DNSSEC Debugger - fedreg.gov

Domain Name:

Time: 2024-07-27 02:44:12 UTC

Analyzing DNSSEC problems for fedreg.gov

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to j.root-servers.net for ./DNSKEY
	Received 864 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 864 octets ;; HEADER SECTION ;; id = 11544 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAdSiy6sslYrcZSGcuMEK4DtE8DZZY1A08kAsviAD49tocYO5m37AvIOyzeiKBWuPuJ4m9u5H onCM/ntxklZKYFyMftv8XoRwbiXdpSjfdpNHiMYTTV2oDUNMjdLFnF6HYSY48xrPbevQOYbAFGHp xqcXAQT0+BaBiAx3Ls6lXBQ3/hSVOprvDWJCQiI2OT+9+saKLddSIX6DwTVy0S5T4YY4EGg5R3c/ eKUb2/8XgKWUzlOIZsVAZZUSTKW0tX54ccAALO7Grvsx/NW62jc1xv6wWAXocOEVgB7+4Lzb7q9p 5o30+sYoGpOsKgFvMSy4oCZTQMQx2Sjd/NG2bMMw6nM= ) ; Key ID = 20038 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20240811000000 20240721000000 20326 . oHsHLvNMC6b1tY+OF7BG9etZbZMixRQiBD6gzpzdD32m4l0Vdh6yO0vA6ECQ3PMHihplvZGlYgZc aow5WFWod7FGAufSncGrrX+55sXKn4I/cZhBfPYh3WCCI+H7Ug29tV81VkeHSJgVd3q5LfUVYkun Czoysi01iU48KefmKZAGqzPINkOwRJT76+lyrOzSVQWvYStWsR5EGSvPQ1/tJQXOIzaEzuDDFp50 2fCJqX9CK9LcjCeleXpeDfdH+7Kk1TqRMrRHt3ehRsqh4yuR5buq+p+lCsHht28vdgjADBehrqmb hv6MGoBE3QK+rW5xuHqlu3jRV15JBY3/NnDSyQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAdSiy6sslYrcZSGcuMEK4DtE8DZZY1A08kAsviAD49tocYO5m37AvIOyzeiKBWuPuJ4m9u5H onCM/ntxklZKYFyMftv8XoRwbiXdpSjfdpNHiMYTTV2oDUNMjdLFnF6HYSY48xrPbevQOYbAFGHp xqcXAQT0+BaBiAx3Ls6lXBQ3/hSVOprvDWJCQiI2OT+9+saKLddSIX6DwTVy0S5T4YY4EGg5R3c/ eKUb2/8XgKWUzlOIZsVAZZUSTKW0tX54ccAALO7Grvsx/NW62jc1xv6wWAXocOEVgB7+4Lzb7q9p 5o30+sYoGpOsKgFvMSy4oCZTQMQx2Sjd/NG2bMMw6nM= ) ; Key ID = 20038`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20240811000000 20240721000000 20326 . oHsHLvNMC6b1tY+OF7BG9etZbZMixRQiBD6gzpzdD32m4l0Vdh6yO0vA6ECQ3PMHihplvZGlYgZc aow5WFWod7FGAufSncGrrX+55sXKn4I/cZhBfPYh3WCCI+H7Ug29tV81VkeHSJgVd3q5LfUVYkun Czoysi01iU48KefmKZAGqzPINkOwRJT76+lyrOzSVQWvYStWsR5EGSvPQ1/tJQXOIzaEzuDDFp50 2fCJqX9CK9LcjCeleXpeDfdH+7Kk1TqRMrRHt3ehRsqh4yuR5buq+p+lCsHht28vdgjADBehrqmb hv6MGoBE3QK+rW5xuHqlu3jRV15JBY3/NnDSyQ== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=20038 is now in the chain-of-trust
	Query to b.root-servers.net for fedreg.gov/A
	Received 617 bytes from 170.247.170.2
	;; Response received from [170.247.170.2] 617 octets ;; HEADER SECTION ;; id = 33382 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fedreg.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20240808170000 20240726160000 20038 . MkhK+ObGfAmfWylt1G+YckaU7tEEp0RHlsKq8Ht9QUBgHDl1a0F5AY5Ac0+yU+nvVs9ulbKAyUHQ 08q9/xB9+4ahH5t3zz6bRcZ+fQKZq4w6uuT7wLIQNrxv2fV3LwWNJmP9c7hbso9l4V5q9KRicgvC 4nOoOtjiFMrdS9lDi7oTgyhfqWOp9fTUvGZ6pylfJS/TESnPx5rOUdbObLy6XuzyBra2jXk57RyZ dcHOwiMib1i3kXQpRp3+UPxSiXqxZlM2Ptzyxho6R1hrxyqU8J2QZVfk6y2eN8QhUHzQPeVjzbsD OJSlzrqZY1Ql1GwjbEAj7POKZYrf/fAq57MriA== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN A 199.33.231.1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN A 199.33.232.1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN A 199.33.233.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Query to b.root-servers.net for gov/DNSKEY
	Received 610 bytes from 170.247.170.2
	;; Response received from [170.247.170.2] 610 octets ;; HEADER SECTION ;; id = 14330 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20240808170000 20240726160000 20038 . MkhK+ObGfAmfWylt1G+YckaU7tEEp0RHlsKq8Ht9QUBgHDl1a0F5AY5Ac0+yU+nvVs9ulbKAyUHQ 08q9/xB9+4ahH5t3zz6bRcZ+fQKZq4w6uuT7wLIQNrxv2fV3LwWNJmP9c7hbso9l4V5q9KRicgvC 4nOoOtjiFMrdS9lDi7oTgyhfqWOp9fTUvGZ6pylfJS/TESnPx5rOUdbObLy6XuzyBra2jXk57RyZ dcHOwiMib1i3kXQpRp3+UPxSiXqxZlM2Ptzyxho6R1hrxyqU8J2QZVfk6y2eN8QhUHzQPeVjzbsD OJSlzrqZY1Ql1GwjbEAj7POKZYrf/fAq57MriA== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN A 199.33.231.1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN A 199.33.232.1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN A 199.33.233.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Found child zone gov

gov

	Checking DS between . and gov
	Query to c.root-servers.net for gov/DS
	Received 367 bytes from 192.33.4.12
	;; Response received from [192.33.4.12] 367 octets ;; HEADER SECTION ;; id = 19925 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20240808170000 20240726160000 20038 . MkhK+ObGfAmfWylt1G+YckaU7tEEp0RHlsKq8Ht9QUBgHDl1a0F5AY5Ac0+yU+nvVs9ulbKAyUHQ 08q9/xB9+4ahH5t3zz6bRcZ+fQKZq4w6uuT7wLIQNrxv2fV3LwWNJmP9c7hbso9l4V5q9KRicgvC 4nOoOtjiFMrdS9lDi7oTgyhfqWOp9fTUvGZ6pylfJS/TESnPx5rOUdbObLy6XuzyBra2jXk57RyZ dcHOwiMib1i3kXQpRp3+UPxSiXqxZlM2Ptzyxho6R1hrxyqU8J2QZVfk6y2eN8QhUHzQPeVjzbsD OJSlzrqZY1Ql1GwjbEAj7POKZYrf/fAq57MriA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for gov in the . zone
	DS=2536/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20240808170000 20240726160000 20038 . MkhK+ObGfAmfWylt1G+YckaU7tEEp0RHlsKq8Ht9QUBgHDl1a0F5AY5Ac0+yU+nvVs9ulbKAyUHQ 08q9/xB9+4ahH5t3zz6bRcZ+fQKZq4w6uuT7wLIQNrxv2fV3LwWNJmP9c7hbso9l4V5q9KRicgvC 4nOoOtjiFMrdS9lDi7oTgyhfqWOp9fTUvGZ6pylfJS/TESnPx5rOUdbObLy6XuzyBra2jXk57RyZ dcHOwiMib1i3kXQpRp3+UPxSiXqxZlM2Ptzyxho6R1hrxyqU8J2QZVfk6y2eN8QhUHzQPeVjzbsD OJSlzrqZY1Ql1GwjbEAj7POKZYrf/fAq57MriA== )`
	RRSIG=20038 and DNSKEY=20038 verifies the DS RRset
	DS=2536/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 )`
	Query to c.ns.gov for gov/DNSKEY
	Received 291 bytes from 199.33.232.1
	;; Response received from [199.33.232.1] 291 octets ;; HEADER SECTION ;; id = 9536 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; Key ID = 2536 gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; Key ID = 35496 gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20240919110526 20240720110526 2536 gov. HdS8shIfEbsTrkW5QWcemVuIGkuI/xGvzvDYxBTf/LuRRNzN5FvUA1PbOTLXYLEfPZkeLTC07umN zFbL4Pqx9w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for gov
	`gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; Key ID = 2536`
	`gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; Key ID = 35496`
	DNSKEY=2536/SEP is now in the chain-of-trust
	DS=2536/SHA-256 verifies DNSKEY=2536/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20240919110526 20240720110526 2536 gov. HdS8shIfEbsTrkW5QWcemVuIGkuI/xGvzvDYxBTf/LuRRNzN5FvUA1PbOTLXYLEfPZkeLTC07umN zFbL4Pqx9w== )`
	RRSIG=2536 and DNSKEY=2536/SEP verifies the DNSKEY RRset
	DNSKEY=35496 is now in the chain-of-trust
	Query to b.ns.gov for fedreg.gov/A
	Received 310 bytes from 199.33.231.1
	;; Response received from [199.33.231.1] 310 octets ;; HEADER SECTION ;; id = 3515 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 5 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fedreg.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) fedreg.gov. 10800 IN NS ns1.fedreg.gov. fedreg.gov. 10800 IN NS ns2.fedreg.gov. fedreg.gov. 3600 IN DS ( 2371 13 2 7fb8a3d4803c1655c00910e84648cee774a579ad94edfe85662108d76be8301e ) fedreg.gov. 3600 IN RRSIG ( DS 13 2 3600 20240728034412 20240726014412 35496 gov. bXTo89NaIrUsTiztTwEmFqRBlenFcz6wNzh9n5A3OMP7A3M1Bzv4XfOga5Yi3yw9cmGT4DAJeuSR xkyVkUi+SA== ) ;; ADDITIONAL SECTION (5 records) ns1.fedreg.gov. 3600 IN A 162.159.4.127 ns1.fedreg.gov. 3600 IN AAAA 2400:cb00:2049:1::a29f:47f ns2.fedreg.gov. 3600 IN A 162.159.5.58 ns2.fedreg.gov. 3600 IN AAAA 2400:cb00:2049:1::a29f:53a ;; { "EDNS-VERSION": 0 }
	Query to d.ns.gov for fedreg.gov/DNSKEY
	Received 310 bytes from 199.33.233.1
	;; Response received from [199.33.233.1] 310 octets ;; HEADER SECTION ;; id = 53533 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 5 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fedreg.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) fedreg.gov. 10800 IN NS ns1.fedreg.gov. fedreg.gov. 10800 IN NS ns2.fedreg.gov. fedreg.gov. 3600 IN DS ( 2371 13 2 7fb8a3d4803c1655c00910e84648cee774a579ad94edfe85662108d76be8301e ) fedreg.gov. 3600 IN RRSIG ( DS 13 2 3600 20240728034412 20240726014412 35496 gov. 6XQG5CuUPuNgvVyPzc+eGJLR5SlvAxdU5hSoA70S/nnJyoTOwiuddnOuKpBC2sG8NLVzGd67Zae6 okM3ygM/tg== ) ;; ADDITIONAL SECTION (5 records) ns1.fedreg.gov. 3600 IN A 162.159.4.127 ns1.fedreg.gov. 3600 IN AAAA 2400:cb00:2049:1::a29f:47f ns2.fedreg.gov. 3600 IN A 162.159.5.58 ns2.fedreg.gov. 3600 IN AAAA 2400:cb00:2049:1::a29f:53a ;; { "EDNS-VERSION": 0 }
	Found child zone fedreg.gov

fedreg.gov

	Checking DS between gov and fedreg.gov
	Query to c.ns.gov for fedreg.gov/DS
	Received 186 bytes from 199.33.232.1
	;; Response received from [199.33.232.1] 186 octets ;; HEADER SECTION ;; id = 47405 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fedreg.gov. IN DS ;; ANSWER SECTION (2 records) fedreg.gov. 3600 IN DS ( 2371 13 2 7fb8a3d4803c1655c00910e84648cee774a579ad94edfe85662108d76be8301e ) fedreg.gov. 3600 IN RRSIG ( DS 13 2 3600 20240728034412 20240726014412 35496 gov. 7y87U+eKFm6MKIHMRImCQitsFVPwzBn2qYUx2D0m9I4l93Mq1x3brUPwJojDlbDJpuAUaBGdi9nF 21+vVih2Gw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for fedreg.gov in the gov zone
	DS=2371/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`fedreg.gov. 3600 IN RRSIG ( DS 13 2 3600 20240728034412 20240726014412 35496 gov. 7y87U+eKFm6MKIHMRImCQitsFVPwzBn2qYUx2D0m9I4l93Mq1x3brUPwJojDlbDJpuAUaBGdi9nF 21+vVih2Gw== )`
	RRSIG=35496 and DNSKEY=35496 verifies the DS RRset
	DS=2371/SHA-256 is now in the chain-of-trust
	`fedreg.gov. 3600 IN DS ( 2371 13 2 7fb8a3d4803c1655c00910e84648cee774a579ad94edfe85662108d76be8301e )`
	Query to ns2.fedreg.gov for fedreg.gov/DNSKEY
	Received 305 bytes from 162.159.5.58
	;; Response received from [162.159.5.58] 305 octets ;; HEADER SECTION ;; id = 2981 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fedreg.gov. IN DNSKEY ;; ANSWER SECTION (3 records) fedreg.gov. 3600 IN DNSKEY ( 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iU zy1L53eKGQ== ) ; Key ID = 2371 fedreg.gov. 3600 IN DNSKEY ( 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x 8fGAa2XhSA== ) ; Key ID = 34505 fedreg.gov. 3600 IN RRSIG ( DNSKEY 13 2 3600 20240915200356 20240716200356 2371 fedreg.gov. USOU+ERQjbCIac93eHyV+bnM3d6LKfJ7TIJf6FP1NWZDDVBRNB1kmMo2QNX5K9yCWyL20p4BOk88 udl+Wpj+0Q== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for fedreg.gov
	`fedreg.gov. 3600 IN DNSKEY ( 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iU zy1L53eKGQ== ) ; Key ID = 2371`
	`fedreg.gov. 3600 IN DNSKEY ( 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x 8fGAa2XhSA== ) ; Key ID = 34505`
	DNSKEY=2371/SEP is now in the chain-of-trust
	DS=2371/SHA-256 verifies DNSKEY=2371/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`fedreg.gov. 3600 IN RRSIG ( DNSKEY 13 2 3600 20240915200356 20240716200356 2371 fedreg.gov. USOU+ERQjbCIac93eHyV+bnM3d6LKfJ7TIJf6FP1NWZDDVBRNB1kmMo2QNX5K9yCWyL20p4BOk88 udl+Wpj+0Q== )`
	RRSIG=2371 and DNSKEY=2371/SEP verifies the DNSKEY RRset
	DNSKEY=34505 is now in the chain-of-trust
	Query to ns1.fedreg.gov for fedreg.gov/A
	Received 349 bytes from 162.159.4.127
	;; Response received from [162.159.4.127] 349 octets ;; HEADER SECTION ;; id = 3710 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fedreg.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) fedreg.gov. 1800 IN SOA ( ns1.fedreg.gov. dns.cloudflare.com. 2346732341 ;serial 10000 ;refresh 2400 ;retry 604800 ;expire 1800 ;minimum ) fedreg.gov. 1800 IN NSEC ( \000.fedreg.gov. NS SOA HINFO MX TXT AAAA LOC SRV NAPTR CERT SSHFP RRSIG NSEC DNSKEY TLSA SMIMEA HIP CDS CDNSKEY OPENPGPKEY SVCB HTTPS URI CAA ) fedreg.gov. 1800 IN RRSIG ( SOA 13 2 1800 20240728034412 20240726014412 34505 fedreg.gov. pFOBIFZkeCxOLedBtNwvjWGN1+qbwD9P2cXU9cmRsJ2NAlBC1+1apeAq7uxvFqNaZ4xI7Qa58g6Q AnFlPOyFaQ== ) fedreg.gov. 1800 IN RRSIG ( NSEC 13 2 1800 20240728034412 20240726014412 34505 fedreg.gov. 1vO2+UjpgyiGl20kcuU5B9F7rQcyM1GckBpspowNVnwS6Bk/FClKJrH8s0awiRuf8UIWxp/xRMNx IpWPGLfMxQ== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns1.fedreg.gov is authoritative for fedreg.gov
	Found RRSIG signed by fedreg.gov zone
	Query to ns2.fedreg.gov for fedreg.gov/SOA
	Received 203 bytes from 162.159.5.58
	;; Response received from [162.159.5.58] 203 octets ;; HEADER SECTION ;; id = 16371 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fedreg.gov. IN SOA ;; ANSWER SECTION (2 records) fedreg.gov. 1800 IN SOA ( ns1.fedreg.gov. dns.cloudflare.com. 2346732341 ;serial 10000 ;refresh 2400 ;retry 604800 ;expire 1800 ;minimum ) fedreg.gov. 1800 IN RRSIG ( SOA 13 2 1800 20240728034412 20240726014412 34505 fedreg.gov. f2giIIJPUdCSR7FuXAQ07DX5sBnBVU+ZQe7LNrKljv8qWlY7uoQanbu9GSMrEZeytLEhvS49svEz iyEQDJ5ZyA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns1.fedreg.gov for fedreg.gov/A
	Received 349 bytes from 162.159.4.127
	;; Response received from [162.159.4.127] 349 octets ;; HEADER SECTION ;; id = 3153 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fedreg.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) fedreg.gov. 1800 IN SOA ( ns1.fedreg.gov. dns.cloudflare.com. 2346732341 ;serial 10000 ;refresh 2400 ;retry 604800 ;expire 1800 ;minimum ) fedreg.gov. 1800 IN NSEC ( \000.fedreg.gov. NS SOA HINFO MX TXT AAAA LOC SRV NAPTR CERT SSHFP RRSIG NSEC DNSKEY TLSA SMIMEA HIP CDS CDNSKEY OPENPGPKEY SVCB HTTPS URI CAA ) fedreg.gov. 1800 IN RRSIG ( SOA 13 2 1800 20240728034412 20240726014412 34505 fedreg.gov. e58vspBcn3Wd0YHxR1LYntnOnqwr52/IAab9CGsOA0lW4ZRS1DfFwFv+a+NWXoQBObgc9gQU9sv0 6xzbtuW65w== ) fedreg.gov. 1800 IN RRSIG ( NSEC 13 2 1800 20240728034412 20240726014412 34505 fedreg.gov. TR48E7wJK698UML64469QvLpCIxBxk0PmDUnxOM29WKkRDMwAyhyy2pHBF6YkkZF7MYUiaXH2Foj mNDVTbzZdw== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Checking NSEC records for a NODATA response
	Found 1 RRSIGs over NSEC RRset
	`fedreg.gov. 1800 IN RRSIG ( NSEC 13 2 1800 20240728034412 20240726014412 34505 fedreg.gov. TR48E7wJK698UML64469QvLpCIxBxk0PmDUnxOM29WKkRDMwAyhyy2pHBF6YkkZF7MYUiaXH2Foj mNDVTbzZdw== )`
	RRSIG=34505 and DNSKEY=34505 verifies the NSEC RRset
	NSEC proves no records of type A exist for fedreg.gov
	Found 1 RRSIGs over SOA RRset
	`fedreg.gov. 1800 IN RRSIG ( SOA 13 2 1800 20240728034412 20240726014412 34505 fedreg.gov. pFOBIFZkeCxOLedBtNwvjWGN1+qbwD9P2cXU9cmRsJ2NAlBC1+1apeAq7uxvFqNaZ4xI7Qa58g6Q AnFlPOyFaQ== )`
	RRSIG=34505 and DNSKEY=34505 verifies the SOA RRset

fedreg.gov

	Query to ns2.fedreg.gov for fedreg.gov/A
	Received 349 bytes from 162.159.5.58
	;; Response received from [162.159.5.58] 349 octets ;; HEADER SECTION ;; id = 50555 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fedreg.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) fedreg.gov. 1800 IN SOA ( ns1.fedreg.gov. dns.cloudflare.com. 2346732341 ;serial 10000 ;refresh 2400 ;retry 604800 ;expire 1800 ;minimum ) fedreg.gov. 1800 IN NSEC ( \000.fedreg.gov. NS SOA HINFO MX TXT AAAA LOC SRV NAPTR CERT SSHFP RRSIG NSEC DNSKEY TLSA SMIMEA HIP CDS CDNSKEY OPENPGPKEY SVCB HTTPS URI CAA ) fedreg.gov. 1800 IN RRSIG ( SOA 13 2 1800 20240728034412 20240726014412 34505 fedreg.gov. qMIbPjmW96JdbNyQ1R88wWFVtCBUwbc70DzHNzjKZacX1ecKemMSZbS/mE4e2ffydjGf7WfIGrwZ K6EQwTFjwQ== ) fedreg.gov. 1800 IN RRSIG ( NSEC 13 2 1800 20240728034412 20240726014412 34505 fedreg.gov. 8ouvLL2FEakmcb5il2XnXaPUBfAhgDQDRtIHnRJsmb18xStYmZxLJ4q/SinRX7Ln8WAzbPXMxLAr vHTdWYt/dg== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns2.fedreg.gov is authoritative for fedreg.gov
	Found RRSIG signed by fedreg.gov zone
	Query to ns2.fedreg.gov for fedreg.gov/A
	Received 349 bytes from 162.159.5.58
	;; Response received from [162.159.5.58] 349 octets ;; HEADER SECTION ;; id = 36445 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fedreg.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) fedreg.gov. 1800 IN SOA ( ns1.fedreg.gov. dns.cloudflare.com. 2346732341 ;serial 10000 ;refresh 2400 ;retry 604800 ;expire 1800 ;minimum ) fedreg.gov. 1800 IN NSEC ( \000.fedreg.gov. NS SOA HINFO MX TXT AAAA LOC SRV NAPTR CERT SSHFP RRSIG NSEC DNSKEY TLSA SMIMEA HIP CDS CDNSKEY OPENPGPKEY SVCB HTTPS URI CAA ) fedreg.gov. 1800 IN RRSIG ( SOA 13 2 1800 20240728034412 20240726014412 34505 fedreg.gov. +5bb4t9fr7mSUstpcaKCsrNuwZd8Cl4M1TvI+zfan4qD+QhkOpg1lEqBig98iMqImvgTyPbE15Z4 PiVg1u+btQ== ) fedreg.gov. 1800 IN RRSIG ( NSEC 13 2 1800 20240728034412 20240726014412 34505 fedreg.gov. iV9zqW2rhHacRxpllD/dzOQ6f819i5tYEtA+xvWBRI3iFGqc4tPSyCtVIEa7h0ieiNd08JazQEok +7EJfAb3LQ== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Checking NSEC records for a NODATA response
	Found 1 RRSIGs over NSEC RRset
	`fedreg.gov. 1800 IN RRSIG ( NSEC 13 2 1800 20240728034412 20240726014412 34505 fedreg.gov. iV9zqW2rhHacRxpllD/dzOQ6f819i5tYEtA+xvWBRI3iFGqc4tPSyCtVIEa7h0ieiNd08JazQEok +7EJfAb3LQ== )`
	RRSIG=34505 and DNSKEY=34505 verifies the NSEC RRset
	NSEC proves no records of type A exist for fedreg.gov
	Found 1 RRSIGs over SOA RRset
	`fedreg.gov. 1800 IN RRSIG ( SOA 13 2 1800 20240728034412 20240726014412 34505 fedreg.gov. qMIbPjmW96JdbNyQ1R88wWFVtCBUwbc70DzHNzjKZacX1ecKemMSZbS/mE4e2ffydjGf7WfIGrwZ K6EQwTFjwQ== )`
	RRSIG=34505 and DNSKEY=34505 verifies the SOA RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test fedreg.gov at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: