DNSSEC Analyzer - isoc.org

Domain Name:

Time: 2022-11-30 21:44:01 UTC, NTP stratum 16

Analyzing DNSSEC problems for isoc.org

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to k.root-servers.net for ./DNSKEY
	Received 864 bytes from 193.0.14.129
	;; Response received from 193.0.14.129 (864 octets) ;; HEADER SECTION ;; id = 7080 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAeB54o2xvW6vY4qQZ0krDsEZCe6MsRWCqsXd4+cNJZMePnlV/xwDrIbbeH1SJzv742rOHzgA KM1/3SQHHSkoEIPx8XQdHAZBxfhaXl3e8c5WrE3aGXS5AeTWAkt85ccqWgKyitxjFmJEOol0BqS2 xueltaDwgWcC10nPUY+y5l/kTOYyptYQS4gg1uJNXIob/R1XIEJ10ZCurkYqZxgqyHc7tZv09N23 o9rnGdjnYiArH7FjlXD8Rvjde8YWkmfdbCEWnchrnxDK8KV2/ZvBpG/WYnRKXYPUceGCw59OJdJ5 M7utkm547RB3eEd8CVVhbXopZlsKq3GCrBwaIVe9ci0= ) ; Key ID = 18733 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20221221000000 20221130000000 20326 . EBqHCSXvacXYZX3LBW7wfHm6ObNQiH9UnraUjPzmaxaMW6//o6xiHpfz/ejt3Z74Rgqieuu8aFG/ xVFMtzOFGkceWdPVU2cUIhe4hfdIpspHG6OdYXZyLM/0bebCI8PRVeFOk66/jC2VW5gRO1mmX2fS tT1BufXAsVNBjwCW+lRi5KgOerBk1krKNJNqf9GUe8YugNikmm0T9Vgvgo2HwWXw9zT0MfFW0Q/1 U2IR3DAGcALdTx/+mXuNTjPXVmjuI2XkXzZMbZrV729d0edQIKajMyrjjEhlsug1Zo3dk0KaYBmd JgVt/eDthMKY4JheyUsPYkqBxZK10DAHRO7INA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAeB54o2xvW6vY4qQZ0krDsEZCe6MsRWCqsXd4+cNJZMePnlV/xwDrIbbeH1SJzv742rOHzgA KM1/3SQHHSkoEIPx8XQdHAZBxfhaXl3e8c5WrE3aGXS5AeTWAkt85ccqWgKyitxjFmJEOol0BqS2 xueltaDwgWcC10nPUY+y5l/kTOYyptYQS4gg1uJNXIob/R1XIEJ10ZCurkYqZxgqyHc7tZv09N23 o9rnGdjnYiArH7FjlXD8Rvjde8YWkmfdbCEWnchrnxDK8KV2/ZvBpG/WYnRKXYPUceGCw59OJdJ5 M7utkm547RB3eEd8CVVhbXopZlsKq3GCrBwaIVe9ci0= ) ; Key ID = 18733`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20221221000000 20221130000000 20326 . EBqHCSXvacXYZX3LBW7wfHm6ObNQiH9UnraUjPzmaxaMW6//o6xiHpfz/ejt3Z74Rgqieuu8aFG/ xVFMtzOFGkceWdPVU2cUIhe4hfdIpspHG6OdYXZyLM/0bebCI8PRVeFOk66/jC2VW5gRO1mmX2fS tT1BufXAsVNBjwCW+lRi5KgOerBk1krKNJNqf9GUe8YugNikmm0T9Vgvgo2HwWXw9zT0MfFW0Q/1 U2IR3DAGcALdTx/+mXuNTjPXVmjuI2XkXzZMbZrV729d0edQIKajMyrjjEhlsug1Zo3dk0KaYBmd JgVt/eDthMKY4JheyUsPYkqBxZK10DAHRO7INA== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=18733 is now in the chain-of-trust
	Query to h.root-servers.net for isoc.org/A
	Received 774 bytes from 198.97.190.53
	;; Response received from 198.97.190.53 (774 octets) ;; HEADER SECTION ;; id = 19907 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 13 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; isoc.org. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) org. 172800 IN NS a0.org.afilias-nst.info. org. 172800 IN NS a2.org.afilias-nst.info. org. 172800 IN NS b0.org.afilias-nst.org. org. 172800 IN NS b2.org.afilias-nst.org. org. 172800 IN NS c0.org.afilias-nst.info. org. 172800 IN NS d0.org.afilias-nst.org. org. 86400 IN DS ( 26974 8 2 4fede294c53f438a158c41d39489cd78a86beb0d8a0aeaff14745c0d16e1de32 ) org. 86400 IN RRSIG ( DS 8 1 86400 20221213170000 20221130160000 18733 . sJ/iNgjFT/vJfnaV/2IgiTUmWuQTpYPKh+nmxnnWO4nN9u/YaP+unXOHA8Q2D3Q2+KzEhBNUtd/g zMN8MxMLJf4XzPbNBDAsLoe0F3IGvv/RG0mtxApuXtrBY8Te8xTwWz4YCw/o/j5j6TBT+UcN1/Xv 2ygQSfNyYdPRufPxH/e1ADH2OTIzOxhVEi2lt5D/rq9iCw/nSwOyA5Ec7l+4VJlJf81ao6LdyMZS HGqo/eBcIbWfLyg3b/SRutqFHd2DGeA/mFL976BSytlicjV2MebW6r9GWF16W8erwDCXxu9Ey4sa GazBqx8ugvzOUjM1Q1ns7RDWUZ/barxfmD7yTA== ) ;; ADDITIONAL SECTION (13 records) a0.org.afilias-nst.info. 172800 IN A 199.19.56.1 a2.org.afilias-nst.info. 172800 IN A 199.249.112.1 b0.org.afilias-nst.org. 172800 IN A 199.19.54.1 b2.org.afilias-nst.org. 172800 IN A 199.249.120.1 c0.org.afilias-nst.info. 172800 IN A 199.19.53.1 d0.org.afilias-nst.org. 172800 IN A 199.19.57.1 a0.org.afilias-nst.info. 172800 IN AAAA 2001:500:e::1 a2.org.afilias-nst.info. 172800 IN AAAA 2001:500:40::1 b0.org.afilias-nst.org. 172800 IN AAAA 2001:500:c::1 b2.org.afilias-nst.org. 172800 IN AAAA 2001:500:48::1 c0.org.afilias-nst.info. 172800 IN AAAA 2001:500:b::1 d0.org.afilias-nst.org. 172800 IN AAAA 2001:500:f::1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to f.root-servers.net for org/DNSKEY
	Received 769 bytes from 192.5.5.241
	;; Response received from 192.5.5.241 (769 octets) ;; HEADER SECTION ;; id = 558 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 8 arcount = 13 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option: ;; QUESTION SECTION (1 record) ;; org. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) org. 172800 IN NS a0.org.afilias-nst.info. org. 172800 IN NS a2.org.afilias-nst.info. org. 172800 IN NS b0.org.afilias-nst.org. org. 172800 IN NS b2.org.afilias-nst.org. org. 172800 IN NS c0.org.afilias-nst.info. org. 172800 IN NS d0.org.afilias-nst.org. org. 86400 IN DS ( 26974 8 2 4fede294c53f438a158c41d39489cd78a86beb0d8a0aeaff14745c0d16e1de32 ) org. 86400 IN RRSIG ( DS 8 1 86400 20221213170000 20221130160000 18733 . sJ/iNgjFT/vJfnaV/2IgiTUmWuQTpYPKh+nmxnnWO4nN9u/YaP+unXOHA8Q2D3Q2+KzEhBNUtd/g zMN8MxMLJf4XzPbNBDAsLoe0F3IGvv/RG0mtxApuXtrBY8Te8xTwWz4YCw/o/j5j6TBT+UcN1/Xv 2ygQSfNyYdPRufPxH/e1ADH2OTIzOxhVEi2lt5D/rq9iCw/nSwOyA5Ec7l+4VJlJf81ao6LdyMZS HGqo/eBcIbWfLyg3b/SRutqFHd2DGeA/mFL976BSytlicjV2MebW6r9GWF16W8erwDCXxu9Ey4sa GazBqx8ugvzOUjM1Q1ns7RDWUZ/barxfmD7yTA== ) ;; ADDITIONAL SECTION (13 records) a0.org.afilias-nst.info. 172800 IN A 199.19.56.1 a0.org.afilias-nst.info. 172800 IN AAAA 2001:500:e::1 a2.org.afilias-nst.info. 172800 IN A 199.249.112.1 a2.org.afilias-nst.info. 172800 IN AAAA 2001:500:40::1 b0.org.afilias-nst.org. 172800 IN A 199.19.54.1 b0.org.afilias-nst.org. 172800 IN AAAA 2001:500:c::1 b2.org.afilias-nst.org. 172800 IN A 199.249.120.1 b2.org.afilias-nst.org. 172800 IN AAAA 2001:500:48::1 c0.org.afilias-nst.info. 172800 IN A 199.19.53.1 c0.org.afilias-nst.info. 172800 IN AAAA 2001:500:b::1 d0.org.afilias-nst.org. 172800 IN A 199.19.57.1 d0.org.afilias-nst.org. 172800 IN AAAA 2001:500:f::1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option:
	Found child zone org

org

	Checking DS between . and org
	Query to j.root-servers.net for org/DS
	Received 367 bytes from 192.58.128.30
	;; Response received from 192.58.128.30 (367 octets) ;; HEADER SECTION ;; id = 3220 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; org. IN DS ;; ANSWER SECTION (2 records) org. 86400 IN DS ( 26974 8 2 4fede294c53f438a158c41d39489cd78a86beb0d8a0aeaff14745c0d16e1de32 ) org. 86400 IN RRSIG ( DS 8 1 86400 20221213170000 20221130160000 18733 . sJ/iNgjFT/vJfnaV/2IgiTUmWuQTpYPKh+nmxnnWO4nN9u/YaP+unXOHA8Q2D3Q2+KzEhBNUtd/g zMN8MxMLJf4XzPbNBDAsLoe0F3IGvv/RG0mtxApuXtrBY8Te8xTwWz4YCw/o/j5j6TBT+UcN1/Xv 2ygQSfNyYdPRufPxH/e1ADH2OTIzOxhVEi2lt5D/rq9iCw/nSwOyA5Ec7l+4VJlJf81ao6LdyMZS HGqo/eBcIbWfLyg3b/SRutqFHd2DGeA/mFL976BSytlicjV2MebW6r9GWF16W8erwDCXxu9Ey4sa GazBqx8ugvzOUjM1Q1ns7RDWUZ/barxfmD7yTA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 1 DS records for org in the . zone
	DS=26974/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`org. 86400 IN RRSIG ( DS 8 1 86400 20221213170000 20221130160000 18733 . sJ/iNgjFT/vJfnaV/2IgiTUmWuQTpYPKh+nmxnnWO4nN9u/YaP+unXOHA8Q2D3Q2+KzEhBNUtd/g zMN8MxMLJf4XzPbNBDAsLoe0F3IGvv/RG0mtxApuXtrBY8Te8xTwWz4YCw/o/j5j6TBT+UcN1/Xv 2ygQSfNyYdPRufPxH/e1ADH2OTIzOxhVEi2lt5D/rq9iCw/nSwOyA5Ec7l+4VJlJf81ao6LdyMZS HGqo/eBcIbWfLyg3b/SRutqFHd2DGeA/mFL976BSytlicjV2MebW6r9GWF16W8erwDCXxu9Ey4sa GazBqx8ugvzOUjM1Q1ns7RDWUZ/barxfmD7yTA== )`
	RRSIG=18733 and DNSKEY=18733 verifies the DS RRset
	DS=26974/SHA-256 is now in the chain-of-trust
	`org. 86400 IN DS ( 26974 8 2 4fede294c53f438a158c41d39489cd78a86beb0d8a0aeaff14745c0d16e1de32 )`
	Query to c0.org.afilias-nst.info for org/DNSKEY
	Received 895 bytes from 199.19.53.1
	;; Response received from 199.19.53.1 (895 octets) ;; HEADER SECTION ;; id = 1535 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; org. IN DNSKEY ;; ANSWER SECTION (4 records) org. 3600 IN DNSKEY ( 256 3 8 AwEAAb1vr05DBuL1227pe86ifxDq7GW7SQ5TvXQkl+/ydYTSzd3b1DBDChEK5g7NNBaMCVxgqunz LWZ6JQPoiinu5dcxO3RwezvKTNXAvra19l+xP+/K6cTlOXnjnBDF6f2LY+jI4ykfU19acMpYrsSD /8BhzY2+7qJHAWCAYwD3dHlP ) ; Key ID = 37749 org. 3600 IN DNSKEY ( 256 3 8 AwEAAaSD1yA+QhrWbwLqA5MMbnYs4wTvvf/fX5ONwOHOO0fxhI3G6mq3rYceuhaiQRYF6V+JvJUU J8u8bQ/yuSWzP28d8sf1/9wMZK90j9D0XcKcIM/EH6nEonCGKgSC6zUYsfGWNpkVY++1EO56+mEP F8EvG0bb/MiNDydc41HnSMS1 ) ; Key ID = 41406 org. 3600 IN DNSKEY ( 257 3 8 AwEAAexZJ/1wfyNCxNPrTZizaG7UlibGhP+AyogR6bqjptKweEgE4gD8GxRQJkt+Fn5pCoNqzmm1 ZnEoKqvm93uOYtbKkYQDGH+W69J66MSKpgIyS+mT/4iaXn+lpb5o99l/sf7lHMa975O/fqN6aPUl l4hUbN2T1LHv6HzQuQCtNRJA8jHGwX5q0NMmh2Z+yaG6B9cISerje9l5L+ID2ydJ6zXquYteoIUv X2xzqnXCdHPSvD+oL6R/weW+tztdFS1hok/1z3tn5NzmcaOLll9nXniCozEpLFEGPswyvtphWgCY hI8bBTqhUsIwfIwLSBQTEg2oCX7sS5CbXg44OqwhIW8= ) ; Key ID = 26974 org. 3600 IN RRSIG ( DNSKEY 8 1 3600 20221216152403 20221125142403 26974 org. WQgJv5qdPJDD+azeU5H5afL3y9mKaYbaPjLJngtW0tovuNNt1em5D2sJkbTwDt4bULf8fLTCVQvA jFK8FWBQ4wWycZKyrI1tFyuFsdGUB6atCfVZsuFX7qIv0citgA18o2Z+SGejbLO55cIlmGhoG4e1 QbEk21nCUNWKwDxbOOTFBXi06zYWcihgxc+kC/Vg9+LbDb2qbepRupydvUJsm3HC2kbXY8Bn8sGj e0yloMtPJQJgc/9L8x1BSSgqQWzhbEf6VRTrpzMlFbq+1BIT5p9mxWxoHPUe9eyTwq6QfmSghZ+0 wta1VLBUb6sTbBcUI4esjv7CTKLbO5i7pyGuFQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 3 DNSKEY records for org
	`org. 3600 IN DNSKEY ( 256 3 8 AwEAAb1vr05DBuL1227pe86ifxDq7GW7SQ5TvXQkl+/ydYTSzd3b1DBDChEK5g7NNBaMCVxgqunz LWZ6JQPoiinu5dcxO3RwezvKTNXAvra19l+xP+/K6cTlOXnjnBDF6f2LY+jI4ykfU19acMpYrsSD /8BhzY2+7qJHAWCAYwD3dHlP ) ; Key ID = 37749`
	`org. 3600 IN DNSKEY ( 256 3 8 AwEAAaSD1yA+QhrWbwLqA5MMbnYs4wTvvf/fX5ONwOHOO0fxhI3G6mq3rYceuhaiQRYF6V+JvJUU J8u8bQ/yuSWzP28d8sf1/9wMZK90j9D0XcKcIM/EH6nEonCGKgSC6zUYsfGWNpkVY++1EO56+mEP F8EvG0bb/MiNDydc41HnSMS1 ) ; Key ID = 41406`
	`org. 3600 IN DNSKEY ( 257 3 8 AwEAAexZJ/1wfyNCxNPrTZizaG7UlibGhP+AyogR6bqjptKweEgE4gD8GxRQJkt+Fn5pCoNqzmm1 ZnEoKqvm93uOYtbKkYQDGH+W69J66MSKpgIyS+mT/4iaXn+lpb5o99l/sf7lHMa975O/fqN6aPUl l4hUbN2T1LHv6HzQuQCtNRJA8jHGwX5q0NMmh2Z+yaG6B9cISerje9l5L+ID2ydJ6zXquYteoIUv X2xzqnXCdHPSvD+oL6R/weW+tztdFS1hok/1z3tn5NzmcaOLll9nXniCozEpLFEGPswyvtphWgCY hI8bBTqhUsIwfIwLSBQTEg2oCX7sS5CbXg44OqwhIW8= ) ; Key ID = 26974`
	DNSKEY=26974/SEP is now in the chain-of-trust
	DS=26974/SHA-256 verifies DNSKEY=26974/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`org. 3600 IN RRSIG ( DNSKEY 8 1 3600 20221216152403 20221125142403 26974 org. WQgJv5qdPJDD+azeU5H5afL3y9mKaYbaPjLJngtW0tovuNNt1em5D2sJkbTwDt4bULf8fLTCVQvA jFK8FWBQ4wWycZKyrI1tFyuFsdGUB6atCfVZsuFX7qIv0citgA18o2Z+SGejbLO55cIlmGhoG4e1 QbEk21nCUNWKwDxbOOTFBXi06zYWcihgxc+kC/Vg9+LbDb2qbepRupydvUJsm3HC2kbXY8Bn8sGj e0yloMtPJQJgc/9L8x1BSSgqQWzhbEf6VRTrpzMlFbq+1BIT5p9mxWxoHPUe9eyTwq6QfmSghZ+0 wta1VLBUb6sTbBcUI4esjv7CTKLbO5i7pyGuFQ== )`
	RRSIG=26974 and DNSKEY=26974/SEP verifies the DNSKEY RRset
	DNSKEY=37749 is now in the chain-of-trust
	DNSKEY=41406 is now in the chain-of-trust
	Query to a2.org.afilias-nst.info for isoc.org/A
	Received 304 bytes from 199.249.112.1
	;; Response received from 199.249.112.1 (304 octets) ;; HEADER SECTION ;; id = 27424 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; isoc.org. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) isoc.org. 3600 IN NS yahir.ns.cloudflare.com. isoc.org. 3600 IN NS aron.ns.cloudflare.com. isoc.org. 3600 IN DS ( 2371 13 2 5be4cbe7e5d1caee6d4a194eb96614ad2c6e26dd524bc3d758cc7153d76264cd ) isoc.org. 3600 IN RRSIG ( DS 8 2 3600 20221216152403 20221125142403 41406 org. oH/gatU6zAkS+v1OuuAUMiXHClaVY3570HP8T6I4dqyrfI1c4B6OCFS/s4dcawbTL668IjTzXW7b HcbSaxrvinhYGenkmQ/EyHCwv2EP8Cbb6yKAgMcbAE/VWXsV18Aw2GXWtK8aqjnO5fUCU/x8efHl X/Sp4lepzUbO+rQVuNk= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to c0.org.afilias-nst.info for isoc.org/DNSKEY
	Received 304 bytes from 199.19.53.1
	;; Response received from 199.19.53.1 (304 octets) ;; HEADER SECTION ;; id = 52544 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; isoc.org. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) isoc.org. 3600 IN NS yahir.ns.cloudflare.com. isoc.org. 3600 IN NS aron.ns.cloudflare.com. isoc.org. 3600 IN DS ( 2371 13 2 5be4cbe7e5d1caee6d4a194eb96614ad2c6e26dd524bc3d758cc7153d76264cd ) isoc.org. 3600 IN RRSIG ( DS 8 2 3600 20221216152403 20221125142403 41406 org. oH/gatU6zAkS+v1OuuAUMiXHClaVY3570HP8T6I4dqyrfI1c4B6OCFS/s4dcawbTL668IjTzXW7b HcbSaxrvinhYGenkmQ/EyHCwv2EP8Cbb6yKAgMcbAE/VWXsV18Aw2GXWtK8aqjnO5fUCU/x8efHl X/Sp4lepzUbO+rQVuNk= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found child zone isoc.org

isoc.org

	Checking DS between org and isoc.org
	Query to b0.org.afilias-nst.org for isoc.org/DS
	Received 248 bytes from 199.19.54.1
	;; Response received from 199.19.54.1 (248 octets) ;; HEADER SECTION ;; id = 58396 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; isoc.org. IN DS ;; ANSWER SECTION (2 records) isoc.org. 3600 IN DS ( 2371 13 2 5be4cbe7e5d1caee6d4a194eb96614ad2c6e26dd524bc3d758cc7153d76264cd ) isoc.org. 3600 IN RRSIG ( DS 8 2 3600 20221216152403 20221125142403 41406 org. oH/gatU6zAkS+v1OuuAUMiXHClaVY3570HP8T6I4dqyrfI1c4B6OCFS/s4dcawbTL668IjTzXW7b HcbSaxrvinhYGenkmQ/EyHCwv2EP8Cbb6yKAgMcbAE/VWXsV18Aw2GXWtK8aqjnO5fUCU/x8efHl X/Sp4lepzUbO+rQVuNk= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 1 DS records for isoc.org in the org zone
	DS=2371/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`isoc.org. 3600 IN RRSIG ( DS 8 2 3600 20221216152403 20221125142403 41406 org. oH/gatU6zAkS+v1OuuAUMiXHClaVY3570HP8T6I4dqyrfI1c4B6OCFS/s4dcawbTL668IjTzXW7b HcbSaxrvinhYGenkmQ/EyHCwv2EP8Cbb6yKAgMcbAE/VWXsV18Aw2GXWtK8aqjnO5fUCU/x8efHl X/Sp4lepzUbO+rQVuNk= )`
	RRSIG=41406 and DNSKEY=41406 verifies the DS RRset
	DS=2371/SHA-256 is now in the chain-of-trust
	`isoc.org. 3600 IN DS ( 2371 13 2 5be4cbe7e5d1caee6d4a194eb96614ad2c6e26dd524bc3d758cc7153d76264cd )`
	Query to aron.ns.cloudflare.com for isoc.org/DNSKEY
	Received 301 bytes from 173.245.58.69
	;; Response received from 173.245.58.69 (301 octets) ;; HEADER SECTION ;; id = 1021 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; isoc.org. IN DNSKEY ;; ANSWER SECTION (3 records) isoc.org. 3600 IN DNSKEY ( 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iU zy1L53eKGQ== ) ; Key ID = 2371 isoc.org. 3600 IN DNSKEY ( 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x 8fGAa2XhSA== ) ; Key ID = 34505 isoc.org. 3600 IN RRSIG ( DNSKEY 13 2 3600 20230129045652 20221129045652 2371 isoc.org. V81zWw9OhCIXiwGHARcdRe+lb0u8ZdKe6qCinVC+daxrUvF/hKIMQT+CUYUJXVJPR4m7yLVs1rOz 3BaWrsGhRg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 2 DNSKEY records for isoc.org
	`isoc.org. 3600 IN DNSKEY ( 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iU zy1L53eKGQ== ) ; Key ID = 2371`
	`isoc.org. 3600 IN DNSKEY ( 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x 8fGAa2XhSA== ) ; Key ID = 34505`
	DNSKEY=2371/SEP is now in the chain-of-trust
	DS=2371/SHA-256 verifies DNSKEY=2371/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`isoc.org. 3600 IN RRSIG ( DNSKEY 13 2 3600 20230129045652 20221129045652 2371 isoc.org. V81zWw9OhCIXiwGHARcdRe+lb0u8ZdKe6qCinVC+daxrUvF/hKIMQT+CUYUJXVJPR4m7yLVs1rOz 3BaWrsGhRg== )`
	RRSIG=2371 and DNSKEY=2371/SEP verifies the DNSKEY RRset
	DNSKEY=34505 is now in the chain-of-trust
	Query to yahir.ns.cloudflare.com for isoc.org/A
	Received 173 bytes from 162.159.44.34
	;; Response received from 162.159.44.34 (173 octets) ;; HEADER SECTION ;; id = 46710 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; isoc.org. IN A ;; ANSWER SECTION (3 records) isoc.org. 300 IN A 104.18.10.177 isoc.org. 300 IN A 104.18.11.177 isoc.org. 300 IN RRSIG ( A 13 2 300 20221201224402 20221129204402 34505 isoc.org. Kiin5sPErhVOGhcSOgBRkykcTHh+Q5T6WuVQmVD2hFdn6/o0DK+rCvR94y6sRCcGp9n8DP8twmyd S01fqn7Fhw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	yahir.ns.cloudflare.com is authoritative for isoc.org
	Found RRSIG signed by isoc.org zone
	Query to aron.ns.cloudflare.com for isoc.org/SOA
	Received 203 bytes from 172.64.32.69
	;; Response received from 172.64.32.69 (203 octets) ;; HEADER SECTION ;; id = 17787 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; isoc.org. IN SOA ;; ANSWER SECTION (2 records) isoc.org. 3600 IN SOA ( aron.ns.cloudflare.com. dns.cloudflare.com. 2295304403 ;serial 10000 ;refresh 2400 ;retry 604800 ;expire 3600 ;minimum ) isoc.org. 3600 IN RRSIG ( SOA 13 2 3600 20221201224402 20221129204402 34505 isoc.org. hRkMEcaoKWoBl3ocYiudp5cYcWRear2a3XXuCY8DVpZURWLq5ns8HPj28ATisR8CKUVIDJEk2okC iltOI5f7pg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to yahir.ns.cloudflare.com for isoc.org/A
	Received 173 bytes from 108.162.195.34
	;; Response received from 108.162.195.34 (173 octets) ;; HEADER SECTION ;; id = 25641 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; isoc.org. IN A ;; ANSWER SECTION (3 records) isoc.org. 300 IN A 104.18.10.177 isoc.org. 300 IN A 104.18.11.177 isoc.org. 300 IN RRSIG ( A 13 2 300 20221201224402 20221129204402 34505 isoc.org. 4fmsFY0Td2MGS0tZm3r11cHX3NpL2RwuYxO+LGrC7GUj8fKLw9FnUn4TEOSwP5mkf8OJqtU6LYiF aU/918lVJA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	isoc.org A RR has value 104.18.10.177
	isoc.org A RR has value 104.18.11.177
	Found 1 RRSIGs over A RRset
	`isoc.org. 300 IN RRSIG ( A 13 2 300 20221201224402 20221129204402 34505 isoc.org. 4fmsFY0Td2MGS0tZm3r11cHX3NpL2RwuYxO+LGrC7GUj8fKLw9FnUn4TEOSwP5mkf8OJqtU6LYiF aU/918lVJA== )`
	RRSIG=34505 and DNSKEY=34505 verifies the A RRset

isoc.org

	Query to aron.ns.cloudflare.com for isoc.org/A
	Received 173 bytes from 172.64.32.69
	;; Response received from 172.64.32.69 (173 octets) ;; HEADER SECTION ;; id = 11704 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; isoc.org. IN A ;; ANSWER SECTION (3 records) isoc.org. 300 IN A 104.18.11.177 isoc.org. 300 IN A 104.18.10.177 isoc.org. 300 IN RRSIG ( A 13 2 300 20221201224402 20221129204402 34505 isoc.org. VkZsccTvnQntOPOWd4+7WuWsl23nIArStzIWFMQ4PqcCC3avObSN9ztz7JBE8kleIcaxBmklmo6Z uUFxOhbUlQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	aron.ns.cloudflare.com is authoritative for isoc.org
	Found RRSIG signed by isoc.org zone
	Query to aron.ns.cloudflare.com for isoc.org/A
	Received 173 bytes from 108.162.192.69
	;; Response received from 108.162.192.69 (173 octets) ;; HEADER SECTION ;; id = 37039 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; isoc.org. IN A ;; ANSWER SECTION (3 records) isoc.org. 300 IN A 104.18.10.177 isoc.org. 300 IN A 104.18.11.177 isoc.org. 300 IN RRSIG ( A 13 2 300 20221201224402 20221129204402 34505 isoc.org. JiCn8u39aZJAUzoOoug85QEER7/7hZSLU1FciXN3NXY/eliq/DzYG2wTOXC+0iWgcQPyE1K6NBHO uViSuPB/gQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	isoc.org A RR has value 104.18.10.177
	isoc.org A RR has value 104.18.11.177
	Found 1 RRSIGs over A RRset
	`isoc.org. 300 IN RRSIG ( A 13 2 300 20221201224402 20221129204402 34505 isoc.org. JiCn8u39aZJAUzoOoug85QEER7/7hZSLU1FciXN3NXY/eliq/DzYG2wTOXC+0iWgcQPyE1K6NBHO uViSuPB/gQ== )`
	RRSIG=34505 and DNSKEY=34505 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test isoc.org at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: