200 20250525095024 20250521092746 39828 disa.mil. A2RjlRR/EIMBPP/7eDD2mGSdwr9icSHEk0XD7tuQL0MdzuaAoLZleqsaRWytzzM5QsoJ7GUESybd 3Bi+IqucQBMco/7QqbRCiWry6bzPurcV21Jy00641wjXl07jy24OrVeb9RRM65poiwckTHPZGJpV L7sunCRdtNFj1A13Xxg= )`
	RRSIG=39828 and DNSKEY=39828 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test disa.mil at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: