DNSSEC Debugger

Domain Name:

Time: 2024-10-22 15:42:20 UTC

Analyzing DNSSEC problems for iad.gov

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to h.root-servers.net for ./DNSKEY
	Received 864 bytes from 198.97.190.53
	;; Response received from [198.97.190.53] 864 octets ;; HEADER SECTION ;; id = 63167 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAc0SunbHdS0KFEyZbYII/+tzsrNzIwurKxmJA+0fhAYlTPA/5LrMGkGEqvvufzM0w/CaVtdm 5eWkZYQcsoSKT5bycx0C4jxnLEb3ZiZUQSqu1rWcKGF1fj/GyDWLkOu7a5h3el+gPmglj/4l4V31 ugNYfqYq84vCB+3D6Sodrd+85KyonnzWJ8cS7aZ57x0d0sGqsAKA+6tRnIXjVNVe7Ro5xJuz8IR7 rOxdzfuRLriN+Z00EL3U5E7s9SISU/hDh7Q7N70W1mLMc1o2+tCRGjEWrw4wmCWMzc1kegbLES/d UOWFvPjJz0+AEeWDhd2GqtXk02BzAhdfeIAEIv68FTs= ) ; Key ID = 61050 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20241111000000 20241021000000 20326 . alCFgDZS+0l5zcpQ/7R+5OFeCrk9KGkNP2F9ynXIXG6QigPj/9qjm0xxItRJUUim+SrJywAmLKe+ 48oTUeSRyDKVVg3LGDekLKcIVz0EBqTL2y44usDlUlxqx5O0LQVHy4h/hm9+dCXFiSBWoV0LcApl V9OYWhxi+CxmxZU58vK6eVAde8E2JHdeDuy23WF5lxYEg1q7ehEt5EdRvZ7hZzfawEFR3Qv3WMoo tO2eBAAneIe94daJP/i1iwQJ4p+bGVCZ4sJk+Pk9J7lwEQq6GhkdSpLsRxArUhvoVgtnh0LkAV7T sajYk8K2JRt7wHNDbBV6+Vdq2bh7ZPGvLiGkIQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAc0SunbHdS0KFEyZbYII/+tzsrNzIwurKxmJA+0fhAYlTPA/5LrMGkGEqvvufzM0w/CaVtdm 5eWkZYQcsoSKT5bycx0C4jxnLEb3ZiZUQSqu1rWcKGF1fj/GyDWLkOu7a5h3el+gPmglj/4l4V31 ugNYfqYq84vCB+3D6Sodrd+85KyonnzWJ8cS7aZ57x0d0sGqsAKA+6tRnIXjVNVe7Ro5xJuz8IR7 rOxdzfuRLriN+Z00EL3U5E7s9SISU/hDh7Q7N70W1mLMc1o2+tCRGjEWrw4wmCWMzc1kegbLES/d UOWFvPjJz0+AEeWDhd2GqtXk02BzAhdfeIAEIv68FTs= ) ; Key ID = 61050`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20241111000000 20241021000000 20326 . alCFgDZS+0l5zcpQ/7R+5OFeCrk9KGkNP2F9ynXIXG6QigPj/9qjm0xxItRJUUim+SrJywAmLKe+ 48oTUeSRyDKVVg3LGDekLKcIVz0EBqTL2y44usDlUlxqx5O0LQVHy4h/hm9+dCXFiSBWoV0LcApl V9OYWhxi+CxmxZU58vK6eVAde8E2JHdeDuy23WF5lxYEg1q7ehEt5EdRvZ7hZzfawEFR3Qv3WMoo tO2eBAAneIe94daJP/i1iwQJ4p+bGVCZ4sJk+Pk9J7lwEQq6GhkdSpLsRxArUhvoVgtnh0LkAV7T sajYk8K2JRt7wHNDbBV6+Vdq2bh7ZPGvLiGkIQ== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=61050 is now in the chain-of-trust
	Query to f.root-servers.net for iad.gov/A
	Received 614 bytes from 192.5.5.241
	;; Response received from [192.5.5.241] 614 octets ;; HEADER SECTION ;; id = 1161 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20241104050000 20241022040000 61050 . QDXVOwEnASUAI40BGDttxq7qGhvCMEac486WIGSve98vzbXX+DtkWnd7z8LaETy7VbTIPy1KOj5A BPnEWAck4dyal0iO3FGHMxTjlkOGHkjZ/EwUux+CeESCvZJ9VjcktKR7o7yg/sC6bf6HcJ2EgnA+ Ck0Yh6B5e7GX8R0YJG95CgxCX/MQtOxgOJUekfUTz7Yi+HlYhCoLolP+DQWkPnzCZabd8FoOexHX Fsme/6iHMa3inPLa3R7hXiygsW0/QHY8CsJbqkZX3TFiHIKi+mr3hx/h/gbROLcqge7E0vtKsKdu vqeO1X7dSFlbxuuoRZUvPi+7/uMv1+kVge+YXw== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN A 199.33.231.1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN A 199.33.232.1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN A 199.33.233.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Query to g.root-servers.net for gov/DNSKEY
	Received 613 bytes from 192.112.36.4
	;; Response received from [192.112.36.4] 613 octets ;; HEADER SECTION ;; id = 36525 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20241104050000 20241022040000 61050 . QDXVOwEnASUAI40BGDttxq7qGhvCMEac486WIGSve98vzbXX+DtkWnd7z8LaETy7VbTIPy1KOj5A BPnEWAck4dyal0iO3FGHMxTjlkOGHkjZ/EwUux+CeESCvZJ9VjcktKR7o7yg/sC6bf6HcJ2EgnA+ Ck0Yh6B5e7GX8R0YJG95CgxCX/MQtOxgOJUekfUTz7Yi+HlYhCoLolP+DQWkPnzCZabd8FoOexHX Fsme/6iHMa3inPLa3R7hXiygsW0/QHY8CsJbqkZX3TFiHIKi+mr3hx/h/gbROLcqge7E0vtKsKdu vqeO1X7dSFlbxuuoRZUvPi+7/uMv1+kVge+YXw== ) ;; ADDITIONAL SECTION (9 records) d.ns.gov. 172800 IN A 199.33.233.1 c.ns.gov. 172800 IN A 199.33.232.1 b.ns.gov. 172800 IN A 199.33.231.1 a.ns.gov. 172800 IN A 199.33.230.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 ;; { "EDNS-VERSION": 0 }
	Found child zone gov

gov

	Checking DS between . and gov
	Query to f.root-servers.net for gov/DS
	Received 367 bytes from 192.5.5.241
	;; Response received from [192.5.5.241] 367 octets ;; HEADER SECTION ;; id = 53844 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20241104050000 20241022040000 61050 . QDXVOwEnASUAI40BGDttxq7qGhvCMEac486WIGSve98vzbXX+DtkWnd7z8LaETy7VbTIPy1KOj5A BPnEWAck4dyal0iO3FGHMxTjlkOGHkjZ/EwUux+CeESCvZJ9VjcktKR7o7yg/sC6bf6HcJ2EgnA+ Ck0Yh6B5e7GX8R0YJG95CgxCX/MQtOxgOJUekfUTz7Yi+HlYhCoLolP+DQWkPnzCZabd8FoOexHX Fsme/6iHMa3inPLa3R7hXiygsW0/QHY8CsJbqkZX3TFiHIKi+mr3hx/h/gbROLcqge7E0vtKsKdu vqeO1X7dSFlbxuuoRZUvPi+7/uMv1+kVge+YXw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for gov in the . zone
	DS=2536/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20241104050000 20241022040000 61050 . QDXVOwEnASUAI40BGDttxq7qGhvCMEac486WIGSve98vzbXX+DtkWnd7z8LaETy7VbTIPy1KOj5A BPnEWAck4dyal0iO3FGHMxTjlkOGHkjZ/EwUux+CeESCvZJ9VjcktKR7o7yg/sC6bf6HcJ2EgnA+ Ck0Yh6B5e7GX8R0YJG95CgxCX/MQtOxgOJUekfUTz7Yi+HlYhCoLolP+DQWkPnzCZabd8FoOexHX Fsme/6iHMa3inPLa3R7hXiygsW0/QHY8CsJbqkZX3TFiHIKi+mr3hx/h/gbROLcqge7E0vtKsKdu vqeO1X7dSFlbxuuoRZUvPi+7/uMv1+kVge+YXw== )`
	RRSIG=61050 and DNSKEY=61050 verifies the DS RRset
	DS=2536/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 )`
	Query to b.ns.gov for gov/DNSKEY
	Timeout querying b.ns.gov/199.33.231.1 for gov/DNSKEY
	All Queries to b.ns.gov for gov/DNSKEY timed out or failed
	Query to a.ns.gov for gov/DNSKEY
	Received 291 bytes from 199.33.230.1
	;; Response received from [199.33.230.1] 291 octets ;; HEADER SECTION ;; id = 50954 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; Key ID = 2536 gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; Key ID = 35496 gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20241130110534 20240930110534 2536 gov. h+Iyb0tqmydmCz6R4wG6Ldr2zopf1WBr/SM7MutctneoFWjCjO/k0ErdVLVoXEXenkMNv5My6iIv oCnmSrJeOQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for gov
	`gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; Key ID = 2536`
	`gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; Key ID = 35496`
	DNSKEY=2536/SEP is now in the chain-of-trust
	DS=2536/SHA-256 verifies DNSKEY=2536/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20241130110534 20240930110534 2536 gov. h+Iyb0tqmydmCz6R4wG6Ldr2zopf1WBr/SM7MutctneoFWjCjO/k0ErdVLVoXEXenkMNv5My6iIv oCnmSrJeOQ== )`
	RRSIG=2536 and DNSKEY=2536/SEP verifies the DNSKEY RRset
	DNSKEY=35496 is now in the chain-of-trust
	Query to c.ns.gov for iad.gov/A
	Received 315 bytes from 199.33.232.1
	;; Response received from [199.33.232.1] 315 octets ;; HEADER SECTION ;; id = 12842 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) iad.gov. 10800 IN NS a1-107.akam.net. iad.gov. 10800 IN NS a11-66.akam.net. iad.gov. 10800 IN NS a12-67.akam.net. iad.gov. 10800 IN NS a2-64.akam.net. iad.gov. 10800 IN NS a24-65.akam.net. iad.gov. 10800 IN NS a5-66.akam.net. iad.gov. 3600 IN DS ( 7830 13 2 86eb65d258d69aaa782d6c1a163cda8771a8bfbb6dbef3c38807a51d5f6ac75e ) iad.gov. 3600 IN RRSIG ( DS 13 2 3600 20241023164225 20241021144225 35496 gov. 5xEqDD/9cLFHkfXDszkDv05zi0UJ/SGwIhoNEkyjHyzmZhTUM4awM5zRdYmtrjZHUIGiFm7ilQiD ChMevfjhpQ== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a.ns.gov for iad.gov/DNSKEY
	Received 315 bytes from 199.33.230.1
	;; Response received from [199.33.230.1] 315 octets ;; HEADER SECTION ;; id = 24808 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) iad.gov. 10800 IN NS a1-107.akam.net. iad.gov. 10800 IN NS a11-66.akam.net. iad.gov. 10800 IN NS a12-67.akam.net. iad.gov. 10800 IN NS a2-64.akam.net. iad.gov. 10800 IN NS a24-65.akam.net. iad.gov. 10800 IN NS a5-66.akam.net. iad.gov. 3600 IN DS ( 7830 13 2 86eb65d258d69aaa782d6c1a163cda8771a8bfbb6dbef3c38807a51d5f6ac75e ) iad.gov. 3600 IN RRSIG ( DS 13 2 3600 20241023164225 20241021144225 35496 gov. OlO7CmzKBKisaQNC4WFVvvmaBrA2dXrs/Z9CmBZe7d2X3YE+ZG/t0tvtaspOkvsVEZ2++0CXD8GF WphwvV0L2g== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone iad.gov

iad.gov

	Checking DS between gov and iad.gov
	Query to d.ns.gov for iad.gov/DS
	Received 183 bytes from 199.33.233.1
	;; Response received from [199.33.233.1] 183 octets ;; HEADER SECTION ;; id = 21454 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN DS ;; ANSWER SECTION (2 records) iad.gov. 3600 IN DS ( 7830 13 2 86eb65d258d69aaa782d6c1a163cda8771a8bfbb6dbef3c38807a51d5f6ac75e ) iad.gov. 3600 IN RRSIG ( DS 13 2 3600 20241023164225 20241021144225 35496 gov. ADljpa30XvJu2y0frSFqGEPiRsHLvCJvhgnR02yNSnj3FrqQhDV/CbS8egUwRR9VzanjW6iZr1N1 SWI3m3HHAw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for iad.gov in the gov zone
	DS=7830/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`iad.gov. 3600 IN RRSIG ( DS 13 2 3600 20241023164225 20241021144225 35496 gov. ADljpa30XvJu2y0frSFqGEPiRsHLvCJvhgnR02yNSnj3FrqQhDV/CbS8egUwRR9VzanjW6iZr1N1 SWI3m3HHAw== )`
	RRSIG=35496 and DNSKEY=35496 verifies the DS RRset
	DS=7830/SHA-256 is now in the chain-of-trust
	`iad.gov. 3600 IN DS ( 7830 13 2 86eb65d258d69aaa782d6c1a163cda8771a8bfbb6dbef3c38807a51d5f6ac75e )`
	Query to a24-65.akam.net for iad.gov/DNSKEY
	Received 562 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 562 octets ;; HEADER SECTION ;; id = 44551 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 6 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN DNSKEY ;; ANSWER SECTION (6 records) iad.gov. 7200 IN DNSKEY ( 257 3 13 /0BjafdfEv2/qmMKYO8pGdijmkVI607cknI4xvWQy6F1WpoHL5iXHyez42W9v85+25+OXunA7qQU r+mOOzu/NA== ) ; Key ID = 23923 iad.gov. 7200 IN DNSKEY ( 257 3 13 9PaYaiyFDamqlLk8Mbig/uZWwaWYBBDvC9qtaebvpAHOXMDlP4o9+t3yk+xiPCUlhuBFXs1RIksA raZwwJ1dqw== ) ; Key ID = 7830 iad.gov. 7200 IN DNSKEY ( 256 3 13 7A2pZjy1KVQ28OKUtO+4mykMmTW4WXtVBsyBFRXcuibXaqAxZM3T9GFW8UyMs2lueF5CAwZkvuiq vUGTsX4hhw== ) ; Key ID = 3226 iad.gov. 7200 IN DNSKEY ( 256 3 13 S9vxIHSGg9G/s27SuZ4hTnVFaVVdqDIKs/uV/f5dhx13HebodzYEToaFJjX6rDLKuwthzRzG/TcH 2IyUnR4s6Q== ) ; Key ID = 51614 iad.gov. 7200 IN RRSIG ( DNSKEY 13 2 7200 20241025112758 20241022102758 7830 iad.gov. gS117SrukKtDZGfzoTWAwi+iMxqmhubR6ygX4yzxq9jBinmtNLwb2FxV+Ze66UrI3R+HBWGKcNnq 8W72EHVhfA== ) iad.gov. 7200 IN RRSIG ( DNSKEY 13 2 7200 20241025112758 20241022102758 23923 iad.gov. 8Ll/Gx7hq4KLq8PRo5KB38pwLXJ/bgSiJHAO3G2p9Vn7NTi64fvOMg6tnbyqUwmBv09/6KPZUAfl kAk88z+F5A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 4 DNSKEY records for iad.gov
	`iad.gov. 7200 IN DNSKEY ( 257 3 13 /0BjafdfEv2/qmMKYO8pGdijmkVI607cknI4xvWQy6F1WpoHL5iXHyez42W9v85+25+OXunA7qQU r+mOOzu/NA== ) ; Key ID = 23923`
	`iad.gov. 7200 IN DNSKEY ( 257 3 13 9PaYaiyFDamqlLk8Mbig/uZWwaWYBBDvC9qtaebvpAHOXMDlP4o9+t3yk+xiPCUlhuBFXs1RIksA raZwwJ1dqw== ) ; Key ID = 7830`
	`iad.gov. 7200 IN DNSKEY ( 256 3 13 7A2pZjy1KVQ28OKUtO+4mykMmTW4WXtVBsyBFRXcuibXaqAxZM3T9GFW8UyMs2lueF5CAwZkvuiq vUGTsX4hhw== ) ; Key ID = 3226`
	`iad.gov. 7200 IN DNSKEY ( 256 3 13 S9vxIHSGg9G/s27SuZ4hTnVFaVVdqDIKs/uV/f5dhx13HebodzYEToaFJjX6rDLKuwthzRzG/TcH 2IyUnR4s6Q== ) ; Key ID = 51614`
	DNSKEY=7830/SEP is now in the chain-of-trust
	DS=7830/SHA-256 verifies DNSKEY=7830/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`iad.gov. 7200 IN RRSIG ( DNSKEY 13 2 7200 20241025112758 20241022102758 7830 iad.gov. gS117SrukKtDZGfzoTWAwi+iMxqmhubR6ygX4yzxq9jBinmtNLwb2FxV+Ze66UrI3R+HBWGKcNnq 8W72EHVhfA== )`
	`iad.gov. 7200 IN RRSIG ( DNSKEY 13 2 7200 20241025112758 20241022102758 23923 iad.gov. 8Ll/Gx7hq4KLq8PRo5KB38pwLXJ/bgSiJHAO3G2p9Vn7NTi64fvOMg6tnbyqUwmBv09/6KPZUAfl kAk88z+F5A== )`
	RRSIG=7830 and DNSKEY=7830/SEP verifies the DNSKEY RRset
	RRSIG=23923 and DNSKEY=23923/SEP verifies the DNSKEY RRset
	DNSKEY=23923/SEP is now in the chain-of-trust
	DNSKEY=3226 is now in the chain-of-trust
	DNSKEY=51614 is now in the chain-of-trust
	Query to a2-64.akam.net for iad.gov/A
	Received 171 bytes from 95.100.174.64
	;; Response received from [95.100.174.64] 171 octets ;; HEADER SECTION ;; id = 45340 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (3 records) iad.gov. 20 IN A 104.114.72.232 iad.gov. 20 IN A 104.114.72.153 iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. E7WexVTOACqxtPdojsPsCfOSPyJ1DDRErfn16usozjoCkVQ27dFlrBbK83egmEw3nO5qRKsd4poM BtFWRNj7cA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a2-64.akam.net is authoritative for iad.gov
	Found RRSIG signed by iad.gov zone
	Query to a5-66.akam.net for iad.gov/SOA
	Received 421 bytes from 95.100.168.66
	;; Response received from [95.100.168.66] 421 octets ;; HEADER SECTION ;; id = 55803 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN SOA ;; ANSWER SECTION (2 records) iad.gov. 300 IN SOA ( a1-107.akam.net. hostmaster.iad.gov. 2022082319 ;serial 3600 ;refresh 600 ;retry 604800 ;expire 300 ;minimum ) iad.gov. 300 IN RRSIG ( SOA 13 2 300 20241025112758 20241022102758 3226 iad.gov. q2GZPJNgbB888vVGL8t6SaL+ircOwCfUtjS7I7M2owzgGBMAg3Rl8XDoNJjd09MAsg7MZ1zb+kAT PxPTwda94Q== ) ;; AUTHORITY SECTION (7 records) iad.gov. 86400 IN NS a5-66.akam.net. iad.gov. 86400 IN NS a2-64.akam.net. iad.gov. 86400 IN NS a1-107.akam.net. iad.gov. 86400 IN NS a12-67.akam.net. iad.gov. 86400 IN NS a24-65.akam.net. iad.gov. 86400 IN NS a11-66.akam.net. iad.gov. 86400 IN RRSIG ( NS 13 2 86400 20241025112758 20241022102758 3226 iad.gov. tmav46ZN7XrGpZ2xR5Ry+SoOLmgKy2gv5Rak9r6BCir3a31+SSiHUlVf6JV/5dGw8EdUn6oXnKNQ soLCQ9hemg== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a12-67.akam.net for iad.gov/SOA
	Received 421 bytes from 184.26.160.67
	;; Response received from [184.26.160.67] 421 octets ;; HEADER SECTION ;; id = 5596 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN SOA ;; ANSWER SECTION (2 records) iad.gov. 300 IN SOA ( a1-107.akam.net. hostmaster.iad.gov. 2022082319 ;serial 3600 ;refresh 600 ;retry 604800 ;expire 300 ;minimum ) iad.gov. 300 IN RRSIG ( SOA 13 2 300 20241025112758 20241022102758 3226 iad.gov. q2GZPJNgbB888vVGL8t6SaL+ircOwCfUtjS7I7M2owzgGBMAg3Rl8XDoNJjd09MAsg7MZ1zb+kAT PxPTwda94Q== ) ;; AUTHORITY SECTION (7 records) iad.gov. 86400 IN NS a5-66.akam.net. iad.gov. 86400 IN NS a1-107.akam.net. iad.gov. 86400 IN NS a11-66.akam.net. iad.gov. 86400 IN NS a12-67.akam.net. iad.gov. 86400 IN NS a2-64.akam.net. iad.gov. 86400 IN NS a24-65.akam.net. iad.gov. 86400 IN RRSIG ( NS 13 2 86400 20241025112758 20241022102758 3226 iad.gov. tmav46ZN7XrGpZ2xR5Ry+SoOLmgKy2gv5Rak9r6BCir3a31+SSiHUlVf6JV/5dGw8EdUn6oXnKNQ soLCQ9hemg== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a1-107.akam.net for iad.gov/SOA
	Received 421 bytes from 193.108.91.107
	;; Response received from [193.108.91.107] 421 octets ;; HEADER SECTION ;; id = 29960 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN SOA ;; ANSWER SECTION (2 records) iad.gov. 300 IN SOA ( a1-107.akam.net. hostmaster.iad.gov. 2022082319 ;serial 3600 ;refresh 600 ;retry 604800 ;expire 300 ;minimum ) iad.gov. 300 IN RRSIG ( SOA 13 2 300 20241025112758 20241022102758 3226 iad.gov. q2GZPJNgbB888vVGL8t6SaL+ircOwCfUtjS7I7M2owzgGBMAg3Rl8XDoNJjd09MAsg7MZ1zb+kAT PxPTwda94Q== ) ;; AUTHORITY SECTION (7 records) iad.gov. 86400 IN NS a12-67.akam.net. iad.gov. 86400 IN NS a5-66.akam.net. iad.gov. 86400 IN NS a11-66.akam.net. iad.gov. 86400 IN NS a1-107.akam.net. iad.gov. 86400 IN NS a24-65.akam.net. iad.gov. 86400 IN NS a2-64.akam.net. iad.gov. 86400 IN RRSIG ( NS 13 2 86400 20241025112758 20241022102758 3226 iad.gov. tmav46ZN7XrGpZ2xR5Ry+SoOLmgKy2gv5Rak9r6BCir3a31+SSiHUlVf6JV/5dGw8EdUn6oXnKNQ soLCQ9hemg== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a24-65.akam.net for iad.gov/SOA
	Received 421 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 421 octets ;; HEADER SECTION ;; id = 41923 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN SOA ;; ANSWER SECTION (2 records) iad.gov. 300 IN SOA ( a1-107.akam.net. hostmaster.iad.gov. 2022082319 ;serial 3600 ;refresh 600 ;retry 604800 ;expire 300 ;minimum ) iad.gov. 300 IN RRSIG ( SOA 13 2 300 20241025112758 20241022102758 3226 iad.gov. q2GZPJNgbB888vVGL8t6SaL+ircOwCfUtjS7I7M2owzgGBMAg3Rl8XDoNJjd09MAsg7MZ1zb+kAT PxPTwda94Q== ) ;; AUTHORITY SECTION (7 records) iad.gov. 86400 IN NS a1-107.akam.net. iad.gov. 86400 IN NS a5-66.akam.net. iad.gov. 86400 IN NS a12-67.akam.net. iad.gov. 86400 IN NS a11-66.akam.net. iad.gov. 86400 IN NS a2-64.akam.net. iad.gov. 86400 IN NS a24-65.akam.net. iad.gov. 86400 IN RRSIG ( NS 13 2 86400 20241025112758 20241022102758 3226 iad.gov. tmav46ZN7XrGpZ2xR5Ry+SoOLmgKy2gv5Rak9r6BCir3a31+SSiHUlVf6JV/5dGw8EdUn6oXnKNQ soLCQ9hemg== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a11-66.akam.net for iad.gov/SOA
	Received 421 bytes from 84.53.139.66
	;; Response received from [84.53.139.66] 421 octets ;; HEADER SECTION ;; id = 38172 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 7 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN SOA ;; ANSWER SECTION (2 records) iad.gov. 300 IN SOA ( a1-107.akam.net. hostmaster.iad.gov. 2022082319 ;serial 3600 ;refresh 600 ;retry 604800 ;expire 300 ;minimum ) iad.gov. 300 IN RRSIG ( SOA 13 2 300 20241025112758 20241022102758 3226 iad.gov. q2GZPJNgbB888vVGL8t6SaL+ircOwCfUtjS7I7M2owzgGBMAg3Rl8XDoNJjd09MAsg7MZ1zb+kAT PxPTwda94Q== ) ;; AUTHORITY SECTION (7 records) iad.gov. 86400 IN NS a2-64.akam.net. iad.gov. 86400 IN NS a11-66.akam.net. iad.gov. 86400 IN NS a24-65.akam.net. iad.gov. 86400 IN NS a1-107.akam.net. iad.gov. 86400 IN NS a12-67.akam.net. iad.gov. 86400 IN NS a5-66.akam.net. iad.gov. 86400 IN RRSIG ( NS 13 2 86400 20241025112758 20241022102758 3226 iad.gov. tmav46ZN7XrGpZ2xR5Ry+SoOLmgKy2gv5Rak9r6BCir3a31+SSiHUlVf6JV/5dGw8EdUn6oXnKNQ soLCQ9hemg== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a2-64.akam.net for iad.gov/A
	Received 171 bytes from 95.100.174.64
	;; Response received from [95.100.174.64] 171 octets ;; HEADER SECTION ;; id = 33545 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (3 records) iad.gov. 20 IN A 104.114.72.232 iad.gov. 20 IN A 104.114.72.153 iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. vNWnoCmWzrrBkHtzufCSfOslRvYfPCdC0z44M07D0NkXFWHH7FlBnfERH3+uFPCaATLxWO6SCEJ3 7FYNGqndoQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	iad.gov A RR has value 104.114.72.232
	iad.gov A RR has value 104.114.72.153
	Found 1 RRSIGs over A RRset
	`iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. vNWnoCmWzrrBkHtzufCSfOslRvYfPCdC0z44M07D0NkXFWHH7FlBnfERH3+uFPCaATLxWO6SCEJ3 7FYNGqndoQ== )`
	RRSIG=3226 and DNSKEY=3226 verifies the A RRset

iad.gov

	Query to a11-66.akam.net for iad.gov/A
	Received 171 bytes from 84.53.139.66
	;; Response received from [84.53.139.66] 171 octets ;; HEADER SECTION ;; id = 22016 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (3 records) iad.gov. 20 IN A 104.114.72.232 iad.gov. 20 IN A 104.114.72.153 iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. 1Y76PGwCPwo6OxHxwGVjGROvXEJosHaT+a4bvyjW0ouu0XFdTKDgApvGJoKbxIk5IBJetf27xJBj y/TgTPitdw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a11-66.akam.net is authoritative for iad.gov
	Found RRSIG signed by iad.gov zone
	Query to a11-66.akam.net for iad.gov/A
	Received 171 bytes from 84.53.139.66
	;; Response received from [84.53.139.66] 171 octets ;; HEADER SECTION ;; id = 10421 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (3 records) iad.gov. 20 IN A 104.114.72.232 iad.gov. 20 IN A 104.114.72.153 iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. yb1jgF0tiXQCf5bzd22vr6cOEekw9WpUbcBD9A+uF7SSWIC28uVcLYF78vcgTwY/1TE6dwYuiCZc yFQzr21w8Q== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	iad.gov A RR has value 104.114.72.232
	iad.gov A RR has value 104.114.72.153
	Found 1 RRSIGs over A RRset
	`iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. yb1jgF0tiXQCf5bzd22vr6cOEekw9WpUbcBD9A+uF7SSWIC28uVcLYF78vcgTwY/1TE6dwYuiCZc yFQzr21w8Q== )`
	RRSIG=3226 and DNSKEY=3226 verifies the A RRset

iad.gov

	Query to a5-66.akam.net for iad.gov/A
	Received 171 bytes from 95.100.168.66
	;; Response received from [95.100.168.66] 171 octets ;; HEADER SECTION ;; id = 23946 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (3 records) iad.gov. 20 IN A 104.114.72.232 iad.gov. 20 IN A 104.114.72.153 iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. 3bk1Jc7yDbaFFTF/NrOZN3YEFPmGDdwSoTKRDrpWBAH1CA2wviL7cv+jFw09ebr8STvJBpxJMo0k /aOPrlKaNg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a5-66.akam.net is authoritative for iad.gov
	Found RRSIG signed by iad.gov zone
	Query to a5-66.akam.net for iad.gov/A
	Received 171 bytes from 95.100.168.66
	;; Response received from [95.100.168.66] 171 octets ;; HEADER SECTION ;; id = 61824 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (3 records) iad.gov. 20 IN A 104.114.72.232 iad.gov. 20 IN A 104.114.72.153 iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. 3SDgRIATs9TJ2cq/MH53aFsLCATrYS4WL4kWcKnkeWLcXIMJAnMZ0WqQ8TKgyTiBO/pSdjdsOtFb NziLWyaIgw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	iad.gov A RR has value 104.114.72.232
	iad.gov A RR has value 104.114.72.153
	Found 1 RRSIGs over A RRset
	`iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. 3SDgRIATs9TJ2cq/MH53aFsLCATrYS4WL4kWcKnkeWLcXIMJAnMZ0WqQ8TKgyTiBO/pSdjdsOtFb NziLWyaIgw== )`
	RRSIG=3226 and DNSKEY=3226 verifies the A RRset

iad.gov

	Query to a12-67.akam.net for iad.gov/A
	Received 171 bytes from 184.26.160.67
	;; Response received from [184.26.160.67] 171 octets ;; HEADER SECTION ;; id = 40986 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (3 records) iad.gov. 20 IN A 104.114.72.153 iad.gov. 20 IN A 104.114.72.232 iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. yC5zF+Vt0wsB8yM9Tr+mTxFFllslxfl8z8QUj2AHT4eVOUbWpyadz3DN4D65TFBoRUGT6L+d5yZc JcfSG2Rvbw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a12-67.akam.net is authoritative for iad.gov
	Found RRSIG signed by iad.gov zone
	Query to a12-67.akam.net for iad.gov/A
	Received 171 bytes from 184.26.160.67
	;; Response received from [184.26.160.67] 171 octets ;; HEADER SECTION ;; id = 9932 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (3 records) iad.gov. 20 IN A 104.114.72.153 iad.gov. 20 IN A 104.114.72.232 iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. Cim+o4W/Gf+rNTclgpoTfP7ILqvNbKkcxrZeFgeS9SJ/nT4G3LvqjFChyIo47wSq87bX2Qg+mnB0 5eb0fqhSQw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	iad.gov A RR has value 104.114.72.153
	iad.gov A RR has value 104.114.72.232
	Found 1 RRSIGs over A RRset
	`iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. Cim+o4W/Gf+rNTclgpoTfP7ILqvNbKkcxrZeFgeS9SJ/nT4G3LvqjFChyIo47wSq87bX2Qg+mnB0 5eb0fqhSQw== )`
	RRSIG=3226 and DNSKEY=3226 verifies the A RRset

iad.gov

	Query to a1-107.akam.net for iad.gov/A
	Received 171 bytes from 193.108.91.107
	;; Response received from [193.108.91.107] 171 octets ;; HEADER SECTION ;; id = 41224 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (3 records) iad.gov. 20 IN A 104.114.72.153 iad.gov. 20 IN A 104.114.72.232 iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. 6fLFQTIbk4ZSctNLlgWiTdL4RhvviwLO78BuzQc99ce4hav9NUD8YIbu5TRpoZCKVEdub6eAjKms YSdX6JZdEg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a1-107.akam.net is authoritative for iad.gov
	Found RRSIG signed by iad.gov zone
	Query to a1-107.akam.net for iad.gov/A
	Received 171 bytes from 193.108.91.107
	;; Response received from [193.108.91.107] 171 octets ;; HEADER SECTION ;; id = 34316 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (3 records) iad.gov. 20 IN A 104.114.72.153 iad.gov. 20 IN A 104.114.72.232 iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. qAbLlOXVbCkHHcHRXA9naOEJUiUvXoTEzEI2uHLZc4qeHAnPcDD9LjgYo0tgx6IPSyIWuvNZI5MK GbY+tbULdw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	iad.gov A RR has value 104.114.72.153
	iad.gov A RR has value 104.114.72.232
	Found 1 RRSIGs over A RRset
	`iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. qAbLlOXVbCkHHcHRXA9naOEJUiUvXoTEzEI2uHLZc4qeHAnPcDD9LjgYo0tgx6IPSyIWuvNZI5MK GbY+tbULdw== )`
	RRSIG=3226 and DNSKEY=3226 verifies the A RRset

iad.gov

	Query to a24-65.akam.net for iad.gov/A
	Received 171 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 171 octets ;; HEADER SECTION ;; id = 19086 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (3 records) iad.gov. 20 IN A 104.114.72.232 iad.gov. 20 IN A 104.114.72.153 iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. FOaGVpxKvSjnuKz3jemjSQmT10TTM/5sxm7E8JnK5GMGgADp8ynOtPi6Uy54fD2y1y5gLrB4ythk HDy4ljciiw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a24-65.akam.net is authoritative for iad.gov
	Found RRSIG signed by iad.gov zone
	Query to a24-65.akam.net for iad.gov/A
	Received 171 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 171 octets ;; HEADER SECTION ;; id = 47695 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iad.gov. IN A ;; ANSWER SECTION (3 records) iad.gov. 20 IN A 104.114.72.232 iad.gov. 20 IN A 104.114.72.153 iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. FmMSgPWvo+7fC4jk2KLAzgPkPxAfXvqkQSMBqejqkYZNUwRMQ4DjWjOIVljB/hepOvsBU/nt4KB2 ORv9Q5blcQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	iad.gov A RR has value 104.114.72.232
	iad.gov A RR has value 104.114.72.153
	Found 1 RRSIGs over A RRset
	`iad.gov. 20 IN RRSIG ( A 13 2 20 20241025112758 20241022102758 3226 iad.gov. FmMSgPWvo+7fC4jk2KLAzgPkPxAfXvqkQSMBqejqkYZNUwRMQ4DjWjOIVljB/hepOvsBU/nt4KB2 ORv9Q5blcQ== )`
	RRSIG=3226 and DNSKEY=3226 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test iad.gov at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: