DNSSEC Debugger - healthcare.gov

Domain Name:

Time: 2024-07-27 08:38:11 UTC

Analyzing DNSSEC problems for healthcare.gov

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to f.root-servers.net for ./DNSKEY
	Received 864 bytes from 192.5.5.241
	;; Response received from [192.5.5.241] 864 octets ;; HEADER SECTION ;; id = 24036 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAdSiy6sslYrcZSGcuMEK4DtE8DZZY1A08kAsviAD49tocYO5m37AvIOyzeiKBWuPuJ4m9u5H onCM/ntxklZKYFyMftv8XoRwbiXdpSjfdpNHiMYTTV2oDUNMjdLFnF6HYSY48xrPbevQOYbAFGHp xqcXAQT0+BaBiAx3Ls6lXBQ3/hSVOprvDWJCQiI2OT+9+saKLddSIX6DwTVy0S5T4YY4EGg5R3c/ eKUb2/8XgKWUzlOIZsVAZZUSTKW0tX54ccAALO7Grvsx/NW62jc1xv6wWAXocOEVgB7+4Lzb7q9p 5o30+sYoGpOsKgFvMSy4oCZTQMQx2Sjd/NG2bMMw6nM= ) ; Key ID = 20038 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20240811000000 20240721000000 20326 . oHsHLvNMC6b1tY+OF7BG9etZbZMixRQiBD6gzpzdD32m4l0Vdh6yO0vA6ECQ3PMHihplvZGlYgZc aow5WFWod7FGAufSncGrrX+55sXKn4I/cZhBfPYh3WCCI+H7Ug29tV81VkeHSJgVd3q5LfUVYkun Czoysi01iU48KefmKZAGqzPINkOwRJT76+lyrOzSVQWvYStWsR5EGSvPQ1/tJQXOIzaEzuDDFp50 2fCJqX9CK9LcjCeleXpeDfdH+7Kk1TqRMrRHt3ehRsqh4yuR5buq+p+lCsHht28vdgjADBehrqmb hv6MGoBE3QK+rW5xuHqlu3jRV15JBY3/NnDSyQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAdSiy6sslYrcZSGcuMEK4DtE8DZZY1A08kAsviAD49tocYO5m37AvIOyzeiKBWuPuJ4m9u5H onCM/ntxklZKYFyMftv8XoRwbiXdpSjfdpNHiMYTTV2oDUNMjdLFnF6HYSY48xrPbevQOYbAFGHp xqcXAQT0+BaBiAx3Ls6lXBQ3/hSVOprvDWJCQiI2OT+9+saKLddSIX6DwTVy0S5T4YY4EGg5R3c/ eKUb2/8XgKWUzlOIZsVAZZUSTKW0tX54ccAALO7Grvsx/NW62jc1xv6wWAXocOEVgB7+4Lzb7q9p 5o30+sYoGpOsKgFvMSy4oCZTQMQx2Sjd/NG2bMMw6nM= ) ; Key ID = 20038`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20240811000000 20240721000000 20326 . oHsHLvNMC6b1tY+OF7BG9etZbZMixRQiBD6gzpzdD32m4l0Vdh6yO0vA6ECQ3PMHihplvZGlYgZc aow5WFWod7FGAufSncGrrX+55sXKn4I/cZhBfPYh3WCCI+H7Ug29tV81VkeHSJgVd3q5LfUVYkun Czoysi01iU48KefmKZAGqzPINkOwRJT76+lyrOzSVQWvYStWsR5EGSvPQ1/tJQXOIzaEzuDDFp50 2fCJqX9CK9LcjCeleXpeDfdH+7Kk1TqRMrRHt3ehRsqh4yuR5buq+p+lCsHht28vdgjADBehrqmb hv6MGoBE3QK+rW5xuHqlu3jRV15JBY3/NnDSyQ== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=20038 is now in the chain-of-trust
	Query to i.root-servers.net for healthcare.gov/A
	Received 624 bytes from 192.36.148.17
	;; Response received from [192.36.148.17] 624 octets ;; HEADER SECTION ;; id = 35975 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20240809050000 20240727040000 20038 . AUJBLpsUhWKjE6dvMcdfbNONvje+uhwNLO9U8w0BFf/JStvB2H0cug3378rsp9TixmL2Pl6iTnxd lIfGy7ce2UkJPmpABWGQvbaWBcMX8soIXD030Mcbhv+h41nzZxVt9/WdlTodaIporR4FVILyk+oE RwKwb9OCynYtshegCeic9ZY7wQvFCu9loycFBl8e3GXXzYE3MSNK9n5+PKNfF+MDRU1y8c9p9zOI dDogCAmpnHkIMy3LIr7EAWv0wQTYXji7Voiune7KF9bI/ziD+mGiX1h0B3+ubkK9XkKiMFVc+LX9 hn8F07K6wY1AhiYRgcg3u7mxEAZnJ36jApTVtQ== ) ;; ADDITIONAL SECTION (9 records) d.ns.gov. 172800 IN A 199.33.233.1 c.ns.gov. 172800 IN A 199.33.232.1 b.ns.gov. 172800 IN A 199.33.231.1 a.ns.gov. 172800 IN A 199.33.230.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 ;; { "EDNS-VERSION": 0 }
	Query to i.root-servers.net for gov/DNSKEY
	Received 613 bytes from 192.36.148.17
	;; Response received from [192.36.148.17] 613 octets ;; HEADER SECTION ;; id = 40141 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 172800 IN NS a.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20240809050000 20240727040000 20038 . AUJBLpsUhWKjE6dvMcdfbNONvje+uhwNLO9U8w0BFf/JStvB2H0cug3378rsp9TixmL2Pl6iTnxd lIfGy7ce2UkJPmpABWGQvbaWBcMX8soIXD030Mcbhv+h41nzZxVt9/WdlTodaIporR4FVILyk+oE RwKwb9OCynYtshegCeic9ZY7wQvFCu9loycFBl8e3GXXzYE3MSNK9n5+PKNfF+MDRU1y8c9p9zOI dDogCAmpnHkIMy3LIr7EAWv0wQTYXji7Voiune7KF9bI/ziD+mGiX1h0B3+ubkK9XkKiMFVc+LX9 hn8F07K6wY1AhiYRgcg3u7mxEAZnJ36jApTVtQ== ) ;; ADDITIONAL SECTION (9 records) d.ns.gov. 172800 IN A 199.33.233.1 c.ns.gov. 172800 IN A 199.33.232.1 b.ns.gov. 172800 IN A 199.33.231.1 a.ns.gov. 172800 IN A 199.33.230.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 ;; { "EDNS-VERSION": 0 }
	Found child zone gov

gov

	Checking DS between . and gov
	Query to j.root-servers.net for gov/DS
	Received 367 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 367 octets ;; HEADER SECTION ;; id = 19546 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20240809050000 20240727040000 20038 . AUJBLpsUhWKjE6dvMcdfbNONvje+uhwNLO9U8w0BFf/JStvB2H0cug3378rsp9TixmL2Pl6iTnxd lIfGy7ce2UkJPmpABWGQvbaWBcMX8soIXD030Mcbhv+h41nzZxVt9/WdlTodaIporR4FVILyk+oE RwKwb9OCynYtshegCeic9ZY7wQvFCu9loycFBl8e3GXXzYE3MSNK9n5+PKNfF+MDRU1y8c9p9zOI dDogCAmpnHkIMy3LIr7EAWv0wQTYXji7Voiune7KF9bI/ziD+mGiX1h0B3+ubkK9XkKiMFVc+LX9 hn8F07K6wY1AhiYRgcg3u7mxEAZnJ36jApTVtQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for gov in the . zone
	DS=2536/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20240809050000 20240727040000 20038 . AUJBLpsUhWKjE6dvMcdfbNONvje+uhwNLO9U8w0BFf/JStvB2H0cug3378rsp9TixmL2Pl6iTnxd lIfGy7ce2UkJPmpABWGQvbaWBcMX8soIXD030Mcbhv+h41nzZxVt9/WdlTodaIporR4FVILyk+oE RwKwb9OCynYtshegCeic9ZY7wQvFCu9loycFBl8e3GXXzYE3MSNK9n5+PKNfF+MDRU1y8c9p9zOI dDogCAmpnHkIMy3LIr7EAWv0wQTYXji7Voiune7KF9bI/ziD+mGiX1h0B3+ubkK9XkKiMFVc+LX9 hn8F07K6wY1AhiYRgcg3u7mxEAZnJ36jApTVtQ== )`
	RRSIG=20038 and DNSKEY=20038 verifies the DS RRset
	DS=2536/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 )`
	Query to a.ns.gov for gov/DNSKEY
	Received 291 bytes from 199.33.230.1
	;; Response received from [199.33.230.1] 291 octets ;; HEADER SECTION ;; id = 60900 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; Key ID = 2536 gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; Key ID = 35496 gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20240919110526 20240720110526 2536 gov. HdS8shIfEbsTrkW5QWcemVuIGkuI/xGvzvDYxBTf/LuRRNzN5FvUA1PbOTLXYLEfPZkeLTC07umN zFbL4Pqx9w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for gov
	`gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; Key ID = 2536`
	`gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; Key ID = 35496`
	DNSKEY=2536/SEP is now in the chain-of-trust
	DS=2536/SHA-256 verifies DNSKEY=2536/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20240919110526 20240720110526 2536 gov. HdS8shIfEbsTrkW5QWcemVuIGkuI/xGvzvDYxBTf/LuRRNzN5FvUA1PbOTLXYLEfPZkeLTC07umN zFbL4Pqx9w== )`
	RRSIG=2536 and DNSKEY=2536/SEP verifies the DNSKEY RRset
	DNSKEY=35496 is now in the chain-of-trust
	Query to c.ns.gov for healthcare.gov/A
	Received 321 bytes from 199.33.232.1
	;; Response received from [199.33.232.1] 321 octets ;; HEADER SECTION ;; id = 41010 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) healthcare.gov. 10800 IN NS a1-86.akam.net. healthcare.gov. 10800 IN NS a10-67.akam.net. healthcare.gov. 10800 IN NS a13-64.akam.net. healthcare.gov. 10800 IN NS a24-65.akam.net. healthcare.gov. 10800 IN NS a3-66.akam.net. healthcare.gov. 10800 IN NS a8-67.akam.net. healthcare.gov. 3600 IN DS ( 15654 7 2 2e84a95691bb3bd8e84d748621039a2fa3e8dc58cc3e4f49c87911d2e6903f92 ) healthcare.gov. 3600 IN RRSIG ( DS 13 2 3600 20240728093811 20240726073811 35496 gov. emdvEjqCwXUD9fl6WNteZIn+ELEzYXKSxyL9OhLAd2ySr9Xy4g80rhbzRE88aNkumCUkYD6So2z7 8eex8JO4Ug== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to b.ns.gov for healthcare.gov/DNSKEY
	Received 321 bytes from 199.33.231.1
	;; Response received from [199.33.231.1] 321 octets ;; HEADER SECTION ;; id = 60889 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) healthcare.gov. 10800 IN NS a1-86.akam.net. healthcare.gov. 10800 IN NS a10-67.akam.net. healthcare.gov. 10800 IN NS a13-64.akam.net. healthcare.gov. 10800 IN NS a24-65.akam.net. healthcare.gov. 10800 IN NS a3-66.akam.net. healthcare.gov. 10800 IN NS a8-67.akam.net. healthcare.gov. 3600 IN DS ( 15654 7 2 2e84a95691bb3bd8e84d748621039a2fa3e8dc58cc3e4f49c87911d2e6903f92 ) healthcare.gov. 3600 IN RRSIG ( DS 13 2 3600 20240728093811 20240726073811 35496 gov. TJrJt+kilqHDAF8LSSST361WssnsN6CAmww6Wo4jl4pY3VYDxXgtCRGqvpxygglB/SEMEOFQIDaa CinTF0Orpg== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone healthcare.gov

healthcare.gov

	Checking DS between gov and healthcare.gov
	Query to b.ns.gov for healthcare.gov/DS
	Received 190 bytes from 199.33.231.1
	;; Response received from [199.33.231.1] 190 octets ;; HEADER SECTION ;; id = 25709 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN DS ;; ANSWER SECTION (2 records) healthcare.gov. 3600 IN DS ( 15654 7 2 2e84a95691bb3bd8e84d748621039a2fa3e8dc58cc3e4f49c87911d2e6903f92 ) healthcare.gov. 3600 IN RRSIG ( DS 13 2 3600 20240728093811 20240726073811 35496 gov. ldmlUtR4w3gAvoruUQz9GEDHIa7H4hEop/EKq1EihRL3uthcTKLzEcMGjcIdWc9qLi9AoqtdvXf3 G+qSEyKLuA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for healthcare.gov in the gov zone
	DS=15654/SHA-256 has algorithm RSASHA1-NSEC3-SHA1
	Found 1 RRSIGs over DS RRset
	`healthcare.gov. 3600 IN RRSIG ( DS 13 2 3600 20240728093811 20240726073811 35496 gov. ldmlUtR4w3gAvoruUQz9GEDHIa7H4hEop/EKq1EihRL3uthcTKLzEcMGjcIdWc9qLi9AoqtdvXf3 G+qSEyKLuA== )`
	RRSIG=35496 and DNSKEY=35496 verifies the DS RRset
	DS=15654/SHA-256 is now in the chain-of-trust
	`healthcare.gov. 3600 IN DS ( 15654 7 2 2e84a95691bb3bd8e84d748621039a2fa3e8dc58cc3e4f49c87911d2e6903f92 )`
	Query to a3-66.akam.net for healthcare.gov/DNSKEY
	Received 917 bytes from 96.7.49.66
	;; Response received from [96.7.49.66] 917 octets ;; HEADER SECTION ;; id = 37574 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN DNSKEY ;; ANSWER SECTION (4 records) healthcare.gov. 7200 IN DNSKEY ( 257 3 7 AwEAAaM01WjqO1lXp1TDMNjNQwm+Wp0lfbZtOUd5oynCv8eozJSNc336R3wX6AMhI5EZGwRPhPSl l8NnN8tOVmXHUiyOrGjDfjvFqR2OaiggiOg7vIORB8IBfsRSG81F/b2PhVrGnLnlrdK+2SJ4iBrf 9ILu4vqRO/mNfjp++JmWADggl1bnMARhIDIJRWdkvaJK5y/Hrk/6xOpU6UvHQgkaW5aexXZkEWMP yVXSpUJ26W4QepB/CIojcDXIUK47LrD2k15v3F5EjjEi23MFryf+/ywRuhfl4XLPvzcFZHwIVbSa cx1AS5W0lb8fbB0gNNQG4L/Lck2Lxt2RqdFdYojYuw8= ) ; Key ID = 15654 healthcare.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAd3hhY+ku4NdxSJOL92HxW0G8RODCG/Pg264+aGCjTZINMO/mMsSfjsKClbjgvpen6hUJlOu C7Ay4cHGFgPZxPdPdv/oC9Q4zw51Qv2OTmmLdTujFifTprYD4Dfdrn+48L2Bs6rHTn5hculcPhRO Ovgj51gg+zaPASEWsMh+P9rJ ) ; Key ID = 59390 healthcare.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAdAi/COTU+9g93snuKH9fYUsj/fwn6sz7SvDZy3+jIqStDlH4VLtGim96Jg5nsBGdv83LkXj QeJ0J8Tdka71EftxqN315QIQyFt8J0gdga/6eRrKKGE3rTAB3FlyHZFiMEvWgkVkeRsKWtVKhLzp qM6L5TLu89KR9yF0bTw49WI3 ) ; Key ID = 36987 healthcare.gov. 7200 IN RRSIG ( DNSKEY 7 2 7200 20240730023618 20240727013618 15654 healthcare.gov. GmN4xZMIwtDE2vCfA1PjJkIooTEkNYldOQYCC0LzDC4zQqp9gsGeh4w0bf3NZqPpIuOcEm3b5VOX 3vXqy6cBqhemnq/uMjAwIA2D/+661z4fCj0Ftzc6nO6rXyHtSu0sM28hlwEvwqlHEWRpHbUv2NHu ooOagcIBqstFVAY7QetpUmdCbX1b0U+fIQ2VsE4/UmaE0Lad1r0r+RCGIbkfnilCdoTogaLMCmT8 fmeQkXnlOv/Fh1D+rCU/Wf7Q/0++X2uCqAk82hve0OoF0Yipn0FmF1FTHpxUGMe/+9Efjboes3/+ 8ym7MSIRjd00bJeAg0rIn8bWMKPMeINFf5gYwA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for healthcare.gov
	`healthcare.gov. 7200 IN DNSKEY ( 257 3 7 AwEAAaM01WjqO1lXp1TDMNjNQwm+Wp0lfbZtOUd5oynCv8eozJSNc336R3wX6AMhI5EZGwRPhPSl l8NnN8tOVmXHUiyOrGjDfjvFqR2OaiggiOg7vIORB8IBfsRSG81F/b2PhVrGnLnlrdK+2SJ4iBrf 9ILu4vqRO/mNfjp++JmWADggl1bnMARhIDIJRWdkvaJK5y/Hrk/6xOpU6UvHQgkaW5aexXZkEWMP yVXSpUJ26W4QepB/CIojcDXIUK47LrD2k15v3F5EjjEi23MFryf+/ywRuhfl4XLPvzcFZHwIVbSa cx1AS5W0lb8fbB0gNNQG4L/Lck2Lxt2RqdFdYojYuw8= ) ; Key ID = 15654`
	`healthcare.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAd3hhY+ku4NdxSJOL92HxW0G8RODCG/Pg264+aGCjTZINMO/mMsSfjsKClbjgvpen6hUJlOu C7Ay4cHGFgPZxPdPdv/oC9Q4zw51Qv2OTmmLdTujFifTprYD4Dfdrn+48L2Bs6rHTn5hculcPhRO Ovgj51gg+zaPASEWsMh+P9rJ ) ; Key ID = 59390`
	`healthcare.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAdAi/COTU+9g93snuKH9fYUsj/fwn6sz7SvDZy3+jIqStDlH4VLtGim96Jg5nsBGdv83LkXj QeJ0J8Tdka71EftxqN315QIQyFt8J0gdga/6eRrKKGE3rTAB3FlyHZFiMEvWgkVkeRsKWtVKhLzp qM6L5TLu89KR9yF0bTw49WI3 ) ; Key ID = 36987`
	DNSKEY=15654/SEP is now in the chain-of-trust
	DS=15654/SHA-256 verifies DNSKEY=15654/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`healthcare.gov. 7200 IN RRSIG ( DNSKEY 7 2 7200 20240730023618 20240727013618 15654 healthcare.gov. GmN4xZMIwtDE2vCfA1PjJkIooTEkNYldOQYCC0LzDC4zQqp9gsGeh4w0bf3NZqPpIuOcEm3b5VOX 3vXqy6cBqhemnq/uMjAwIA2D/+661z4fCj0Ftzc6nO6rXyHtSu0sM28hlwEvwqlHEWRpHbUv2NHu ooOagcIBqstFVAY7QetpUmdCbX1b0U+fIQ2VsE4/UmaE0Lad1r0r+RCGIbkfnilCdoTogaLMCmT8 fmeQkXnlOv/Fh1D+rCU/Wf7Q/0++X2uCqAk82hve0OoF0Yipn0FmF1FTHpxUGMe/+9Efjboes3/+ 8ym7MSIRjd00bJeAg0rIn8bWMKPMeINFf5gYwA== )`
	RRSIG=15654 and DNSKEY=15654/SEP verifies the DNSKEY RRset
	DNSKEY=59390 is now in the chain-of-trust
	DNSKEY=36987 is now in the chain-of-trust
	Query to a13-64.akam.net for healthcare.gov/A
	Received 233 bytes from 2.22.230.64
	;; Response received from [2.22.230.64] 233 octets ;; HEADER SECTION ;; id = 39235 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (2 records) healthcare.gov. 20 IN A 23.60.220.121 healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. QWxktq32VlLG5CtTDP4Z4I21PlwWh/oWzlXq5wJpYu3oXVrdxWRm9PqSvOlt0X2IDa0ukVT15IkJ KZiuMMw9qu9lRSM/EKpsyXMVGXuisqFfD8WZp6Og8uAo132R7inM3/0BE5kUy4KDoG7mZsMV1lxT WjHB9rkKgdTrFfJNed4= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a13-64.akam.net is authoritative for healthcare.gov
	Found RRSIG signed by healthcare.gov zone
	Query to a10-67.akam.net for healthcare.gov/SOA
	Received 584 bytes from 96.7.50.67
	;; Response received from [96.7.50.67] 584 octets ;; HEADER SECTION ;; id = 42267 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN SOA ;; ANSWER SECTION (2 records) healthcare.gov. 900 IN SOA ( usw2.akam.net. hostmaster.akamai.com. 1559940371 ;serial 300 ;refresh 30 ;retry 604800 ;expire 900 ;minimum ) healthcare.gov. 900 IN RRSIG ( SOA 7 2 900 20240730023618 20240727013618 36987 healthcare.gov. T1frRZmJHbPxM/V9tpec7gdiUMt4wYUPcgQBMswAG4jfmQm+HFNJzmrjxGeoUVsixCvNL/6isAMB prQRJ/gPK8Nv+nMXeQwFEoTUPR8mXhsv2CbwFDqpIx7QztdiBOWo4hmCccSKIjLXdZQAo8SaZNbd FdZ7Ty417NCakI1I8a8= ) ;; AUTHORITY SECTION (7 records) healthcare.gov. 86400 IN NS a24-65.akam.net. healthcare.gov. 86400 IN NS a10-67.akam.net. healthcare.gov. 86400 IN NS a1-86.akam.net. healthcare.gov. 86400 IN NS a3-66.akam.net. healthcare.gov. 86400 IN NS a13-64.akam.net. healthcare.gov. 86400 IN NS a8-67.akam.net. healthcare.gov. 86400 IN RRSIG ( NS 7 2 86400 20240730023618 20240727013618 36987 healthcare.gov. Zpq8+ssS6ksWWSX3ZHypWOIGeZ/wkh1kYOpjJYSFLSjbnU1UTWx6DaBdERc1QzeOBkKB82/gPstp kiJH/LWpOK+MYozIQaHRFLBEZ87a0YRrSSFazLFjl4Led9syAgMU41O2mpsiT8fuiYD9hDRj4Cc8 0ci7i4f8szQOFZ9sDBw= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a24-65.akam.net for healthcare.gov/SOA
	Received 584 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 584 octets ;; HEADER SECTION ;; id = 7827 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN SOA ;; ANSWER SECTION (2 records) healthcare.gov. 900 IN SOA ( usw2.akam.net. hostmaster.akamai.com. 1559940371 ;serial 300 ;refresh 30 ;retry 604800 ;expire 900 ;minimum ) healthcare.gov. 900 IN RRSIG ( SOA 7 2 900 20240730023618 20240727013618 36987 healthcare.gov. T1frRZmJHbPxM/V9tpec7gdiUMt4wYUPcgQBMswAG4jfmQm+HFNJzmrjxGeoUVsixCvNL/6isAMB prQRJ/gPK8Nv+nMXeQwFEoTUPR8mXhsv2CbwFDqpIx7QztdiBOWo4hmCccSKIjLXdZQAo8SaZNbd FdZ7Ty417NCakI1I8a8= ) ;; AUTHORITY SECTION (7 records) healthcare.gov. 86400 IN NS a10-67.akam.net. healthcare.gov. 86400 IN NS a13-64.akam.net. healthcare.gov. 86400 IN NS a1-86.akam.net. healthcare.gov. 86400 IN NS a24-65.akam.net. healthcare.gov. 86400 IN NS a3-66.akam.net. healthcare.gov. 86400 IN NS a8-67.akam.net. healthcare.gov. 86400 IN RRSIG ( NS 7 2 86400 20240730023618 20240727013618 36987 healthcare.gov. Zpq8+ssS6ksWWSX3ZHypWOIGeZ/wkh1kYOpjJYSFLSjbnU1UTWx6DaBdERc1QzeOBkKB82/gPstp kiJH/LWpOK+MYozIQaHRFLBEZ87a0YRrSSFazLFjl4Led9syAgMU41O2mpsiT8fuiYD9hDRj4Cc8 0ci7i4f8szQOFZ9sDBw= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a3-66.akam.net for healthcare.gov/SOA
	Received 584 bytes from 96.7.49.66
	;; Response received from [96.7.49.66] 584 octets ;; HEADER SECTION ;; id = 65517 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN SOA ;; ANSWER SECTION (2 records) healthcare.gov. 900 IN SOA ( usw2.akam.net. hostmaster.akamai.com. 1559940371 ;serial 300 ;refresh 30 ;retry 604800 ;expire 900 ;minimum ) healthcare.gov. 900 IN RRSIG ( SOA 7 2 900 20240730023618 20240727013618 36987 healthcare.gov. T1frRZmJHbPxM/V9tpec7gdiUMt4wYUPcgQBMswAG4jfmQm+HFNJzmrjxGeoUVsixCvNL/6isAMB prQRJ/gPK8Nv+nMXeQwFEoTUPR8mXhsv2CbwFDqpIx7QztdiBOWo4hmCccSKIjLXdZQAo8SaZNbd FdZ7Ty417NCakI1I8a8= ) ;; AUTHORITY SECTION (7 records) healthcare.gov. 86400 IN NS a10-67.akam.net. healthcare.gov. 86400 IN NS a8-67.akam.net. healthcare.gov. 86400 IN NS a3-66.akam.net. healthcare.gov. 86400 IN NS a1-86.akam.net. healthcare.gov. 86400 IN NS a24-65.akam.net. healthcare.gov. 86400 IN NS a13-64.akam.net. healthcare.gov. 86400 IN RRSIG ( NS 7 2 86400 20240730023618 20240727013618 36987 healthcare.gov. Zpq8+ssS6ksWWSX3ZHypWOIGeZ/wkh1kYOpjJYSFLSjbnU1UTWx6DaBdERc1QzeOBkKB82/gPstp kiJH/LWpOK+MYozIQaHRFLBEZ87a0YRrSSFazLFjl4Led9syAgMU41O2mpsiT8fuiYD9hDRj4Cc8 0ci7i4f8szQOFZ9sDBw= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a8-67.akam.net for healthcare.gov/SOA
	Received 584 bytes from 2.16.40.67
	;; Response received from [2.16.40.67] 584 octets ;; HEADER SECTION ;; id = 21573 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN SOA ;; ANSWER SECTION (2 records) healthcare.gov. 900 IN SOA ( usw2.akam.net. hostmaster.akamai.com. 1559940371 ;serial 300 ;refresh 30 ;retry 604800 ;expire 900 ;minimum ) healthcare.gov. 900 IN RRSIG ( SOA 7 2 900 20240730023618 20240727013618 36987 healthcare.gov. T1frRZmJHbPxM/V9tpec7gdiUMt4wYUPcgQBMswAG4jfmQm+HFNJzmrjxGeoUVsixCvNL/6isAMB prQRJ/gPK8Nv+nMXeQwFEoTUPR8mXhsv2CbwFDqpIx7QztdiBOWo4hmCccSKIjLXdZQAo8SaZNbd FdZ7Ty417NCakI1I8a8= ) ;; AUTHORITY SECTION (7 records) healthcare.gov. 86400 IN NS a13-64.akam.net. healthcare.gov. 86400 IN NS a10-67.akam.net. healthcare.gov. 86400 IN NS a8-67.akam.net. healthcare.gov. 86400 IN NS a3-66.akam.net. healthcare.gov. 86400 IN NS a24-65.akam.net. healthcare.gov. 86400 IN NS a1-86.akam.net. healthcare.gov. 86400 IN RRSIG ( NS 7 2 86400 20240730023618 20240727013618 36987 healthcare.gov. Zpq8+ssS6ksWWSX3ZHypWOIGeZ/wkh1kYOpjJYSFLSjbnU1UTWx6DaBdERc1QzeOBkKB82/gPstp kiJH/LWpOK+MYozIQaHRFLBEZ87a0YRrSSFazLFjl4Led9syAgMU41O2mpsiT8fuiYD9hDRj4Cc8 0ci7i4f8szQOFZ9sDBw= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a1-86.akam.net for healthcare.gov/SOA
	Received 584 bytes from 193.108.91.86
	;; Response received from [193.108.91.86] 584 octets ;; HEADER SECTION ;; id = 401 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN SOA ;; ANSWER SECTION (2 records) healthcare.gov. 900 IN SOA ( usw2.akam.net. hostmaster.akamai.com. 1559940371 ;serial 300 ;refresh 30 ;retry 604800 ;expire 900 ;minimum ) healthcare.gov. 900 IN RRSIG ( SOA 7 2 900 20240730023618 20240727013618 36987 healthcare.gov. T1frRZmJHbPxM/V9tpec7gdiUMt4wYUPcgQBMswAG4jfmQm+HFNJzmrjxGeoUVsixCvNL/6isAMB prQRJ/gPK8Nv+nMXeQwFEoTUPR8mXhsv2CbwFDqpIx7QztdiBOWo4hmCccSKIjLXdZQAo8SaZNbd FdZ7Ty417NCakI1I8a8= ) ;; AUTHORITY SECTION (7 records) healthcare.gov. 86400 IN NS a3-66.akam.net. healthcare.gov. 86400 IN NS a24-65.akam.net. healthcare.gov. 86400 IN NS a8-67.akam.net. healthcare.gov. 86400 IN NS a1-86.akam.net. healthcare.gov. 86400 IN NS a13-64.akam.net. healthcare.gov. 86400 IN NS a10-67.akam.net. healthcare.gov. 86400 IN RRSIG ( NS 7 2 86400 20240730023618 20240727013618 36987 healthcare.gov. Zpq8+ssS6ksWWSX3ZHypWOIGeZ/wkh1kYOpjJYSFLSjbnU1UTWx6DaBdERc1QzeOBkKB82/gPstp kiJH/LWpOK+MYozIQaHRFLBEZ87a0YRrSSFazLFjl4Led9syAgMU41O2mpsiT8fuiYD9hDRj4Cc8 0ci7i4f8szQOFZ9sDBw= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a13-64.akam.net for healthcare.gov/A
	Received 233 bytes from 2.22.230.64
	;; Response received from [2.22.230.64] 233 octets ;; HEADER SECTION ;; id = 59249 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (2 records) healthcare.gov. 20 IN A 23.60.220.121 healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. QWxktq32VlLG5CtTDP4Z4I21PlwWh/oWzlXq5wJpYu3oXVrdxWRm9PqSvOlt0X2IDa0ukVT15IkJ KZiuMMw9qu9lRSM/EKpsyXMVGXuisqFfD8WZp6Og8uAo132R7inM3/0BE5kUy4KDoG7mZsMV1lxT WjHB9rkKgdTrFfJNed4= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	healthcare.gov A RR has value 23.60.220.121
	Found 1 RRSIGs over A RRset
	`healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. QWxktq32VlLG5CtTDP4Z4I21PlwWh/oWzlXq5wJpYu3oXVrdxWRm9PqSvOlt0X2IDa0ukVT15IkJ KZiuMMw9qu9lRSM/EKpsyXMVGXuisqFfD8WZp6Og8uAo132R7inM3/0BE5kUy4KDoG7mZsMV1lxT WjHB9rkKgdTrFfJNed4= )`
	RRSIG=36987 and DNSKEY=36987 verifies the A RRset

healthcare.gov

	Query to a3-66.akam.net for healthcare.gov/A
	Received 233 bytes from 96.7.49.66
	;; Response received from [96.7.49.66] 233 octets ;; HEADER SECTION ;; id = 37223 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (2 records) healthcare.gov. 20 IN A 23.5.14.180 healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. OiCeDEvZ1XQRkLbi1xSfSr0mhfM3K2Mdkc5jjqLhnP/f57QDd86cr2PCLVcsxuDRdh9wgKN03m7e BqcEGWmkY19sjN3hrnXcc1gcN0Nqhl/caKFAf/6m0LGwSkku2bD65/BlW+/8mqFqAzVlRb6WqV2l XfAWDFbMOzOnQ+zIAew= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a3-66.akam.net is authoritative for healthcare.gov
	Found RRSIG signed by healthcare.gov zone
	Query to a3-66.akam.net for healthcare.gov/A
	Received 233 bytes from 96.7.49.66
	;; Response received from [96.7.49.66] 233 octets ;; HEADER SECTION ;; id = 4840 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (2 records) healthcare.gov. 20 IN A 23.5.14.180 healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. OiCeDEvZ1XQRkLbi1xSfSr0mhfM3K2Mdkc5jjqLhnP/f57QDd86cr2PCLVcsxuDRdh9wgKN03m7e BqcEGWmkY19sjN3hrnXcc1gcN0Nqhl/caKFAf/6m0LGwSkku2bD65/BlW+/8mqFqAzVlRb6WqV2l XfAWDFbMOzOnQ+zIAew= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	healthcare.gov A RR has value 23.5.14.180
	Found 1 RRSIGs over A RRset
	`healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. OiCeDEvZ1XQRkLbi1xSfSr0mhfM3K2Mdkc5jjqLhnP/f57QDd86cr2PCLVcsxuDRdh9wgKN03m7e BqcEGWmkY19sjN3hrnXcc1gcN0Nqhl/caKFAf/6m0LGwSkku2bD65/BlW+/8mqFqAzVlRb6WqV2l XfAWDFbMOzOnQ+zIAew= )`
	RRSIG=36987 and DNSKEY=36987 verifies the A RRset

healthcare.gov

	Query to a8-67.akam.net for healthcare.gov/A
	Received 233 bytes from 2.16.40.67
	;; Response received from [2.16.40.67] 233 octets ;; HEADER SECTION ;; id = 17981 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (2 records) healthcare.gov. 20 IN A 96.17.35.36 healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. FkqtIYPdg2z4NE5wtET4wQ1yKJmCnFhsA/cSEKwKDOXUM7acxDzU3sOM+bFfuTnRYkYeeRKASlAn x2/oIvDSDAy9EA/dM7xVfhwhX5JgJMwgyBoKqAc0o6SfCCWYSCgJ6S4nbyJnbPcZ6CDVSWV6DFBp bK8gVKKAhGG5xw/EDs0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a8-67.akam.net is authoritative for healthcare.gov
	Found RRSIG signed by healthcare.gov zone
	Query to a8-67.akam.net for healthcare.gov/A
	Received 233 bytes from 2.16.40.67
	;; Response received from [2.16.40.67] 233 octets ;; HEADER SECTION ;; id = 38734 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (2 records) healthcare.gov. 20 IN A 96.17.35.36 healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. FkqtIYPdg2z4NE5wtET4wQ1yKJmCnFhsA/cSEKwKDOXUM7acxDzU3sOM+bFfuTnRYkYeeRKASlAn x2/oIvDSDAy9EA/dM7xVfhwhX5JgJMwgyBoKqAc0o6SfCCWYSCgJ6S4nbyJnbPcZ6CDVSWV6DFBp bK8gVKKAhGG5xw/EDs0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	healthcare.gov A RR has value 96.17.35.36
	Found 1 RRSIGs over A RRset
	`healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. FkqtIYPdg2z4NE5wtET4wQ1yKJmCnFhsA/cSEKwKDOXUM7acxDzU3sOM+bFfuTnRYkYeeRKASlAn x2/oIvDSDAy9EA/dM7xVfhwhX5JgJMwgyBoKqAc0o6SfCCWYSCgJ6S4nbyJnbPcZ6CDVSWV6DFBp bK8gVKKAhGG5xw/EDs0= )`
	RRSIG=36987 and DNSKEY=36987 verifies the A RRset

healthcare.gov

	Query to a24-65.akam.net for healthcare.gov/A
	Received 233 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 233 octets ;; HEADER SECTION ;; id = 14662 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (2 records) healthcare.gov. 20 IN A 104.64.222.175 healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. D3xuYxXsOzrPueBA5I4pUrZyMrqiSmo6WM/+YTzkcA992+UN5Jl3gmVl/mvhValJahg8xMJtbnEo uR9WnuzTKAKvxz93pSjatfuPJH11YPSapQszxI3bRnoRxqnHPul9IcNITXO/rG4Lynwuxrbwp1ag s91/tvkJMUlKLSKgdEM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a24-65.akam.net is authoritative for healthcare.gov
	Found RRSIG signed by healthcare.gov zone
	Query to a24-65.akam.net for healthcare.gov/A
	Received 233 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 233 octets ;; HEADER SECTION ;; id = 23708 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (2 records) healthcare.gov. 20 IN A 104.64.222.175 healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. D3xuYxXsOzrPueBA5I4pUrZyMrqiSmo6WM/+YTzkcA992+UN5Jl3gmVl/mvhValJahg8xMJtbnEo uR9WnuzTKAKvxz93pSjatfuPJH11YPSapQszxI3bRnoRxqnHPul9IcNITXO/rG4Lynwuxrbwp1ag s91/tvkJMUlKLSKgdEM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	healthcare.gov A RR has value 104.64.222.175
	Found 1 RRSIGs over A RRset
	`healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. D3xuYxXsOzrPueBA5I4pUrZyMrqiSmo6WM/+YTzkcA992+UN5Jl3gmVl/mvhValJahg8xMJtbnEo uR9WnuzTKAKvxz93pSjatfuPJH11YPSapQszxI3bRnoRxqnHPul9IcNITXO/rG4Lynwuxrbwp1ag s91/tvkJMUlKLSKgdEM= )`
	RRSIG=36987 and DNSKEY=36987 verifies the A RRset

healthcare.gov

	Query to a10-67.akam.net for healthcare.gov/A
	Received 233 bytes from 96.7.50.67
	;; Response received from [96.7.50.67] 233 octets ;; HEADER SECTION ;; id = 20234 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (2 records) healthcare.gov. 20 IN A 96.17.35.36 healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. FkqtIYPdg2z4NE5wtET4wQ1yKJmCnFhsA/cSEKwKDOXUM7acxDzU3sOM+bFfuTnRYkYeeRKASlAn x2/oIvDSDAy9EA/dM7xVfhwhX5JgJMwgyBoKqAc0o6SfCCWYSCgJ6S4nbyJnbPcZ6CDVSWV6DFBp bK8gVKKAhGG5xw/EDs0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a10-67.akam.net is authoritative for healthcare.gov
	Found RRSIG signed by healthcare.gov zone
	Query to a10-67.akam.net for healthcare.gov/A
	Received 233 bytes from 96.7.50.67
	;; Response received from [96.7.50.67] 233 octets ;; HEADER SECTION ;; id = 12976 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (2 records) healthcare.gov. 20 IN A 96.17.35.36 healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. FkqtIYPdg2z4NE5wtET4wQ1yKJmCnFhsA/cSEKwKDOXUM7acxDzU3sOM+bFfuTnRYkYeeRKASlAn x2/oIvDSDAy9EA/dM7xVfhwhX5JgJMwgyBoKqAc0o6SfCCWYSCgJ6S4nbyJnbPcZ6CDVSWV6DFBp bK8gVKKAhGG5xw/EDs0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	healthcare.gov A RR has value 96.17.35.36
	Found 1 RRSIGs over A RRset
	`healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. FkqtIYPdg2z4NE5wtET4wQ1yKJmCnFhsA/cSEKwKDOXUM7acxDzU3sOM+bFfuTnRYkYeeRKASlAn x2/oIvDSDAy9EA/dM7xVfhwhX5JgJMwgyBoKqAc0o6SfCCWYSCgJ6S4nbyJnbPcZ6CDVSWV6DFBp bK8gVKKAhGG5xw/EDs0= )`
	RRSIG=36987 and DNSKEY=36987 verifies the A RRset

healthcare.gov

	Query to a1-86.akam.net for healthcare.gov/A
	Received 233 bytes from 193.108.91.86
	;; Response received from [193.108.91.86] 233 octets ;; HEADER SECTION ;; id = 19373 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (2 records) healthcare.gov. 20 IN A 184.24.204.105 healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. sy9FL4fBBZBUkrzB2yYohNm+jD97ZH+K+sdwK5lMTmpyrhoTcs7znZVwgvWfgroF0YGzUGcdO75O wrICZiyZymRdMG4HWxkcMoAg7UK07Q/6TKWI6t0h4K6VJ3opkKw4ln55Hm5S5xuI1ErFwYH3/OC4 Tj8oWy14WJVwFS98gGU= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a1-86.akam.net is authoritative for healthcare.gov
	Found RRSIG signed by healthcare.gov zone
	Query to a1-86.akam.net for healthcare.gov/A
	Received 233 bytes from 193.108.91.86
	;; Response received from [193.108.91.86] 233 octets ;; HEADER SECTION ;; id = 55763 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; healthcare.gov. IN A ;; ANSWER SECTION (2 records) healthcare.gov. 20 IN A 104.64.222.175 healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. D3xuYxXsOzrPueBA5I4pUrZyMrqiSmo6WM/+YTzkcA992+UN5Jl3gmVl/mvhValJahg8xMJtbnEo uR9WnuzTKAKvxz93pSjatfuPJH11YPSapQszxI3bRnoRxqnHPul9IcNITXO/rG4Lynwuxrbwp1ag s91/tvkJMUlKLSKgdEM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	healthcare.gov A RR has value 104.64.222.175
	Found 1 RRSIGs over A RRset
	`healthcare.gov. 20 IN RRSIG ( A 7 2 20 20240730023618 20240727013618 36987 healthcare.gov. D3xuYxXsOzrPueBA5I4pUrZyMrqiSmo6WM/+YTzkcA992+UN5Jl3gmVl/mvhValJahg8xMJtbnEo uR9WnuzTKAKvxz93pSjatfuPJH11YPSapQszxI3bRnoRxqnHPul9IcNITXO/rG4Lynwuxrbwp1ag s91/tvkJMUlKLSKgdEM= )`
	RRSIG=36987 and DNSKEY=36987 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test healthcare.gov at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: