DNSSEC Debugger

Back to Verisign Labs Tools

Domain Name:

Detail: more(+) / less(-)

Time: 2026-06-16 03:26:28 UTC

Analyzing DNSSEC problems for epa.gov

DS=20326/SHA-256 is now in the chain-of-trust

DS=38696/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	`. IN DS ( 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 )`
	Query to e.root-servers.net for ./DNSKEY
	Received 1139 bytes from 192.203.230.10
	;; Response received from [192.203.230.10] 1139 octets ;; HEADER SECTION ;; id = 33341 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAb5dDYffpgAJ8VUGLwQtWXPlQWsjIFJtCM00/XaKU+8ln+ofah3q2KxEIjvzQg+nqdxRj+8e mtPne1mtYcbFWP4Q9E+DniOJLK09R05FuzvGbrG7DDdRDUX/cedFdV7O8pFEAYpJqYNR9BCTIAV9 73DO2biauKSA31b7I2lK/woxoR1tf5cqJ4SMbJUviuHicAEoUi2ATswloZNWd5T5thmEFZnxFx7D 5UgKCY7oflS7+GU7dNJwEtmFnWYVETHN0kHXVz6aguouaAZp706YXNIoR/iTgQhmsR7XX+wL0Z8Q M2LxQIyU6vRZ06IyuJMGRMiwkSuGElbumyBt12JZbrU= ) ; keytag 54393 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20260701000000 20260610000000 20326 . j4xwc5ju8Rar7jcd8yX1jGrb5c85D/uGNLvUpiKCzuSVqv0zhUS56KtqD0JmBo1rC+aWxywONWS6 o76i4p5TOOWFWdrops0E/Vw3OFQW+jLxsscc+Y9WUbK1PxTB3UPdWfiHw3azpvgsaaUdXAWeev5t MWZXcj4NM7NoCZJk9ig5onr298AVFZoFNZP6edyzWhyhkMX0DOxBH1M8+c8te2dFpck09pK2GEvA P5Cf1zlsGmZOiZRxB2mDLOXnCbqwJnHQSyhpW9QZkJGJbogrNPwMWdV+X3xcQ5n+dL9aRLtAkKeS p8FDo1ZeGo9xAbha9AjeCyPF3VkSRQEw9owjJg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAb5dDYffpgAJ8VUGLwQtWXPlQWsjIFJtCM00/XaKU+8ln+ofah3q2KxEIjvzQg+nqdxRj+8e mtPne1mtYcbFWP4Q9E+DniOJLK09R05FuzvGbrG7DDdRDUX/cedFdV7O8pFEAYpJqYNR9BCTIAV9 73DO2biauKSA31b7I2lK/woxoR1tf5cqJ4SMbJUviuHicAEoUi2ATswloZNWd5T5thmEFZnxFx7D 5UgKCY7oflS7+GU7dNJwEtmFnWYVETHN0kHXVz6aguouaAZp706YXNIoR/iTgQhmsR7XX+wL0Z8Q M2LxQIyU6vRZ06IyuJMGRMiwkSuGElbumyBt12JZbrU= ) ; keytag 54393`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	DNSKEY=38696/SEP is now in the chain-of-trust
	DS=38696/SHA-256 verifies DNSKEY=38696/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20260701000000 20260610000000 20326 . j4xwc5ju8Rar7jcd8yX1jGrb5c85D/uGNLvUpiKCzuSVqv0zhUS56KtqD0JmBo1rC+aWxywONWS6 o76i4p5TOOWFWdrops0E/Vw3OFQW+jLxsscc+Y9WUbK1PxTB3UPdWfiHw3azpvgsaaUdXAWeev5t MWZXcj4NM7NoCZJk9ig5onr298AVFZoFNZP6edyzWhyhkMX0DOxBH1M8+c8te2dFpck09pK2GEvA P5Cf1zlsGmZOiZRxB2mDLOXnCbqwJnHQSyhpW9QZkJGJbogrNPwMWdV+X3xcQ5n+dL9aRLtAkKeS p8FDo1ZeGo9xAbha9AjeCyPF3VkSRQEw9owjJg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=54393 is now in the chain-of-trust
	Query to h.root-servers.net for epa.gov/A
	Received 614 bytes from 198.97.190.53
	;; Response received from [198.97.190.53] 614 octets ;; HEADER SECTION ;; id = 1719 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; epa.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20260628200000 20260615190000 54393 . aYWfgE1jHQHjCE/mc++3mzlC7HQMuPbq4oIprc+w41D3IDEYqNOPiEFMbLBSX9wTrgk/+l3AhJ3W OL6HevLmFXcbutn4qJh81UQEwOFB8/dRqeXoxjhSFzBk22luOf1sln6FmOBvGUrlZlul8BTV32mt jcvSm7wYl3RcBpS+MtoBAvKu5Aooxn+m8oNo51oSlfHC2hfvMny9yylYdATT68oudFYQQeghDzam BlrQd0yTAlgx67+04TZbI14AQSesBlmOSPgqN8ZJxyPraoTUbOaU5TGiUavjVz5yfV77XpFYAKI7 Cfz7VjJGuxlAn9yIaiigozN31D6Ewos4gOl3JA== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 b.ns.gov. 172800 IN A 199.33.231.1 c.ns.gov. 172800 IN A 199.33.232.1 d.ns.gov. 172800 IN A 199.33.233.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Query to f.root-servers.net for gov/DNSKEY
	Received 610 bytes from 192.5.5.241
	;; Response received from [192.5.5.241] 610 octets ;; HEADER SECTION ;; id = 64504 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20260628200000 20260615190000 54393 . aYWfgE1jHQHjCE/mc++3mzlC7HQMuPbq4oIprc+w41D3IDEYqNOPiEFMbLBSX9wTrgk/+l3AhJ3W OL6HevLmFXcbutn4qJh81UQEwOFB8/dRqeXoxjhSFzBk22luOf1sln6FmOBvGUrlZlul8BTV32mt jcvSm7wYl3RcBpS+MtoBAvKu5Aooxn+m8oNo51oSlfHC2hfvMny9yylYdATT68oudFYQQeghDzam BlrQd0yTAlgx67+04TZbI14AQSesBlmOSPgqN8ZJxyPraoTUbOaU5TGiUavjVz5yfV77XpFYAKI7 Cfz7VjJGuxlAn9yIaiigozN31D6Ewos4gOl3JA== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN A 199.33.231.1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN A 199.33.232.1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN A 199.33.233.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Found child zone gov

gov

	Checking DS between . and gov
	Query to h.root-servers.net for gov/DS
	Received 367 bytes from 198.97.190.53
	;; Response received from [198.97.190.53] 367 octets ;; HEADER SECTION ;; id = 65352 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20260628200000 20260615190000 54393 . aYWfgE1jHQHjCE/mc++3mzlC7HQMuPbq4oIprc+w41D3IDEYqNOPiEFMbLBSX9wTrgk/+l3AhJ3W OL6HevLmFXcbutn4qJh81UQEwOFB8/dRqeXoxjhSFzBk22luOf1sln6FmOBvGUrlZlul8BTV32mt jcvSm7wYl3RcBpS+MtoBAvKu5Aooxn+m8oNo51oSlfHC2hfvMny9yylYdATT68oudFYQQeghDzam BlrQd0yTAlgx67+04TZbI14AQSesBlmOSPgqN8ZJxyPraoTUbOaU5TGiUavjVz5yfV77XpFYAKI7 Cfz7VjJGuxlAn9yIaiigozN31D6Ewos4gOl3JA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for gov in the . zone
	DS=2536/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20260628200000 20260615190000 54393 . aYWfgE1jHQHjCE/mc++3mzlC7HQMuPbq4oIprc+w41D3IDEYqNOPiEFMbLBSX9wTrgk/+l3AhJ3W OL6HevLmFXcbutn4qJh81UQEwOFB8/dRqeXoxjhSFzBk22luOf1sln6FmOBvGUrlZlul8BTV32mt jcvSm7wYl3RcBpS+MtoBAvKu5Aooxn+m8oNo51oSlfHC2hfvMny9yylYdATT68oudFYQQeghDzam BlrQd0yTAlgx67+04TZbI14AQSesBlmOSPgqN8ZJxyPraoTUbOaU5TGiUavjVz5yfV77XpFYAKI7 Cfz7VjJGuxlAn9yIaiigozN31D6Ewos4gOl3JA== )`
	RRSIG=54393 and DNSKEY=54393 verifies the DS RRset
	DS=2536/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 )`
	Query to a.ns.gov for gov/DNSKEY
	Received 291 bytes from 199.33.230.1
	;; Response received from [199.33.230.1] 291 octets ;; HEADER SECTION ;; id = 52565 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536 gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496 gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20260723110631 20260523110631 2536 gov. KuwBJAdUDPtJavW6u6F8ib8E+R3O8hIRJ3mN+zRdmXbJ7LYMyAN5A6mf1nr9I/8WsCmSxZS5Nehw XiGC/1k0Iw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for gov
	`gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536`
	`gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496`
	DNSKEY=2536/SEP is now in the chain-of-trust
	DS=2536/SHA-256 verifies DNSKEY=2536/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20260723110631 20260523110631 2536 gov. KuwBJAdUDPtJavW6u6F8ib8E+R3O8hIRJ3mN+zRdmXbJ7LYMyAN5A6mf1nr9I/8WsCmSxZS5Nehw XiGC/1k0Iw== )`
	RRSIG=2536 and DNSKEY=2536/SEP verifies the DNSKEY RRset
	DNSKEY=35496 is now in the chain-of-trust
	Query to b.ns.gov for epa.gov/A
	Received 489 bytes from 199.33.231.1
	;; Response received from [199.33.231.1] 489 octets ;; HEADER SECTION ;; id = 56174 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; epa.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) epa.gov. 10800 IN NS dcns1.epa.gov. epa.gov. 10800 IN NS dcns2.epa.gov. epa.gov. 10800 IN NS nccns1.epa.gov. epa.gov. 10800 IN NS nccns2.epa.gov. epa.gov. 3600 IN DS ( 18652 8 2 bfb539d84218f5cf4b41ac58502253b2b0f416815f876c50efd217e188d1219b ) epa.gov. 3600 IN DS ( 32804 8 2 7854b03a546ee2f217436c7be0cdc05aebbcb46eeafa6b9d5077338cd9a6ce23 ) epa.gov. 3600 IN RRSIG ( DS 13 2 3600 20260617042628 20260615022628 35496 gov. nai3Nq/VxYdNIz/efy6qwy8C/omnf3CHrqJ/gKbWAFr60NWWSNIEyenqQC1H7fHcPnFoRdu+V7OX FzEh6qCHlg== ) ;; ADDITIONAL SECTION (9 records) dcns1.epa.gov. 3600 IN A 161.80.212.5 dcns1.epa.gov. 3600 IN AAAA 2620:117:5071:d4::f005 dcns2.epa.gov. 3600 IN A 161.80.212.15 dcns2.epa.gov. 3600 IN AAAA 2620:117:5071:d4::f00f nccns1.epa.gov. 3600 IN A 134.67.12.5 nccns1.epa.gov. 3600 IN AAAA 2620:117:506f:c::f005 nccns2.epa.gov. 3600 IN A 134.67.12.15 nccns2.epa.gov. 3600 IN AAAA 2620:117:506f:c::f00f ;; { "EDNS-VERSION": 0 }
	Query to a.ns.gov for epa.gov/DNSKEY
	Received 489 bytes from 199.33.230.1
	;; Response received from [199.33.230.1] 489 octets ;; HEADER SECTION ;; id = 46723 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; epa.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) epa.gov. 10800 IN NS dcns1.epa.gov. epa.gov. 10800 IN NS dcns2.epa.gov. epa.gov. 10800 IN NS nccns1.epa.gov. epa.gov. 10800 IN NS nccns2.epa.gov. epa.gov. 3600 IN DS ( 18652 8 2 bfb539d84218f5cf4b41ac58502253b2b0f416815f876c50efd217e188d1219b ) epa.gov. 3600 IN DS ( 32804 8 2 7854b03a546ee2f217436c7be0cdc05aebbcb46eeafa6b9d5077338cd9a6ce23 ) epa.gov. 3600 IN RRSIG ( DS 13 2 3600 20260617042628 20260615022628 35496 gov. h8PxSMCCE59yI60RLch/kq0NoiFEgqdcry/lF2xRquapyr96GP2vrVk3gYVBNSFtxahcQ0jKPqdf ++anpGWFzQ== ) ;; ADDITIONAL SECTION (9 records) dcns1.epa.gov. 3600 IN A 161.80.212.5 dcns1.epa.gov. 3600 IN AAAA 2620:117:5071:d4::f005 dcns2.epa.gov. 3600 IN A 161.80.212.15 dcns2.epa.gov. 3600 IN AAAA 2620:117:5071:d4::f00f nccns1.epa.gov. 3600 IN A 134.67.12.5 nccns1.epa.gov. 3600 IN AAAA 2620:117:506f:c::f005 nccns2.epa.gov. 3600 IN A 134.67.12.15 nccns2.epa.gov. 3600 IN AAAA 2620:117:506f:c::f00f ;; { "EDNS-VERSION": 0 }
	Found child zone epa.gov

epa.gov

	Checking DS between gov and epa.gov
	Query to d.ns.gov for epa.gov/DS
	Received 231 bytes from 199.33.233.1
	;; Response received from [199.33.233.1] 231 octets ;; HEADER SECTION ;; id = 5503 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; epa.gov. IN DS ;; ANSWER SECTION (3 records) epa.gov. 3600 IN DS ( 18652 8 2 bfb539d84218f5cf4b41ac58502253b2b0f416815f876c50efd217e188d1219b ) epa.gov. 3600 IN DS ( 32804 8 2 7854b03a546ee2f217436c7be0cdc05aebbcb46eeafa6b9d5077338cd9a6ce23 ) epa.gov. 3600 IN RRSIG ( DS 13 2 3600 20260617042628 20260615022628 35496 gov. VkvVrP0xqP1TnZdryjCvEUJbuYiCvQwU1CRjEMk3vVZaCoHcMXdt6UJYG7TYcQYNNMaKnsmwrexI dnnuQd5SOQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DS records for epa.gov in the gov zone
	DS=18652/SHA-256 has algorithm RSASHA256
	DS=32804/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`epa.gov. 3600 IN RRSIG ( DS 13 2 3600 20260617042628 20260615022628 35496 gov. VkvVrP0xqP1TnZdryjCvEUJbuYiCvQwU1CRjEMk3vVZaCoHcMXdt6UJYG7TYcQYNNMaKnsmwrexI dnnuQd5SOQ== )`
	RRSIG=35496 and DNSKEY=35496 verifies the DS RRset
	DS=18652/SHA-256 is now in the chain-of-trust
	DS=32804/SHA-256 is now in the chain-of-trust
	`epa.gov. 3600 IN DS ( 18652 8 2 bfb539d84218f5cf4b41ac58502253b2b0f416815f876c50efd217e188d1219b )`
	`epa.gov. 3600 IN DS ( 32804 8 2 7854b03a546ee2f217436c7be0cdc05aebbcb46eeafa6b9d5077338cd9a6ce23 )`
	Query to nccns1.epa.gov for epa.gov/DNSKEY
	Received 1641 bytes from 134.67.12.5
	;; Response received from [134.67.12.5] 1641 octets ;; HEADER SECTION ;; id = 41448 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 7 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; epa.gov. IN DNSKEY ;; ANSWER SECTION (7 records) epa.gov. 172800 IN DNSKEY ( 257 3 8 AwEAAcXjUL8+RKOJwH0jhU6qRSb43JrOxn7EEuOCyOnVnHOND/rxP0xhZB1yc/Vp416orRgilRwd BzHQ4q2DQVgUCojf4uH6d2aBDZNbZBcVZHI1ZFzFD1mZeGoNiIGBJxZYN+JQCiz9rsD+1C6ycvlF LUdLpvfJJTbYbn9SzNXQLEU6DLnwDTQHI+I33JGLq/3ZFkWvzsKcmTpmz9BobbUyS5UihTXXkX8U VD1cFfqsjIP56U+bK81FL75R6lVGDrmIpWvbRgHHB+d/oCOFzcuklxisEgGdViPhSie0qgaM4k5F AlTPu75QLAb/veigIAhbtJHrvJyhhvkg5OIWLkqJeHk= ) ; keytag 32804 epa.gov. 172800 IN DNSKEY ( 257 3 8 AwEAAdjI4t6sE/cwHHGaCYWLcV613yIMQtREbGP80XQovjWblu3gNgEFiAYMBwLelUYKmiXzHI0F +KAEBmBjIWsdlH/Ot4Lkk4ekiDJ2VbdXr6EOWuVOFGVnHGW6OxUlut5RsGXK4VBD4+YMzOnOQLan oZhkGCIZEhN8t/P79v7cMzZxoQ++HtXCUH3DW6gMZxu/8FM1DFwI04yBMlOQuTbz1RYzifozKk+P WG5yzSyfX184gANtB7zHIYV/CFWm9xHU68BLffWMorwWFFgNsPkvq0PYrR/U6m1nx97MJcoVUdVk zHatsMyotkjGT7FlKzw/8VtzUHwU7bzzsvnCC0Lzstc= ) ; keytag 18652 epa.gov. 172800 IN DNSKEY ( 256 3 8 AwEAAcbskHe/I26J0gI40jBn0b5GbtIVECjzD/e+OPYZFJNTO+1i4mNJph5HmFd2OS5llL6bArs1 PuYMwp+0+rO8pp90968V4lLVUIIJtShPN2vgqePGRTQvfE44uRjparYH3Ow/Jqd0UfkdnWWuRz9e 5bhCuYHWqWWIqU1tZGAV5mpx ) ; keytag 62278 epa.gov. 172800 IN DNSKEY ( 256 3 8 AwEAAcvSQH3O71ybQRbfNq4u9Rq2KP6u6sxDJkVEwemIWq+UPaTFQcaX0m+3/DscAvqX/ufH17dQ qySjJ+A+X6Eg788UEqon+m+U8Rcaw9aW3+z66C6ImTU4ZJ4JYFDtaVWyUmY/Vq9mm89MEuJWTNw3 lKQ7CSdiwlqCI435Brx5fdqD ) ; keytag 991 epa.gov. 172800 IN RRSIG ( DNSKEY 8 2 172800 20260619060817 20260615050817 991 epa.gov. Q+z0/VI2/3k9FqTubOpeJLXlCPI8equ3N5yDjGLR9JBwR93weHPj5rkGww4l4nc9Mu5ff97f9J/p uuyXvjxeCRXvHkyEYtVXtC6UabZmXe/NsNzinsiPYeSl7mHLtCjEZXm8BP9vwCaYSDSSaFkKjbun l+XYewvBvz+cjl/limE= ) epa.gov. 172800 IN RRSIG ( DNSKEY 8 2 172800 20260619060817 20260615050817 18652 epa.gov. JH2gkJG0SLbU+9emc0RJtp+Nj+vXoeVTDIdbecsrEy/K52nZ3/0Emc/RB3s1K/EMOrf1Ru9k2MO+ cOi5QnsbtkrJFSC+MYalYRBYi+mHOz9xNYjz8jPMljicCqyY0jm+N1NxbeGDactP9WyU9kOMGwla O6Ma4AHKLvTrAWFlpy8s/KY4yGjJ3spDQuc811TrCeAGflJvAfJavQ8nDXFwmTQDrM0J6c4BPE9p Gm+4pPUzSHH+jkNnW70rLJuKU8MyXHheogMLY5mfAIQAQssYqAWFLnyw9sZtfJDXfWvZF8hBrMz1 jOUt4k/Eh6i5eN0Rr0Pxs0Z10GIXNnW79/DLTA== ) epa.gov. 172800 IN RRSIG ( DNSKEY 8 2 172800 20260619060817 20260615050817 32804 epa.gov. bzBNF7dbVtLfkyzulEjUmJ77iv+KfpC7gSecgybnG71q9Lgh4+9O6CdCNkaGKVeuWU5prFC6/+pN 4JReX73tyJ7f4PhvoEjIqTOe33aVgJxIyEh5408Uo9A24hEpBQr5wpP4XRa3/1VA6sV4pEknNePM /qCbG0weJ3j+hsbsRaWPvacEfzB7mTsTXdTVuJepMKWBkAIbs517AHOky2y3fSougAjRmDK/CEuL mZA+kcNTlb1pxUWe7oRcohid4qmxIx03RbBUlSfkPOJAH/ak9OiyY7afz4n1EGvROEN9ZHTGYwIM Xohf6tfUZoxh69kHYQdbVKG7AUbBv/5OWQz9rQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 4 DNSKEY records for epa.gov
	`epa.gov. 172800 IN DNSKEY ( 257 3 8 AwEAAcXjUL8+RKOJwH0jhU6qRSb43JrOxn7EEuOCyOnVnHOND/rxP0xhZB1yc/Vp416orRgilRwd BzHQ4q2DQVgUCojf4uH6d2aBDZNbZBcVZHI1ZFzFD1mZeGoNiIGBJxZYN+JQCiz9rsD+1C6ycvlF LUdLpvfJJTbYbn9SzNXQLEU6DLnwDTQHI+I33JGLq/3ZFkWvzsKcmTpmz9BobbUyS5UihTXXkX8U VD1cFfqsjIP56U+bK81FL75R6lVGDrmIpWvbRgHHB+d/oCOFzcuklxisEgGdViPhSie0qgaM4k5F AlTPu75QLAb/veigIAhbtJHrvJyhhvkg5OIWLkqJeHk= ) ; keytag 32804`
	`epa.gov. 172800 IN DNSKEY ( 257 3 8 AwEAAdjI4t6sE/cwHHGaCYWLcV613yIMQtREbGP80XQovjWblu3gNgEFiAYMBwLelUYKmiXzHI0F +KAEBmBjIWsdlH/Ot4Lkk4ekiDJ2VbdXr6EOWuVOFGVnHGW6OxUlut5RsGXK4VBD4+YMzOnOQLan oZhkGCIZEhN8t/P79v7cMzZxoQ++HtXCUH3DW6gMZxu/8FM1DFwI04yBMlOQuTbz1RYzifozKk+P WG5yzSyfX184gANtB7zHIYV/CFWm9xHU68BLffWMorwWFFgNsPkvq0PYrR/U6m1nx97MJcoVUdVk zHatsMyotkjGT7FlKzw/8VtzUHwU7bzzsvnCC0Lzstc= ) ; keytag 18652`
	`epa.gov. 172800 IN DNSKEY ( 256 3 8 AwEAAcbskHe/I26J0gI40jBn0b5GbtIVECjzD/e+OPYZFJNTO+1i4mNJph5HmFd2OS5llL6bArs1 PuYMwp+0+rO8pp90968V4lLVUIIJtShPN2vgqePGRTQvfE44uRjparYH3Ow/Jqd0UfkdnWWuRz9e 5bhCuYHWqWWIqU1tZGAV5mpx ) ; keytag 62278`
	`epa.gov. 172800 IN DNSKEY ( 256 3 8 AwEAAcvSQH3O71ybQRbfNq4u9Rq2KP6u6sxDJkVEwemIWq+UPaTFQcaX0m+3/DscAvqX/ufH17dQ qySjJ+A+X6Eg788UEqon+m+U8Rcaw9aW3+z66C6ImTU4ZJ4JYFDtaVWyUmY/Vq9mm89MEuJWTNw3 lKQ7CSdiwlqCI435Brx5fdqD ) ; keytag 991`
	DNSKEY=32804/SEP is now in the chain-of-trust
	DS=32804/SHA-256 verifies DNSKEY=32804/SEP
	DNSKEY=18652/SEP is now in the chain-of-trust
	DS=18652/SHA-256 verifies DNSKEY=18652/SEP
	Found 3 RRSIGs over DNSKEY RRset
	`epa.gov. 172800 IN RRSIG ( DNSKEY 8 2 172800 20260619060817 20260615050817 991 epa.gov. Q+z0/VI2/3k9FqTubOpeJLXlCPI8equ3N5yDjGLR9JBwR93weHPj5rkGww4l4nc9Mu5ff97f9J/p uuyXvjxeCRXvHkyEYtVXtC6UabZmXe/NsNzinsiPYeSl7mHLtCjEZXm8BP9vwCaYSDSSaFkKjbun l+XYewvBvz+cjl/limE= )`
	`epa.gov. 172800 IN RRSIG ( DNSKEY 8 2 172800 20260619060817 20260615050817 18652 epa.gov. JH2gkJG0SLbU+9emc0RJtp+Nj+vXoeVTDIdbecsrEy/K52nZ3/0Emc/RB3s1K/EMOrf1Ru9k2MO+ cOi5QnsbtkrJFSC+MYalYRBYi+mHOz9xNYjz8jPMljicCqyY0jm+N1NxbeGDactP9WyU9kOMGwla O6Ma4AHKLvTrAWFlpy8s/KY4yGjJ3spDQuc811TrCeAGflJvAfJavQ8nDXFwmTQDrM0J6c4BPE9p Gm+4pPUzSHH+jkNnW70rLJuKU8MyXHheogMLY5mfAIQAQssYqAWFLnyw9sZtfJDXfWvZF8hBrMz1 jOUt4k/Eh6i5eN0Rr0Pxs0Z10GIXNnW79/DLTA== )`
	`epa.gov. 172800 IN RRSIG ( DNSKEY 8 2 172800 20260619060817 20260615050817 32804 epa.gov. bzBNF7dbVtLfkyzulEjUmJ77iv+KfpC7gSecgybnG71q9Lgh4+9O6CdCNkaGKVeuWU5prFC6/+pN 4JReX73tyJ7f4PhvoEjIqTOe33aVgJxIyEh5408Uo9A24hEpBQr5wpP4XRa3/1VA6sV4pEknNePM /qCbG0weJ3j+hsbsRaWPvacEfzB7mTsTXdTVuJepMKWBkAIbs517AHOky2y3fSougAjRmDK/CEuL mZA+kcNTlb1pxUWe7oRcohid4qmxIx03RbBUlSfkPOJAH/ak9OiyY7afz4n1EGvROEN9ZHTGYwIM Xohf6tfUZoxh69kHYQdbVKG7AUbBv/5OWQz9rQ== )`
	RRSIG=991 and DNSKEY=991 verifies the DNSKEY RRset
	RRSIG=18652 and DNSKEY=18652/SEP verifies the DNSKEY RRset
	RRSIG=32804 and DNSKEY=32804/SEP verifies the DNSKEY RRset
	DNSKEY=62278 is now in the chain-of-trust
	DNSKEY=991 is now in the chain-of-trust
	Query to nccns2.epa.gov for epa.gov/A
	Received 219 bytes from 134.67.12.15
	;; Response received from [134.67.12.15] 219 octets ;; HEADER SECTION ;; id = 13121 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; epa.gov. IN A ;; ANSWER SECTION (2 records) epa.gov. 3600 IN A 134.67.21.34 epa.gov. 3600 IN RRSIG ( A 8 2 3600 20260619204758 20260615204320 991 epa.gov. szsFw43YZWjqz//IwiDoLlujVqR6qEUCpibNLXfBO6pf1B3DIzyrkfrOuECXGqvnJZB/mWZ4hRyd TZvbVH6xxAYLYApoxte2gTaJ8A5h2jx6O0etIsQxX2RWQaPbB8doMk7BKa9ZSNMrRo/TL5iBEski gDnQVrnA5VVa7OjoGZU= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nccns2.epa.gov is authoritative for epa.gov
	Found RRSIG signed by epa.gov zone
	Query to dcns2.epa.gov for epa.gov/SOA
	Received 265 bytes from 161.80.212.15
	;; Response received from [161.80.212.15] 265 octets ;; HEADER SECTION ;; id = 42692 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; epa.gov. IN SOA ;; ANSWER SECTION (2 records) epa.gov. 3600 IN SOA ( rtpgm.ddi.epa.gov. dnsadmin.epa.gov. 2021575571 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) epa.gov. 3600 IN RRSIG ( SOA 8 2 3600 20260620023616 20260616013616 991 epa.gov. fLWxGoKDjq+NyImnghK8J5vmaPwyrRayZmbmsZdBuP82+DgN4xPJdXLYFkHWcwD2hzz828DPahu1 H8xzSNYuyssrKtaRn3Y1rCTzUm0V4r5Ww14WFhf7douZhQEYwnHy4UfBYEGlhQejc9tp9Bttb5Rr qq83JOWkoBYoPNH/C2s= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to dcns1.epa.gov for epa.gov/SOA
	Received 265 bytes from 161.80.212.5
	;; Response received from [161.80.212.5] 265 octets ;; HEADER SECTION ;; id = 51473 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; epa.gov. IN SOA ;; ANSWER SECTION (2 records) epa.gov. 3600 IN SOA ( rtpgm.ddi.epa.gov. dnsadmin.epa.gov. 2021575571 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) epa.gov. 3600 IN RRSIG ( SOA 8 2 3600 20260620023616 20260616013616 991 epa.gov. fLWxGoKDjq+NyImnghK8J5vmaPwyrRayZmbmsZdBuP82+DgN4xPJdXLYFkHWcwD2hzz828DPahu1 H8xzSNYuyssrKtaRn3Y1rCTzUm0V4r5Ww14WFhf7douZhQEYwnHy4UfBYEGlhQejc9tp9Bttb5Rr qq83JOWkoBYoPNH/C2s= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to nccns1.epa.gov for epa.gov/SOA
	Received 265 bytes from 134.67.12.5
	;; Response received from [134.67.12.5] 265 octets ;; HEADER SECTION ;; id = 53869 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; epa.gov. IN SOA ;; ANSWER SECTION (2 records) epa.gov. 3600 IN SOA ( rtpgm.ddi.epa.gov. dnsadmin.epa.gov. 2021575571 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) epa.gov. 3600 IN RRSIG ( SOA 8 2 3600 20260620023616 20260616013616 991 epa.gov. fLWxGoKDjq+NyImnghK8J5vmaPwyrRayZmbmsZdBuP82+DgN4xPJdXLYFkHWcwD2hzz828DPahu1 H8xzSNYuyssrKtaRn3Y1rCTzUm0V4r5Ww14WFhf7douZhQEYwnHy4UfBYEGlhQejc9tp9Bttb5Rr qq83JOWkoBYoPNH/C2s= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to nccns2.epa.gov for epa.gov/A
	epa.gov A RR has value 134.67.21.34
	Found 1 RRSIGs over A RRset
	`epa.gov. 3600 IN RRSIG ( A 8 2 3600 20260619204758 20260615204320 991 epa.gov. szsFw43YZWjqz//IwiDoLlujVqR6qEUCpibNLXfBO6pf1B3DIzyrkfrOuECXGqvnJZB/mWZ4hRyd TZvbVH6xxAYLYApoxte2gTaJ8A5h2jx6O0etIsQxX2RWQaPbB8doMk7BKa9ZSNMrRo/TL5iBEski gDnQVrnA5VVa7OjoGZU= )`
	RRSIG=991 and DNSKEY=991 verifies the A RRset

epa.gov

	Query to dcns1.epa.gov for epa.gov/A
	Received 219 bytes from 161.80.212.5
	;; Response received from [161.80.212.5] 219 octets ;; HEADER SECTION ;; id = 36790 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; epa.gov. IN A ;; ANSWER SECTION (2 records) epa.gov. 3600 IN A 134.67.21.34 epa.gov. 3600 IN RRSIG ( A 8 2 3600 20260619204758 20260615204320 991 epa.gov. szsFw43YZWjqz//IwiDoLlujVqR6qEUCpibNLXfBO6pf1B3DIzyrkfrOuECXGqvnJZB/mWZ4hRyd TZvbVH6xxAYLYApoxte2gTaJ8A5h2jx6O0etIsQxX2RWQaPbB8doMk7BKa9ZSNMrRo/TL5iBEski gDnQVrnA5VVa7OjoGZU= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	dcns1.epa.gov is authoritative for epa.gov
	Found RRSIG signed by epa.gov zone
	Query to dcns1.epa.gov for epa.gov/A
	epa.gov A RR has value 134.67.21.34
	Found 1 RRSIGs over A RRset
	`epa.gov. 3600 IN RRSIG ( A 8 2 3600 20260619204758 20260615204320 991 epa.gov. szsFw43YZWjqz//IwiDoLlujVqR6qEUCpibNLXfBO6pf1B3DIzyrkfrOuECXGqvnJZB/mWZ4hRyd TZvbVH6xxAYLYApoxte2gTaJ8A5h2jx6O0etIsQxX2RWQaPbB8doMk7BKa9ZSNMrRo/TL5iBEski gDnQVrnA5VVa7OjoGZU= )`
	RRSIG=991 and DNSKEY=991 verifies the A RRset

epa.gov

	Query to dcns2.epa.gov for epa.gov/A
	Received 219 bytes from 161.80.212.15
	;; Response received from [161.80.212.15] 219 octets ;; HEADER SECTION ;; id = 7227 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; epa.gov. IN A ;; ANSWER SECTION (2 records) epa.gov. 3600 IN A 134.67.21.34 epa.gov. 3600 IN RRSIG ( A 8 2 3600 20260619204758 20260615204320 991 epa.gov. szsFw43YZWjqz//IwiDoLlujVqR6qEUCpibNLXfBO6pf1B3DIzyrkfrOuECXGqvnJZB/mWZ4hRyd TZvbVH6xxAYLYApoxte2gTaJ8A5h2jx6O0etIsQxX2RWQaPbB8doMk7BKa9ZSNMrRo/TL5iBEski gDnQVrnA5VVa7OjoGZU= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	dcns2.epa.gov is authoritative for epa.gov
	Found RRSIG signed by epa.gov zone
	Query to dcns2.epa.gov for epa.gov/A
	epa.gov A RR has value 134.67.21.34
	Found 1 RRSIGs over A RRset
	`epa.gov. 3600 IN RRSIG ( A 8 2 3600 20260619204758 20260615204320 991 epa.gov. szsFw43YZWjqz//IwiDoLlujVqR6qEUCpibNLXfBO6pf1B3DIzyrkfrOuECXGqvnJZB/mWZ4hRyd TZvbVH6xxAYLYApoxte2gTaJ8A5h2jx6O0etIsQxX2RWQaPbB8doMk7BKa9ZSNMrRo/TL5iBEski gDnQVrnA5VVa7OjoGZU= )`
	RRSIG=991 and DNSKEY=991 verifies the A RRset

epa.gov

	Query to nccns1.epa.gov for epa.gov/A
	Received 219 bytes from 134.67.12.5
	;; Response received from [134.67.12.5] 219 octets ;; HEADER SECTION ;; id = 48625 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; epa.gov. IN A ;; ANSWER SECTION (2 records) epa.gov. 3600 IN A 134.67.21.34 epa.gov. 3600 IN RRSIG ( A 8 2 3600 20260619204758 20260615204320 991 epa.gov. szsFw43YZWjqz//IwiDoLlujVqR6qEUCpibNLXfBO6pf1B3DIzyrkfrOuECXGqvnJZB/mWZ4hRyd TZvbVH6xxAYLYApoxte2gTaJ8A5h2jx6O0etIsQxX2RWQaPbB8doMk7BKa9ZSNMrRo/TL5iBEski gDnQVrnA5VVa7OjoGZU= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nccns1.epa.gov is authoritative for epa.gov
	Found RRSIG signed by epa.gov zone
	Query to nccns1.epa.gov for epa.gov/A
	epa.gov A RR has value 134.67.21.34
	Found 1 RRSIGs over A RRset
	`epa.gov. 3600 IN RRSIG ( A 8 2 3600 20260619204758 20260615204320 991 epa.gov. szsFw43YZWjqz//IwiDoLlujVqR6qEUCpibNLXfBO6pf1B3DIzyrkfrOuECXGqvnJZB/mWZ4hRyd TZvbVH6xxAYLYApoxte2gTaJ8A5h2jx6O0etIsQxX2RWQaPbB8doMk7BKa9ZSNMrRo/TL5iBEski gDnQVrnA5VVa7OjoGZU= )`
	RRSIG=991 and DNSKEY=991 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test epa.gov at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: