DNSSEC Debugger - fnal.gov

Domain Name:

Time: 2024-07-27 02:26:35 UTC

Analyzing DNSSEC problems for fnal.gov

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to a.root-servers.net for ./DNSKEY
	Received 864 bytes from 198.41.0.4
	;; Response received from [198.41.0.4] 864 octets ;; HEADER SECTION ;; id = 6375 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN DNSKEY ( 256 3 8 AwEAAdSiy6sslYrcZSGcuMEK4DtE8DZZY1A08kAsviAD49tocYO5m37AvIOyzeiKBWuPuJ4m9u5H onCM/ntxklZKYFyMftv8XoRwbiXdpSjfdpNHiMYTTV2oDUNMjdLFnF6HYSY48xrPbevQOYbAFGHp xqcXAQT0+BaBiAx3Ls6lXBQ3/hSVOprvDWJCQiI2OT+9+saKLddSIX6DwTVy0S5T4YY4EGg5R3c/ eKUb2/8XgKWUzlOIZsVAZZUSTKW0tX54ccAALO7Grvsx/NW62jc1xv6wWAXocOEVgB7+4Lzb7q9p 5o30+sYoGpOsKgFvMSy4oCZTQMQx2Sjd/NG2bMMw6nM= ) ; Key ID = 20038 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20240811000000 20240721000000 20326 . oHsHLvNMC6b1tY+OF7BG9etZbZMixRQiBD6gzpzdD32m4l0Vdh6yO0vA6ECQ3PMHihplvZGlYgZc aow5WFWod7FGAufSncGrrX+55sXKn4I/cZhBfPYh3WCCI+H7Ug29tV81VkeHSJgVd3q5LfUVYkun Czoysi01iU48KefmKZAGqzPINkOwRJT76+lyrOzSVQWvYStWsR5EGSvPQ1/tJQXOIzaEzuDDFp50 2fCJqX9CK9LcjCeleXpeDfdH+7Kk1TqRMrRHt3ehRsqh4yuR5buq+p+lCsHht28vdgjADBehrqmb hv6MGoBE3QK+rW5xuHqlu3jRV15JBY3/NnDSyQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAdSiy6sslYrcZSGcuMEK4DtE8DZZY1A08kAsviAD49tocYO5m37AvIOyzeiKBWuPuJ4m9u5H onCM/ntxklZKYFyMftv8XoRwbiXdpSjfdpNHiMYTTV2oDUNMjdLFnF6HYSY48xrPbevQOYbAFGHp xqcXAQT0+BaBiAx3Ls6lXBQ3/hSVOprvDWJCQiI2OT+9+saKLddSIX6DwTVy0S5T4YY4EGg5R3c/ eKUb2/8XgKWUzlOIZsVAZZUSTKW0tX54ccAALO7Grvsx/NW62jc1xv6wWAXocOEVgB7+4Lzb7q9p 5o30+sYoGpOsKgFvMSy4oCZTQMQx2Sjd/NG2bMMw6nM= ) ; Key ID = 20038`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20240811000000 20240721000000 20326 . oHsHLvNMC6b1tY+OF7BG9etZbZMixRQiBD6gzpzdD32m4l0Vdh6yO0vA6ECQ3PMHihplvZGlYgZc aow5WFWod7FGAufSncGrrX+55sXKn4I/cZhBfPYh3WCCI+H7Ug29tV81VkeHSJgVd3q5LfUVYkun Czoysi01iU48KefmKZAGqzPINkOwRJT76+lyrOzSVQWvYStWsR5EGSvPQ1/tJQXOIzaEzuDDFp50 2fCJqX9CK9LcjCeleXpeDfdH+7Kk1TqRMrRHt3ehRsqh4yuR5buq+p+lCsHht28vdgjADBehrqmb hv6MGoBE3QK+rW5xuHqlu3jRV15JBY3/NnDSyQ== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=20038 is now in the chain-of-trust
	Query to i.root-servers.net for fnal.gov/A
	Received 618 bytes from 192.36.148.17
	;; Response received from [192.36.148.17] 618 octets ;; HEADER SECTION ;; id = 11741 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20240808170000 20240726160000 20038 . MkhK+ObGfAmfWylt1G+YckaU7tEEp0RHlsKq8Ht9QUBgHDl1a0F5AY5Ac0+yU+nvVs9ulbKAyUHQ 08q9/xB9+4ahH5t3zz6bRcZ+fQKZq4w6uuT7wLIQNrxv2fV3LwWNJmP9c7hbso9l4V5q9KRicgvC 4nOoOtjiFMrdS9lDi7oTgyhfqWOp9fTUvGZ6pylfJS/TESnPx5rOUdbObLy6XuzyBra2jXk57RyZ dcHOwiMib1i3kXQpRp3+UPxSiXqxZlM2Ptzyxho6R1hrxyqU8J2QZVfk6y2eN8QhUHzQPeVjzbsD OJSlzrqZY1Ql1GwjbEAj7POKZYrf/fAq57MriA== ) ;; ADDITIONAL SECTION (9 records) d.ns.gov. 172800 IN A 199.33.233.1 c.ns.gov. 172800 IN A 199.33.232.1 b.ns.gov. 172800 IN A 199.33.231.1 a.ns.gov. 172800 IN A 199.33.230.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 ;; { "EDNS-VERSION": 0 }
	Query to k.root-servers.net for gov/DNSKEY
	Received 610 bytes from 193.0.14.129
	;; Response received from [193.0.14.129] 610 octets ;; HEADER SECTION ;; id = 22567 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20240808170000 20240726160000 20038 . MkhK+ObGfAmfWylt1G+YckaU7tEEp0RHlsKq8Ht9QUBgHDl1a0F5AY5Ac0+yU+nvVs9ulbKAyUHQ 08q9/xB9+4ahH5t3zz6bRcZ+fQKZq4w6uuT7wLIQNrxv2fV3LwWNJmP9c7hbso9l4V5q9KRicgvC 4nOoOtjiFMrdS9lDi7oTgyhfqWOp9fTUvGZ6pylfJS/TESnPx5rOUdbObLy6XuzyBra2jXk57RyZ dcHOwiMib1i3kXQpRp3+UPxSiXqxZlM2Ptzyxho6R1hrxyqU8J2QZVfk6y2eN8QhUHzQPeVjzbsD OJSlzrqZY1Ql1GwjbEAj7POKZYrf/fAq57MriA== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 b.ns.gov. 172800 IN A 199.33.231.1 c.ns.gov. 172800 IN A 199.33.232.1 d.ns.gov. 172800 IN A 199.33.233.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Found child zone gov

gov

	Checking DS between . and gov
	Query to f.root-servers.net for gov/DS
	Received 367 bytes from 192.5.5.241
	;; Response received from [192.5.5.241] 367 octets ;; HEADER SECTION ;; id = 40278 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20240808170000 20240726160000 20038 . MkhK+ObGfAmfWylt1G+YckaU7tEEp0RHlsKq8Ht9QUBgHDl1a0F5AY5Ac0+yU+nvVs9ulbKAyUHQ 08q9/xB9+4ahH5t3zz6bRcZ+fQKZq4w6uuT7wLIQNrxv2fV3LwWNJmP9c7hbso9l4V5q9KRicgvC 4nOoOtjiFMrdS9lDi7oTgyhfqWOp9fTUvGZ6pylfJS/TESnPx5rOUdbObLy6XuzyBra2jXk57RyZ dcHOwiMib1i3kXQpRp3+UPxSiXqxZlM2Ptzyxho6R1hrxyqU8J2QZVfk6y2eN8QhUHzQPeVjzbsD OJSlzrqZY1Ql1GwjbEAj7POKZYrf/fAq57MriA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for gov in the . zone
	DS=2536/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20240808170000 20240726160000 20038 . MkhK+ObGfAmfWylt1G+YckaU7tEEp0RHlsKq8Ht9QUBgHDl1a0F5AY5Ac0+yU+nvVs9ulbKAyUHQ 08q9/xB9+4ahH5t3zz6bRcZ+fQKZq4w6uuT7wLIQNrxv2fV3LwWNJmP9c7hbso9l4V5q9KRicgvC 4nOoOtjiFMrdS9lDi7oTgyhfqWOp9fTUvGZ6pylfJS/TESnPx5rOUdbObLy6XuzyBra2jXk57RyZ dcHOwiMib1i3kXQpRp3+UPxSiXqxZlM2Ptzyxho6R1hrxyqU8J2QZVfk6y2eN8QhUHzQPeVjzbsD OJSlzrqZY1Ql1GwjbEAj7POKZYrf/fAq57MriA== )`
	RRSIG=20038 and DNSKEY=20038 verifies the DS RRset
	DS=2536/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 )`
	Query to d.ns.gov for gov/DNSKEY
	Received 291 bytes from 199.33.233.1
	;; Response received from [199.33.233.1] 291 octets ;; HEADER SECTION ;; id = 52129 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; Key ID = 2536 gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; Key ID = 35496 gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20240919110526 20240720110526 2536 gov. HdS8shIfEbsTrkW5QWcemVuIGkuI/xGvzvDYxBTf/LuRRNzN5FvUA1PbOTLXYLEfPZkeLTC07umN zFbL4Pqx9w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for gov
	`gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; Key ID = 2536`
	`gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; Key ID = 35496`
	DNSKEY=2536/SEP is now in the chain-of-trust
	DS=2536/SHA-256 verifies DNSKEY=2536/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20240919110526 20240720110526 2536 gov. HdS8shIfEbsTrkW5QWcemVuIGkuI/xGvzvDYxBTf/LuRRNzN5FvUA1PbOTLXYLEfPZkeLTC07umN zFbL4Pqx9w== )`
	RRSIG=2536 and DNSKEY=2536/SEP verifies the DNSKEY RRset
	DNSKEY=35496 is now in the chain-of-trust
	Query to c.ns.gov for fnal.gov/A
	Received 438 bytes from 199.33.232.1
	;; Response received from [199.33.232.1] 438 octets ;; HEADER SECTION ;; id = 23981 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 5 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) fnal.gov. 10800 IN NS adns1.es.net. fnal.gov. 10800 IN NS adns2.es.net. fnal.gov. 10800 IN NS ns1.fnal.gov. fnal.gov. 10800 IN NS ns2.fnal.gov. fnal.gov. 3600 IN DS ( 35409 7 2 ae1a224da6483981c772ce24cf1c3b61eabf034608d3cdba399770e259895f92 ) fnal.gov. 3600 IN DS 55074 7 1 dfaaafb52ff2600ccec66263c5155b0a986789fe fnal.gov. 3600 IN DS ( 55074 7 2 89a8161f9964c3cbf2dd7a2255d5ae818b4f63308a420252b00d5fe7e73c8ef7 ) fnal.gov. 3600 IN RRSIG ( DS 13 2 3600 20240728032635 20240726012635 35496 gov. MQ133+eGyGOXvCg+/hSWb58AYDj+6wbwpVm2yyN/mi8yj0/zu4Z2MxZWetjxG2vVD9iQ7LIzMZsB lWF6Lt1p7w== ) ;; ADDITIONAL SECTION (5 records) ns1.fnal.gov. 3600 IN A 198.49.208.71 ns1.fnal.gov. 3600 IN AAAA 2620:6a:0:1203::208:71 ns2.fnal.gov. 3600 IN A 198.49.208.70 ns2.fnal.gov. 3600 IN AAAA 2620:6a:0:1203::208:70 ;; { "EDNS-VERSION": 0 }
	Query to c.ns.gov for fnal.gov/DNSKEY
	Received 438 bytes from 199.33.232.1
	;; Response received from [199.33.232.1] 438 octets ;; HEADER SECTION ;; id = 31354 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 5 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) fnal.gov. 10800 IN NS adns1.es.net. fnal.gov. 10800 IN NS adns2.es.net. fnal.gov. 10800 IN NS ns1.fnal.gov. fnal.gov. 10800 IN NS ns2.fnal.gov. fnal.gov. 3600 IN DS ( 35409 7 2 ae1a224da6483981c772ce24cf1c3b61eabf034608d3cdba399770e259895f92 ) fnal.gov. 3600 IN DS 55074 7 1 dfaaafb52ff2600ccec66263c5155b0a986789fe fnal.gov. 3600 IN DS ( 55074 7 2 89a8161f9964c3cbf2dd7a2255d5ae818b4f63308a420252b00d5fe7e73c8ef7 ) fnal.gov. 3600 IN RRSIG ( DS 13 2 3600 20240728032635 20240726012635 35496 gov. j37OnjaK3XzhxMsv4q5IDtUnEJqzpaYAPsXN8u/V5/yZPvNbSMRzTUytOmZJJnB/pWIZ9oxlJLtK p4eUeGe+Jw== ) ;; ADDITIONAL SECTION (5 records) ns1.fnal.gov. 3600 IN A 198.49.208.71 ns1.fnal.gov. 3600 IN AAAA 2620:6a:0:1203::208:71 ns2.fnal.gov. 3600 IN A 198.49.208.70 ns2.fnal.gov. 3600 IN AAAA 2620:6a:0:1203::208:70 ;; { "EDNS-VERSION": 0 }
	Found child zone fnal.gov

fnal.gov

	Checking DS between gov and fnal.gov
	Query to d.ns.gov for fnal.gov/DS
	Received 268 bytes from 199.33.233.1
	;; Response received from [199.33.233.1] 268 octets ;; HEADER SECTION ;; id = 36154 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN DS ;; ANSWER SECTION (4 records) fnal.gov. 3600 IN DS ( 35409 7 2 ae1a224da6483981c772ce24cf1c3b61eabf034608d3cdba399770e259895f92 ) fnal.gov. 3600 IN DS 55074 7 1 dfaaafb52ff2600ccec66263c5155b0a986789fe fnal.gov. 3600 IN DS ( 55074 7 2 89a8161f9964c3cbf2dd7a2255d5ae818b4f63308a420252b00d5fe7e73c8ef7 ) fnal.gov. 3600 IN RRSIG ( DS 13 2 3600 20240728032635 20240726012635 35496 gov. lMmFEqDu9srmpc/gIHxgjP/Yc8fEwe8eXDMYpqtMBVzlUWVZxTAU0gBpP8p4qCD7BEYqlF4j3AiX PyczJ2BnjA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DS records for fnal.gov in the gov zone
	DS=55074/SHA-1 uses a deprecated digest algorithm
	DS=35409/SHA-256 has algorithm RSASHA1-NSEC3-SHA1
	DS=55074/SHA-1 has algorithm RSASHA1-NSEC3-SHA1
	DS=55074/SHA-256 has algorithm RSASHA1-NSEC3-SHA1
	Found 1 RRSIGs over DS RRset
	`fnal.gov. 3600 IN RRSIG ( DS 13 2 3600 20240728032635 20240726012635 35496 gov. lMmFEqDu9srmpc/gIHxgjP/Yc8fEwe8eXDMYpqtMBVzlUWVZxTAU0gBpP8p4qCD7BEYqlF4j3AiX PyczJ2BnjA== )`
	RRSIG=35496 and DNSKEY=35496 verifies the DS RRset
	DS=35409/SHA-256 is now in the chain-of-trust
	DS=55074/SHA-1 is now in the chain-of-trust
	`fnal.gov. 3600 IN DS ( 35409 7 2 ae1a224da6483981c772ce24cf1c3b61eabf034608d3cdba399770e259895f92 )`
	`fnal.gov. 3600 IN DS 55074 7 1 dfaaafb52ff2600ccec66263c5155b0a986789fe`
	`fnal.gov. 3600 IN DS ( 55074 7 2 89a8161f9964c3cbf2dd7a2255d5ae818b4f63308a420252b00d5fe7e73c8ef7 )`
	Query to adns1.es.net for fnal.gov/DNSKEY
	Received 925 bytes from 192.188.22.22
	;; Response received from [192.188.22.22] 925 octets ;; HEADER SECTION ;; id = 50630 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN DNSKEY ;; ANSWER SECTION (4 records) fnal.gov. 172800 IN DNSKEY ( 256 3 7 AwEAAbBT+0B2u4htBdodx0sG89B5VNO29QI4Dujbs0k+45Qrj5IW/sCgIsQ2IAJiyrvGQJh5QnKC Qv4Qih7DH6b+tQqokGZLL5TtI8R0qQ5WbPh39GYn3KslidBNYbq6a3xiABRNVlAo+vWCSDG3PT8A DsE9BQK5jlJZaRkSJ1c5n3aj ) ; Key ID = 21194 fnal.gov. 172800 IN DNSKEY ( 257 3 7 AwEAAcMsvu6xati3yVItCTMU1ll5HvWkG7mtNoQUC68FGvVvBhb29LhSRLukKCzLrXdkQJaSBrdQ e5GpVu6G14l7t7Uh4PK8aG6OvzLdLsPc/ZpejZpFHuQZBd1fsMwbEh+bEZCsQ9jgb3oideeyT8wc 5bXN9Zw7GAESM+S6P+LfKq7RHZYjLJ6v4DxYjBTMKbPypPLHHc5Nk1+hdLnmMM2ilI8M4i/pJRQq hj35reXpkLgo2QabsQEiGa79AmUTTxKzkz8LIFwdlUCk7uX3oM1+FldSeNvgn/iV7H7hyueJ3pxt CCn+SiiIxhUodGnRZj1ZhxCHZjC5cD/8oVQ5P7SP+j8= ) ; Key ID = 35409 fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20240730235652 20240726233454 21194 fnal.gov. W6amy7fcFxPfF3hudvQTvhdOjMvXeWzPZ7eFGqbz3zQu0PJfH92HC2/xkVQNVGKClj+6ja02TAie XCSd5g0kl0uVM++JHzbkRJr4+YSxnSuW9Lbn12XVbXI6t7m8gIDwa/HOWk7ulVXLimld9EZ6mdbx batzJch2qc6jiM9M7kM= ) fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20240730235652 20240726233454 35409 fnal.gov. uVrkuCVBuw4CWBRu29fC+Ad7buwWHlxMERQqidDWy6habz4SMfffRyIXFveyhT7ZDJnQJUGynS9W KyWjZZJhOOTlqjVGstabQUdBnAH0ob3D6nGFEdCSMCElgRI3bOLLJ32tEZZEKPDs6pcguJSuJ/j2 +Q+7niKHjpKYhe8Fy/vRaRp8e99Ci3wFivgA6UTvpsYyEOafqqmOjAzpaio2VOm0X8U6+M9UGTta /OtZzF1b71DJtJ8PIZuyK4qcOw9Xx8q4+4qAMadwRAYteAQ8c6gYFewAX4BAx8B5r2ah9kC33aJy kkjCkoeanu6rjLYtsuBnEDDnKiox83bKfaIZ3g== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for fnal.gov
	`fnal.gov. 172800 IN DNSKEY ( 256 3 7 AwEAAbBT+0B2u4htBdodx0sG89B5VNO29QI4Dujbs0k+45Qrj5IW/sCgIsQ2IAJiyrvGQJh5QnKC Qv4Qih7DH6b+tQqokGZLL5TtI8R0qQ5WbPh39GYn3KslidBNYbq6a3xiABRNVlAo+vWCSDG3PT8A DsE9BQK5jlJZaRkSJ1c5n3aj ) ; Key ID = 21194`
	`fnal.gov. 172800 IN DNSKEY ( 257 3 7 AwEAAcMsvu6xati3yVItCTMU1ll5HvWkG7mtNoQUC68FGvVvBhb29LhSRLukKCzLrXdkQJaSBrdQ e5GpVu6G14l7t7Uh4PK8aG6OvzLdLsPc/ZpejZpFHuQZBd1fsMwbEh+bEZCsQ9jgb3oideeyT8wc 5bXN9Zw7GAESM+S6P+LfKq7RHZYjLJ6v4DxYjBTMKbPypPLHHc5Nk1+hdLnmMM2ilI8M4i/pJRQq hj35reXpkLgo2QabsQEiGa79AmUTTxKzkz8LIFwdlUCk7uX3oM1+FldSeNvgn/iV7H7hyueJ3pxt CCn+SiiIxhUodGnRZj1ZhxCHZjC5cD/8oVQ5P7SP+j8= ) ; Key ID = 35409`
	DNSKEY=35409/SEP is now in the chain-of-trust
	DS=35409/SHA-256 verifies DNSKEY=35409/SEP
	DS=55074/SHA-1 is published, but a corresponding DNSKEY is not
	Found 2 RRSIGs over DNSKEY RRset
	`fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20240730235652 20240726233454 21194 fnal.gov. W6amy7fcFxPfF3hudvQTvhdOjMvXeWzPZ7eFGqbz3zQu0PJfH92HC2/xkVQNVGKClj+6ja02TAie XCSd5g0kl0uVM++JHzbkRJr4+YSxnSuW9Lbn12XVbXI6t7m8gIDwa/HOWk7ulVXLimld9EZ6mdbx batzJch2qc6jiM9M7kM= )`
	`fnal.gov. 172800 IN RRSIG ( DNSKEY 7 2 172800 20240730235652 20240726233454 35409 fnal.gov. uVrkuCVBuw4CWBRu29fC+Ad7buwWHlxMERQqidDWy6habz4SMfffRyIXFveyhT7ZDJnQJUGynS9W KyWjZZJhOOTlqjVGstabQUdBnAH0ob3D6nGFEdCSMCElgRI3bOLLJ32tEZZEKPDs6pcguJSuJ/j2 +Q+7niKHjpKYhe8Fy/vRaRp8e99Ci3wFivgA6UTvpsYyEOafqqmOjAzpaio2VOm0X8U6+M9UGTta /OtZzF1b71DJtJ8PIZuyK4qcOw9Xx8q4+4qAMadwRAYteAQ8c6gYFewAX4BAx8B5r2ah9kC33aJy kkjCkoeanu6rjLYtsuBnEDDnKiox83bKfaIZ3g== )`
	RRSIG=21194 and DNSKEY=21194 verifies the DNSKEY RRset
	RRSIG=35409 and DNSKEY=35409/SEP verifies the DNSKEY RRset
	DNSKEY=21194 is now in the chain-of-trust
	Query to ns2.fnal.gov for fnal.gov/A
	Received 221 bytes from 198.49.208.70
	;; Response received from [198.49.208.70] 221 octets ;; HEADER SECTION ;; id = 42113 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN A ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN A 131.225.105.15 fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20240730050519 20240726045638 21194 fnal.gov. WkVeZyIMea+FIOkto6s9VpAf1LRwXUeROraArpL1C85ix2lQZvlsWsXApuCraQL8vX2r3uGZ62QY ad8jA3Ar3nXcuU/xRoleXNEfaoD0LemVlkzA4wJn0X6yMJChBhhAWmnnKEwPJLtfAybtOjY+5Wus I5Byk+LQY9j/dW7YBqM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns2.fnal.gov is authoritative for fnal.gov
	Found RRSIG signed by fnal.gov zone
	Query to adns1.es.net for fnal.gov/SOA
	Received 256 bytes from 192.188.22.22
	;; Response received from [192.188.22.22] 256 octets ;; HEADER SECTION ;; id = 28969 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN SOA ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN SOA ( ns1.fnal.gov. netmanager.fnal.gov. 2030407472 ;serial 7200 ;refresh 120 ;retry 1209600 ;expire 900 ;minimum ) fnal.gov. 21600 IN RRSIG ( SOA 7 2 21600 20240731022624 20240727012624 21194 fnal.gov. QfDcktvQSsG4oFpoj7g9VxondF/oLCLtqHIidaxA0KwXWqyGcC5mZBhpbywf/OjGfmEkZiroQEAg qxt222T6b3GcXy2JtEiHjQL/6yfRPZjhadpjySn7tWhkRXdfwOA4D4zgo+rGQxQl1rI4ekvUczmO s/pWRqED1ShuF/ah488= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns1.fnal.gov for fnal.gov/SOA
	Received 256 bytes from 198.49.208.71
	;; Response received from [198.49.208.71] 256 octets ;; HEADER SECTION ;; id = 61776 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN SOA ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN SOA ( ns1.fnal.gov. netmanager.fnal.gov. 2030407472 ;serial 7200 ;refresh 120 ;retry 1209600 ;expire 900 ;minimum ) fnal.gov. 21600 IN RRSIG ( SOA 7 2 21600 20240731022624 20240727012624 21194 fnal.gov. QfDcktvQSsG4oFpoj7g9VxondF/oLCLtqHIidaxA0KwXWqyGcC5mZBhpbywf/OjGfmEkZiroQEAg qxt222T6b3GcXy2JtEiHjQL/6yfRPZjhadpjySn7tWhkRXdfwOA4D4zgo+rGQxQl1rI4ekvUczmO s/pWRqED1ShuF/ah488= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to adns2.es.net for fnal.gov/SOA
	Received 1094 bytes from 192.188.22.52
	;; Response received from [192.188.22.52] 1094 octets ;; HEADER SECTION ;; id = 27548 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 5 arcount = 8 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN SOA ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN SOA ( ns1.fnal.gov. netmanager.fnal.gov. 2030407472 ;serial 7200 ;refresh 120 ;retry 1209600 ;expire 900 ;minimum ) fnal.gov. 21600 IN RRSIG ( SOA 7 2 21600 20240731022624 20240727012624 21194 fnal.gov. QfDcktvQSsG4oFpoj7g9VxondF/oLCLtqHIidaxA0KwXWqyGcC5mZBhpbywf/OjGfmEkZiroQEAg qxt222T6b3GcXy2JtEiHjQL/6yfRPZjhadpjySn7tWhkRXdfwOA4D4zgo+rGQxQl1rI4ekvUczmO s/pWRqED1ShuF/ah488= ) ;; AUTHORITY SECTION (5 records) fnal.gov. 21600 IN NS ns1.fnal.gov. fnal.gov. 21600 IN NS adns2.es.net. fnal.gov. 21600 IN NS adns1.es.net. fnal.gov. 21600 IN NS ns2.fnal.gov. fnal.gov. 21600 IN RRSIG ( NS 7 2 21600 20240730204546 20240726195522 21194 fnal.gov. fVkVlEmQnEabFeuuu6ZsXyzUeylGZq33Lp/vWzWoZ+skly3EncdU93Us2YOLasEp7xWaJ5NgJtql wbrLQ258WkMk5rqYEf3zDXraH/64sd5izqc1NDVXFdbdb5qT2pAUjQ9lx+ROlWTXjnFoeYJKTafH OPU7EoTYCAj9AwW71M0= ) ;; ADDITIONAL SECTION (8 records) ns1.fnal.gov. 21600 IN A 198.49.208.71 ns2.fnal.gov. 21600 IN A 198.49.208.70 ns1.fnal.gov. 21600 IN AAAA 2620:6a:0:1203::208:71 ns2.fnal.gov. 21600 IN AAAA 2620:6a:0:1203::208:70 ns1.fnal.gov. 21600 IN RRSIG ( A 7 3 21600 20240730041850 20240726033826 21194 fnal.gov. OomskMAQtdDYFl6PuGgsP6X8td8jDpEWpyQswmlSIeLJyJT6kZSEAVG7TZk742UWIUAL0XqfjDVM 3iIFfns06VNm4+m1w13za2rR+XNN61XRIikHwAFYi70o06NXyGTM7Fn6TfGoa27GnbWJ5cKy53op iVfdKvg3sz3gkog46n0= ) ns1.fnal.gov. 21600 IN RRSIG ( AAAA 7 3 21600 20240730110539 20240726103424 21194 fnal.gov. jKZguHgl9WIuiGx1SVlAm+s/VAGfQgPibaXofPZMukVTNqRk7hMOsZEqqO2fjeBup4w0dK7l0Zef rhsdXkja/0NxSk4uwK+sn7mKL/58O36yLc+9BTy/XWxiZANn7/hsQmh+RrkIWz64ctRTmgmQXl7y Vm0KlViJM7x45353Tng= ) ns2.fnal.gov. 21600 IN RRSIG ( A 7 3 21600 20240730182320 20240726181247 21194 fnal.gov. B7JFJuVE4bajG85qKn4uJhegDxF/OPcvGTzlF6oOouRUJI1dqRhdu4xZ2Y5mNeM0uwnCKfwUuPWy VwkV8ZxgmtfC7QYPEwlwVtdUmHzWIFXu7GyDTbNCoxhKDwnsjLryexi5+vp7hF0H65b5pFiPe1X1 sA2FgWE40liLj9gzJxM= ) ;; { "EDNS-VERSION": 0 }
	Query to ns2.fnal.gov for fnal.gov/A
	Received 221 bytes from 198.49.208.70
	;; Response received from [198.49.208.70] 221 octets ;; HEADER SECTION ;; id = 21743 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN A ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN A 131.225.105.15 fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20240730050519 20240726045638 21194 fnal.gov. WkVeZyIMea+FIOkto6s9VpAf1LRwXUeROraArpL1C85ix2lQZvlsWsXApuCraQL8vX2r3uGZ62QY ad8jA3Ar3nXcuU/xRoleXNEfaoD0LemVlkzA4wJn0X6yMJChBhhAWmnnKEwPJLtfAybtOjY+5Wus I5Byk+LQY9j/dW7YBqM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	fnal.gov A RR has value 131.225.105.15
	Found 1 RRSIGs over A RRset
	`fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20240730050519 20240726045638 21194 fnal.gov. WkVeZyIMea+FIOkto6s9VpAf1LRwXUeROraArpL1C85ix2lQZvlsWsXApuCraQL8vX2r3uGZ62QY ad8jA3Ar3nXcuU/xRoleXNEfaoD0LemVlkzA4wJn0X6yMJChBhhAWmnnKEwPJLtfAybtOjY+5Wus I5Byk+LQY9j/dW7YBqM= )`
	RRSIG=21194 and DNSKEY=21194 verifies the A RRset

fnal.gov

	Query to adns1.es.net for fnal.gov/A
	Received 221 bytes from 192.188.22.22
	;; Response received from [192.188.22.22] 221 octets ;; HEADER SECTION ;; id = 15807 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN A ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN A 131.225.105.15 fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20240730050519 20240726045638 21194 fnal.gov. WkVeZyIMea+FIOkto6s9VpAf1LRwXUeROraArpL1C85ix2lQZvlsWsXApuCraQL8vX2r3uGZ62QY ad8jA3Ar3nXcuU/xRoleXNEfaoD0LemVlkzA4wJn0X6yMJChBhhAWmnnKEwPJLtfAybtOjY+5Wus I5Byk+LQY9j/dW7YBqM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	adns1.es.net is authoritative for fnal.gov
	Found RRSIG signed by fnal.gov zone
	Query to adns1.es.net for fnal.gov/A
	Received 221 bytes from 192.188.22.22
	;; Response received from [192.188.22.22] 221 octets ;; HEADER SECTION ;; id = 22984 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN A ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN A 131.225.105.15 fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20240730050519 20240726045638 21194 fnal.gov. WkVeZyIMea+FIOkto6s9VpAf1LRwXUeROraArpL1C85ix2lQZvlsWsXApuCraQL8vX2r3uGZ62QY ad8jA3Ar3nXcuU/xRoleXNEfaoD0LemVlkzA4wJn0X6yMJChBhhAWmnnKEwPJLtfAybtOjY+5Wus I5Byk+LQY9j/dW7YBqM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	fnal.gov A RR has value 131.225.105.15
	Found 1 RRSIGs over A RRset
	`fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20240730050519 20240726045638 21194 fnal.gov. WkVeZyIMea+FIOkto6s9VpAf1LRwXUeROraArpL1C85ix2lQZvlsWsXApuCraQL8vX2r3uGZ62QY ad8jA3Ar3nXcuU/xRoleXNEfaoD0LemVlkzA4wJn0X6yMJChBhhAWmnnKEwPJLtfAybtOjY+5Wus I5Byk+LQY9j/dW7YBqM= )`
	RRSIG=21194 and DNSKEY=21194 verifies the A RRset

fnal.gov

	Query to adns2.es.net for fnal.gov/A
	Received 1063 bytes from 192.188.22.52
	;; Response received from [192.188.22.52] 1063 octets ;; HEADER SECTION ;; id = 21533 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 5 arcount = 8 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN A ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN A 131.225.105.15 fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20240730050519 20240726045638 21194 fnal.gov. WkVeZyIMea+FIOkto6s9VpAf1LRwXUeROraArpL1C85ix2lQZvlsWsXApuCraQL8vX2r3uGZ62QY ad8jA3Ar3nXcuU/xRoleXNEfaoD0LemVlkzA4wJn0X6yMJChBhhAWmnnKEwPJLtfAybtOjY+5Wus I5Byk+LQY9j/dW7YBqM= ) ;; AUTHORITY SECTION (5 records) fnal.gov. 21600 IN NS adns1.es.net. fnal.gov. 21600 IN NS ns1.fnal.gov. fnal.gov. 21600 IN NS ns2.fnal.gov. fnal.gov. 21600 IN NS adns2.es.net. fnal.gov. 21600 IN RRSIG ( NS 7 2 21600 20240730204546 20240726195522 21194 fnal.gov. fVkVlEmQnEabFeuuu6ZsXyzUeylGZq33Lp/vWzWoZ+skly3EncdU93Us2YOLasEp7xWaJ5NgJtql wbrLQ258WkMk5rqYEf3zDXraH/64sd5izqc1NDVXFdbdb5qT2pAUjQ9lx+ROlWTXjnFoeYJKTafH OPU7EoTYCAj9AwW71M0= ) ;; ADDITIONAL SECTION (8 records) ns1.fnal.gov. 21600 IN A 198.49.208.71 ns2.fnal.gov. 21600 IN A 198.49.208.70 ns1.fnal.gov. 21600 IN AAAA 2620:6a:0:1203::208:71 ns2.fnal.gov. 21600 IN AAAA 2620:6a:0:1203::208:70 ns1.fnal.gov. 21600 IN RRSIG ( A 7 3 21600 20240730041850 20240726033826 21194 fnal.gov. OomskMAQtdDYFl6PuGgsP6X8td8jDpEWpyQswmlSIeLJyJT6kZSEAVG7TZk742UWIUAL0XqfjDVM 3iIFfns06VNm4+m1w13za2rR+XNN61XRIikHwAFYi70o06NXyGTM7Fn6TfGoa27GnbWJ5cKy53op iVfdKvg3sz3gkog46n0= ) ns1.fnal.gov. 21600 IN RRSIG ( AAAA 7 3 21600 20240730110539 20240726103424 21194 fnal.gov. jKZguHgl9WIuiGx1SVlAm+s/VAGfQgPibaXofPZMukVTNqRk7hMOsZEqqO2fjeBup4w0dK7l0Zef rhsdXkja/0NxSk4uwK+sn7mKL/58O36yLc+9BTy/XWxiZANn7/hsQmh+RrkIWz64ctRTmgmQXl7y Vm0KlViJM7x45353Tng= ) ns2.fnal.gov. 21600 IN RRSIG ( A 7 3 21600 20240730182320 20240726181247 21194 fnal.gov. B7JFJuVE4bajG85qKn4uJhegDxF/OPcvGTzlF6oOouRUJI1dqRhdu4xZ2Y5mNeM0uwnCKfwUuPWy VwkV8ZxgmtfC7QYPEwlwVtdUmHzWIFXu7GyDTbNCoxhKDwnsjLryexi5+vp7hF0H65b5pFiPe1X1 sA2FgWE40liLj9gzJxM= ) ;; { "EDNS-VERSION": 0 }
	adns2.es.net is authoritative for fnal.gov
	Found RRSIG signed by fnal.gov zone
	Query to adns2.es.net for fnal.gov/A
	Received 1063 bytes from 192.188.22.52
	;; Response received from [192.188.22.52] 1063 octets ;; HEADER SECTION ;; id = 33359 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 5 arcount = 8 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN A ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN A 131.225.105.15 fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20240730050519 20240726045638 21194 fnal.gov. WkVeZyIMea+FIOkto6s9VpAf1LRwXUeROraArpL1C85ix2lQZvlsWsXApuCraQL8vX2r3uGZ62QY ad8jA3Ar3nXcuU/xRoleXNEfaoD0LemVlkzA4wJn0X6yMJChBhhAWmnnKEwPJLtfAybtOjY+5Wus I5Byk+LQY9j/dW7YBqM= ) ;; AUTHORITY SECTION (5 records) fnal.gov. 21600 IN NS ns1.fnal.gov. fnal.gov. 21600 IN NS ns2.fnal.gov. fnal.gov. 21600 IN NS adns1.es.net. fnal.gov. 21600 IN NS adns2.es.net. fnal.gov. 21600 IN RRSIG ( NS 7 2 21600 20240730204546 20240726195522 21194 fnal.gov. fVkVlEmQnEabFeuuu6ZsXyzUeylGZq33Lp/vWzWoZ+skly3EncdU93Us2YOLasEp7xWaJ5NgJtql wbrLQ258WkMk5rqYEf3zDXraH/64sd5izqc1NDVXFdbdb5qT2pAUjQ9lx+ROlWTXjnFoeYJKTafH OPU7EoTYCAj9AwW71M0= ) ;; ADDITIONAL SECTION (8 records) ns1.fnal.gov. 21600 IN A 198.49.208.71 ns2.fnal.gov. 21600 IN A 198.49.208.70 ns1.fnal.gov. 21600 IN AAAA 2620:6a:0:1203::208:71 ns2.fnal.gov. 21600 IN AAAA 2620:6a:0:1203::208:70 ns1.fnal.gov. 21600 IN RRSIG ( A 7 3 21600 20240730041850 20240726033826 21194 fnal.gov. OomskMAQtdDYFl6PuGgsP6X8td8jDpEWpyQswmlSIeLJyJT6kZSEAVG7TZk742UWIUAL0XqfjDVM 3iIFfns06VNm4+m1w13za2rR+XNN61XRIikHwAFYi70o06NXyGTM7Fn6TfGoa27GnbWJ5cKy53op iVfdKvg3sz3gkog46n0= ) ns1.fnal.gov. 21600 IN RRSIG ( AAAA 7 3 21600 20240730110539 20240726103424 21194 fnal.gov. jKZguHgl9WIuiGx1SVlAm+s/VAGfQgPibaXofPZMukVTNqRk7hMOsZEqqO2fjeBup4w0dK7l0Zef rhsdXkja/0NxSk4uwK+sn7mKL/58O36yLc+9BTy/XWxiZANn7/hsQmh+RrkIWz64ctRTmgmQXl7y Vm0KlViJM7x45353Tng= ) ns2.fnal.gov. 21600 IN RRSIG ( A 7 3 21600 20240730182320 20240726181247 21194 fnal.gov. B7JFJuVE4bajG85qKn4uJhegDxF/OPcvGTzlF6oOouRUJI1dqRhdu4xZ2Y5mNeM0uwnCKfwUuPWy VwkV8ZxgmtfC7QYPEwlwVtdUmHzWIFXu7GyDTbNCoxhKDwnsjLryexi5+vp7hF0H65b5pFiPe1X1 sA2FgWE40liLj9gzJxM= ) ;; { "EDNS-VERSION": 0 }
	fnal.gov A RR has value 131.225.105.15
	Found 1 RRSIGs over A RRset
	`fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20240730050519 20240726045638 21194 fnal.gov. WkVeZyIMea+FIOkto6s9VpAf1LRwXUeROraArpL1C85ix2lQZvlsWsXApuCraQL8vX2r3uGZ62QY ad8jA3Ar3nXcuU/xRoleXNEfaoD0LemVlkzA4wJn0X6yMJChBhhAWmnnKEwPJLtfAybtOjY+5Wus I5Byk+LQY9j/dW7YBqM= )`
	RRSIG=21194 and DNSKEY=21194 verifies the A RRset

fnal.gov

	Query to ns1.fnal.gov for fnal.gov/A
	Received 221 bytes from 198.49.208.71
	;; Response received from [198.49.208.71] 221 octets ;; HEADER SECTION ;; id = 36422 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN A ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN A 131.225.105.15 fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20240730050519 20240726045638 21194 fnal.gov. WkVeZyIMea+FIOkto6s9VpAf1LRwXUeROraArpL1C85ix2lQZvlsWsXApuCraQL8vX2r3uGZ62QY ad8jA3Ar3nXcuU/xRoleXNEfaoD0LemVlkzA4wJn0X6yMJChBhhAWmnnKEwPJLtfAybtOjY+5Wus I5Byk+LQY9j/dW7YBqM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns1.fnal.gov is authoritative for fnal.gov
	Found RRSIG signed by fnal.gov zone
	Query to ns1.fnal.gov for fnal.gov/A
	Received 221 bytes from 198.49.208.71
	;; Response received from [198.49.208.71] 221 octets ;; HEADER SECTION ;; id = 54162 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; fnal.gov. IN A ;; ANSWER SECTION (2 records) fnal.gov. 21600 IN A 131.225.105.15 fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20240730050519 20240726045638 21194 fnal.gov. WkVeZyIMea+FIOkto6s9VpAf1LRwXUeROraArpL1C85ix2lQZvlsWsXApuCraQL8vX2r3uGZ62QY ad8jA3Ar3nXcuU/xRoleXNEfaoD0LemVlkzA4wJn0X6yMJChBhhAWmnnKEwPJLtfAybtOjY+5Wus I5Byk+LQY9j/dW7YBqM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	fnal.gov A RR has value 131.225.105.15
	Found 1 RRSIGs over A RRset
	`fnal.gov. 21600 IN RRSIG ( A 7 2 21600 20240730050519 20240726045638 21194 fnal.gov. WkVeZyIMea+FIOkto6s9VpAf1LRwXUeROraArpL1C85ix2lQZvlsWsXApuCraQL8vX2r3uGZ62QY ad8jA3Ar3nXcuU/xRoleXNEfaoD0LemVlkzA4wJn0X6yMJChBhhAWmnnKEwPJLtfAybtOjY+5Wus I5Byk+LQY9j/dW7YBqM= )`
	RRSIG=21194 and DNSKEY=21194 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test fnal.gov at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: