DNSSEC Debugger - kagi.com

Domain Name:

Time: 2025-12-05 16:56:44 UTC

Analyzing DNSSEC problems for kagi.com

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to b.root-servers.net for ./DNSKEY
	Received 1139 bytes from 170.247.170.2
	;; Response received from [170.247.170.2] 1139 octets ;; HEADER SECTION ;; id = 50738 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAeuS7hMRZ7muj1c/ew2DoavxkBw3jUG5R79pKVDI39fxvlD1HfJYGJERnXuV4SrQfUPzWw/l t5Axb0EqXL/sQ2ZyntVmwQwoSXi2l9smlIKh2UrkTmmozRCPe7GS4fZTE4Ew7AV4YprTLgVmxiGP 4unRuXkYOgQJXCIBpVCmEdUli6X2sm0i5ZilU/Q+rX3RDw+eYPP7K0cJnJ+ZnvQDy14+BFtreWl9 enNQljgGpBp26lEp1z7AbvUfzkQNVCVGaM8jEaCSALXiROlwCQMOdj+tpLXFf99kdJnTQw2cpEr1 uGs/yENAJpoGhbjZAoIkXzDUBSlfFeYz7FWzH6gIe7M= ) ; keytag 61809 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20251221000000 20251130000000 20326 . L/iH2Q42PclQDXuwtlroZdsA6QvdFsYiK32J0zRyhKdUS3g1JXLbxvT1XMCY/O8VChagqJJKgR9K oRyDBuUwYcYEVAUjKdWLRyylxNt6Gak+OItMAr2b1lmRzXoHfKkihi6XdY8n9eG3tGAZi3Dc0gh7 aZP1hrKUBM/zBA1qqyDRwvAFomgPx7bmOEpVgdZ+yLaKZtzBHCIbLvGfSrWJ82UjxIxTFt1SrZsv rRdLsXDaaNPgClzdEtbzPCfbaIaeMghxRAZjCWOR2iliklsiiLzStP3VTxe7VijQS8vpQzTPFaQl Yr5CNG0n4ZeUCKIXIEyV02V2QqjIAxSTe2xeRQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAeuS7hMRZ7muj1c/ew2DoavxkBw3jUG5R79pKVDI39fxvlD1HfJYGJERnXuV4SrQfUPzWw/l t5Axb0EqXL/sQ2ZyntVmwQwoSXi2l9smlIKh2UrkTmmozRCPe7GS4fZTE4Ew7AV4YprTLgVmxiGP 4unRuXkYOgQJXCIBpVCmEdUli6X2sm0i5ZilU/Q+rX3RDw+eYPP7K0cJnJ+ZnvQDy14+BFtreWl9 enNQljgGpBp26lEp1z7AbvUfzkQNVCVGaM8jEaCSALXiROlwCQMOdj+tpLXFf99kdJnTQw2cpEr1 uGs/yENAJpoGhbjZAoIkXzDUBSlfFeYz7FWzH6gIe7M= ) ; keytag 61809`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20251221000000 20251130000000 20326 . L/iH2Q42PclQDXuwtlroZdsA6QvdFsYiK32J0zRyhKdUS3g1JXLbxvT1XMCY/O8VChagqJJKgR9K oRyDBuUwYcYEVAUjKdWLRyylxNt6Gak+OItMAr2b1lmRzXoHfKkihi6XdY8n9eG3tGAZi3Dc0gh7 aZP1hrKUBM/zBA1qqyDRwvAFomgPx7bmOEpVgdZ+yLaKZtzBHCIbLvGfSrWJ82UjxIxTFt1SrZsv rRdLsXDaaNPgClzdEtbzPCfbaIaeMghxRAZjCWOR2iliklsiiLzStP3VTxe7VijQS8vpQzTPFaQl Yr5CNG0n4ZeUCKIXIEyV02V2QqjIAxSTe2xeRQ== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=61809 is now in the chain-of-trust
	DNSKEY=38696/SEP is now in the chain-of-trust
	Query to f.root-servers.net for kagi.com/A
	Received 1168 bytes from 192.5.5.241
	;; Response received from [192.5.5.241] 1168 octets ;; HEADER SECTION ;; id = 57274 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 15 arcount = 27 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. com. 86400 IN DS ( 19718 13 2 8acbb0cd28f41250a80a491389424d341522d946b0da0c0291f2d3d771d7805a ) com. 86400 IN RRSIG ( DS 8 1 86400 20251218050000 20251205040000 61809 . uojlR9v3zGjF/1nC620HcK5h1whrulbL3cBmy6k9D/DQYBoxyCfEtDJFnt5zwY79z3zKdQytiag+ DJObhIjJYvrpoMlYP4GXFQ4evpKlK1eNfxsHvZQKvxirC+Irce7U9/tJGWGSDImYP9hEcRgheGZP fV+7Ch7ccmP2o4CusMETJB/b5vSEUE0RVflr/yNs5gn78gYruOGpP6dZ/5naN1GfQT+5viFKOkxA AOJTXTvLuLwp6Daf2bmC+YRlESN4zXyazlhm11IoGdCzp8B5H00GI4twwHYwXM0UNILP+yELIxaf 4ro8ZJkePE1aKZ6F7wk1Ea0YNccSuGDkst0lgA== ) ;; ADDITIONAL SECTION (27 records) a.gtld-servers.net. 172800 IN A 192.5.6.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 b.gtld-servers.net. 172800 IN A 192.33.14.30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 c.gtld-servers.net. 172800 IN A 192.26.92.30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 d.gtld-servers.net. 172800 IN A 192.31.80.30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 e.gtld-servers.net. 172800 IN A 192.12.94.30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 f.gtld-servers.net. 172800 IN A 192.35.51.30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 g.gtld-servers.net. 172800 IN A 192.42.93.30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 h.gtld-servers.net. 172800 IN A 192.54.112.30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 i.gtld-servers.net. 172800 IN A 192.43.172.30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 j.gtld-servers.net. 172800 IN A 192.48.79.30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 k.gtld-servers.net. 172800 IN A 192.52.178.30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 l.gtld-servers.net. 172800 IN A 192.41.162.30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 m.gtld-servers.net. 172800 IN A 192.55.83.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 ;; { "EDNS-VERSION": 0 }
	Query to m.root-servers.net for com/DNSKEY
	Received 1163 bytes from 202.12.27.33
	;; Response received from [202.12.27.33] 1163 octets ;; HEADER SECTION ;; id = 29079 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 15 arcount = 27 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; com. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 86400 IN DS ( 19718 13 2 8acbb0cd28f41250a80a491389424d341522d946b0da0c0291f2d3d771d7805a ) com. 86400 IN RRSIG ( DS 8 1 86400 20251218050000 20251205040000 61809 . uojlR9v3zGjF/1nC620HcK5h1whrulbL3cBmy6k9D/DQYBoxyCfEtDJFnt5zwY79z3zKdQytiag+ DJObhIjJYvrpoMlYP4GXFQ4evpKlK1eNfxsHvZQKvxirC+Irce7U9/tJGWGSDImYP9hEcRgheGZP fV+7Ch7ccmP2o4CusMETJB/b5vSEUE0RVflr/yNs5gn78gYruOGpP6dZ/5naN1GfQT+5viFKOkxA AOJTXTvLuLwp6Daf2bmC+YRlESN4zXyazlhm11IoGdCzp8B5H00GI4twwHYwXM0UNILP+yELIxaf 4ro8ZJkePE1aKZ6F7wk1Ea0YNccSuGDkst0lgA== ) ;; ADDITIONAL SECTION (27 records) m.gtld-servers.net. 172800 IN A 192.55.83.30 l.gtld-servers.net. 172800 IN A 192.41.162.30 k.gtld-servers.net. 172800 IN A 192.52.178.30 j.gtld-servers.net. 172800 IN A 192.48.79.30 i.gtld-servers.net. 172800 IN A 192.43.172.30 h.gtld-servers.net. 172800 IN A 192.54.112.30 g.gtld-servers.net. 172800 IN A 192.42.93.30 f.gtld-servers.net. 172800 IN A 192.35.51.30 e.gtld-servers.net. 172800 IN A 192.12.94.30 d.gtld-servers.net. 172800 IN A 192.31.80.30 c.gtld-servers.net. 172800 IN A 192.26.92.30 b.gtld-servers.net. 172800 IN A 192.33.14.30 a.gtld-servers.net. 172800 IN A 192.5.6.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 ;; { "EDNS-VERSION": 0 }
	Found child zone com

com

	Checking DS between . and com
	Query to l.root-servers.net for com/DS
	Received 367 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 367 octets ;; HEADER SECTION ;; id = 50319 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; com. IN DS ;; ANSWER SECTION (2 records) com. 86400 IN DS ( 19718 13 2 8acbb0cd28f41250a80a491389424d341522d946b0da0c0291f2d3d771d7805a ) com. 86400 IN RRSIG ( DS 8 1 86400 20251218050000 20251205040000 61809 . uojlR9v3zGjF/1nC620HcK5h1whrulbL3cBmy6k9D/DQYBoxyCfEtDJFnt5zwY79z3zKdQytiag+ DJObhIjJYvrpoMlYP4GXFQ4evpKlK1eNfxsHvZQKvxirC+Irce7U9/tJGWGSDImYP9hEcRgheGZP fV+7Ch7ccmP2o4CusMETJB/b5vSEUE0RVflr/yNs5gn78gYruOGpP6dZ/5naN1GfQT+5viFKOkxA AOJTXTvLuLwp6Daf2bmC+YRlESN4zXyazlhm11IoGdCzp8B5H00GI4twwHYwXM0UNILP+yELIxaf 4ro8ZJkePE1aKZ6F7wk1Ea0YNccSuGDkst0lgA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for com in the . zone
	DS=19718/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`com. 86400 IN RRSIG ( DS 8 1 86400 20251218050000 20251205040000 61809 . uojlR9v3zGjF/1nC620HcK5h1whrulbL3cBmy6k9D/DQYBoxyCfEtDJFnt5zwY79z3zKdQytiag+ DJObhIjJYvrpoMlYP4GXFQ4evpKlK1eNfxsHvZQKvxirC+Irce7U9/tJGWGSDImYP9hEcRgheGZP fV+7Ch7ccmP2o4CusMETJB/b5vSEUE0RVflr/yNs5gn78gYruOGpP6dZ/5naN1GfQT+5viFKOkxA AOJTXTvLuLwp6Daf2bmC+YRlESN4zXyazlhm11IoGdCzp8B5H00GI4twwHYwXM0UNILP+yELIxaf 4ro8ZJkePE1aKZ6F7wk1Ea0YNccSuGDkst0lgA== )`
	RRSIG=61809 and DNSKEY=61809 verifies the DS RRset
	DS=19718/SHA-256 is now in the chain-of-trust
	`com. 86400 IN DS ( 19718 13 2 8acbb0cd28f41250a80a491389424d341522d946b0da0c0291f2d3d771d7805a )`
	Query to f.gtld-servers.net for com/DNSKEY
	Received 291 bytes from 192.35.51.30
	;; Response received from [192.35.51.30] 291 octets ;; HEADER SECTION ;; id = 30106 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; com. IN DNSKEY ;; ANSWER SECTION (3 records) com. 86400 IN DNSKEY ( 256 3 13 DlR2Hg7gaFa3QrV+6wv2miYtrBDVD6maxc/us4r02T1p/PCAGk+TPlmtiam1QvGYS1/g2IAi6UV0 nZkLOb+OyA== ) ; keytag 46539 com. 86400 IN DNSKEY ( 257 3 13 tx8EZRAd2+K/DJRV0S+hbBzaRPS/G6JVNBitHzqpsGlz8huE61Ms9ANe6NSDLKJtiTBqfTJWDAyw Ep1FCsEINQ== ) ; keytag 19718 com. 86400 IN RRSIG ( DNSKEY 13 1 86400 20251213150235 20251128145735 19718 com. +ZZyJIsTdrzgLuHJ5KMkQZXdix7eTSRVs6H6Fg7mmk04DYSd6sTv2q3IW3Z3LDzkBtshLgALjO0x 2m5r1Eip2g== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for com
	`com. 86400 IN DNSKEY ( 256 3 13 DlR2Hg7gaFa3QrV+6wv2miYtrBDVD6maxc/us4r02T1p/PCAGk+TPlmtiam1QvGYS1/g2IAi6UV0 nZkLOb+OyA== ) ; keytag 46539`
	`com. 86400 IN DNSKEY ( 257 3 13 tx8EZRAd2+K/DJRV0S+hbBzaRPS/G6JVNBitHzqpsGlz8huE61Ms9ANe6NSDLKJtiTBqfTJWDAyw Ep1FCsEINQ== ) ; keytag 19718`
	DNSKEY=19718/SEP is now in the chain-of-trust
	DS=19718/SHA-256 verifies DNSKEY=19718/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`com. 86400 IN RRSIG ( DNSKEY 13 1 86400 20251213150235 20251128145735 19718 com. +ZZyJIsTdrzgLuHJ5KMkQZXdix7eTSRVs6H6Fg7mmk04DYSd6sTv2q3IW3Z3LDzkBtshLgALjO0x 2m5r1Eip2g== )`
	RRSIG=19718 and DNSKEY=19718/SEP verifies the DNSKEY RRset
	DNSKEY=46539 is now in the chain-of-trust
	Query to m.gtld-servers.net for kagi.com/A
	Received 337 bytes from 192.55.83.30
	;; Response received from [192.55.83.30] 337 octets ;; HEADER SECTION ;; id = 25490 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 2 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) kagi.com. 172800 IN NS ns-119.awsdns-14.com. kagi.com. 172800 IN NS ns-899.awsdns-48.net. kagi.com. 172800 IN NS ns-1728.awsdns-24.co.uk. kagi.com. 172800 IN NS ns-1265.awsdns-30.org. kagi.com. 86400 IN DS ( 50737 13 2 c0cd5bb0ac3e3cbc46926cd2a4b2951243ca9531325a57984cb0a3201f565b29 ) kagi.com. 86400 IN RRSIG ( DS 13 2 86400 20251211015751 20251204004751 46539 com. mzTusorPOY6/vqvNYkVmHum9p531tQuAmPAnlQIFnlxBDmAURpFzgePVZopOVPEkrWsLgdepcJfK af72zGEUmw== ) ;; ADDITIONAL SECTION (2 records) ns-119.awsdns-14.com. 172800 IN A 205.251.192.119 ;; { "EDNS-VERSION": 0 }
	Query to d.gtld-servers.net for kagi.com/DNSKEY
	Received 337 bytes from 192.31.80.30
	;; Response received from [192.31.80.30] 337 octets ;; HEADER SECTION ;; id = 33260 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 2 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) kagi.com. 172800 IN NS ns-119.awsdns-14.com. kagi.com. 172800 IN NS ns-899.awsdns-48.net. kagi.com. 172800 IN NS ns-1728.awsdns-24.co.uk. kagi.com. 172800 IN NS ns-1265.awsdns-30.org. kagi.com. 86400 IN DS ( 50737 13 2 c0cd5bb0ac3e3cbc46926cd2a4b2951243ca9531325a57984cb0a3201f565b29 ) kagi.com. 86400 IN RRSIG ( DS 13 2 86400 20251211015751 20251204004751 46539 com. mzTusorPOY6/vqvNYkVmHum9p531tQuAmPAnlQIFnlxBDmAURpFzgePVZopOVPEkrWsLgdepcJfK af72zGEUmw== ) ;; ADDITIONAL SECTION (2 records) ns-119.awsdns-14.com. 172800 IN A 205.251.192.119 ;; { "EDNS-VERSION": 0 }
	Found child zone kagi.com

kagi.com

	Checking DS between com and kagi.com
	Query to k.gtld-servers.net for kagi.com/DS
	Received 1079 bytes from 192.52.178.30
	;; Response received from [192.52.178.30] 1079 octets ;; HEADER SECTION ;; id = 13964 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 14 arcount = 27 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN DS ;; ANSWER SECTION (2 records) kagi.com. 86400 IN DS ( 50737 13 2 c0cd5bb0ac3e3cbc46926cd2a4b2951243ca9531325a57984cb0a3201f565b29 ) kagi.com. 86400 IN RRSIG ( DS 13 2 86400 20251211015751 20251204004751 46539 com. mzTusorPOY6/vqvNYkVmHum9p531tQuAmPAnlQIFnlxBDmAURpFzgePVZopOVPEkrWsLgdepcJfK af72zGEUmw== ) ;; AUTHORITY SECTION (14 records) com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. com. 172800 IN RRSIG ( NS 13 1 172800 20251210002654 20251202231654 46539 com. IH0Lp3FTZB5AnfaWo2a8UU/hu/6OyFNduZ6TRiE+PAs8tft6pT3D6mfWMPa/koYWw6FugKozFawz 6Wdt1h4WXA== ) ;; ADDITIONAL SECTION (27 records) k.gtld-servers.net. 172800 IN A 192.52.178.30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 d.gtld-servers.net. 172800 IN A 192.31.80.30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 a.gtld-servers.net. 172800 IN A 192.5.6.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 g.gtld-servers.net. 172800 IN A 192.42.93.30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 b.gtld-servers.net. 172800 IN A 192.33.14.30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 f.gtld-servers.net. 172800 IN A 192.35.51.30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 h.gtld-servers.net. 172800 IN A 192.54.112.30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 c.gtld-servers.net. 172800 IN A 192.26.92.30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 j.gtld-servers.net. 172800 IN A 192.48.79.30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 e.gtld-servers.net. 172800 IN A 192.12.94.30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 i.gtld-servers.net. 172800 IN A 192.43.172.30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 l.gtld-servers.net. 172800 IN A 192.41.162.30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 m.gtld-servers.net. 172800 IN A 192.55.83.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for kagi.com in the com zone
	DS=50737/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`kagi.com. 86400 IN RRSIG ( DS 13 2 86400 20251211015751 20251204004751 46539 com. mzTusorPOY6/vqvNYkVmHum9p531tQuAmPAnlQIFnlxBDmAURpFzgePVZopOVPEkrWsLgdepcJfK af72zGEUmw== )`
	RRSIG=46539 and DNSKEY=46539 verifies the DS RRset
	DS=50737/SHA-256 is now in the chain-of-trust
	`kagi.com. 86400 IN DS ( 50737 13 2 c0cd5bb0ac3e3cbc46926cd2a4b2951243ca9531325a57984cb0a3201f565b29 )`
	Query to ns-1728.awsdns-24.co.uk for kagi.com/DNSKEY
	Received 381 bytes from 205.251.198.192
	;; Response received from [205.251.198.192] 381 octets ;; HEADER SECTION ;; id = 26180 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN DNSKEY ;; ANSWER SECTION (4 records) kagi.com. 3600 IN DNSKEY ( 256 3 13 OVaLCr9Np3uL+x3bsHDxlJhVKXkBblLTqz7djxKftjjSNsxyoOvuNyBS6gBrG4kyV+RZG3OizNT2 aPhZMujapg== ) ; keytag 64768 kagi.com. 3600 IN DNSKEY ( 256 3 13 zZkqNmPUzG7O7lT5LXyyiRMWJwgz0giy2afx08WBgnWEaWIhZN5zhOWBIuWq1o4pBcg3sFNN3jjd nkVVmaMGhw== ) ; keytag 60565 kagi.com. 3600 IN DNSKEY ( 257 3 13 y0gTOa13jkhjO+IMK19MEuqJ/wCE+o9NlGRU0ziecadqOTM/77HTByqEL0a4S8KeFmbmMwFPSiie zCBQZxy2pQ== ) ; keytag 50737 kagi.com. 3600 IN RRSIG ( DNSKEY 13 2 3600 20251206020000 20251205150000 50737 kagi.com. GIenDc7iOI5Kgz2t+fV9y+tw9bTEEV+KCyx2YXZaphcY0qZuAqS4SgS/UeuqqryD+xNuJorveA3H sbZppEctiw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for kagi.com
	`kagi.com. 3600 IN DNSKEY ( 256 3 13 OVaLCr9Np3uL+x3bsHDxlJhVKXkBblLTqz7djxKftjjSNsxyoOvuNyBS6gBrG4kyV+RZG3OizNT2 aPhZMujapg== ) ; keytag 64768`
	`kagi.com. 3600 IN DNSKEY ( 256 3 13 zZkqNmPUzG7O7lT5LXyyiRMWJwgz0giy2afx08WBgnWEaWIhZN5zhOWBIuWq1o4pBcg3sFNN3jjd nkVVmaMGhw== ) ; keytag 60565`
	`kagi.com. 3600 IN DNSKEY ( 257 3 13 y0gTOa13jkhjO+IMK19MEuqJ/wCE+o9NlGRU0ziecadqOTM/77HTByqEL0a4S8KeFmbmMwFPSiie zCBQZxy2pQ== ) ; keytag 50737`
	DNSKEY=50737/SEP is now in the chain-of-trust
	DS=50737/SHA-256 verifies DNSKEY=50737/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`kagi.com. 3600 IN RRSIG ( DNSKEY 13 2 3600 20251206020000 20251205150000 50737 kagi.com. GIenDc7iOI5Kgz2t+fV9y+tw9bTEEV+KCyx2YXZaphcY0qZuAqS4SgS/UeuqqryD+xNuJorveA3H sbZppEctiw== )`
	RRSIG=50737 and DNSKEY=50737/SEP verifies the DNSKEY RRset
	DNSKEY=64768 is now in the chain-of-trust
	DNSKEY=60565 is now in the chain-of-trust
	Query to ns-119.awsdns-14.com for kagi.com/A
	Received 157 bytes from 205.251.192.119
	;; Response received from [205.251.192.119] 157 octets ;; HEADER SECTION ;; id = 46631 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN A ;; ANSWER SECTION (2 records) kagi.com. 300 IN A 34.111.242.115 kagi.com. 300 IN RRSIG ( A 13 2 300 20251205180144 20251205155644 60565 kagi.com. oJs9FNjE703e9EMuHTa/A/xNPKdJzdMFRq3KLtblKsZffso1prQK6UlVaqWZ4CrYg2XKELFFgDuo 8RS0yZNB5w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns-119.awsdns-14.com is authoritative for kagi.com
	Found RRSIG signed by kagi.com zone
	Query to ns-1265.awsdns-30.org for kagi.com/SOA
	Received 225 bytes from 205.251.196.241
	;; Response received from [205.251.196.241] 225 octets ;; HEADER SECTION ;; id = 63994 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN SOA ;; ANSWER SECTION (2 records) kagi.com. 900 IN SOA ( ns-1728.awsdns-24.co.uk. awsdns-hostmaster.amazon.com. 1 ;serial 7200 ;refresh 900 ;retry 1209600 ;expire 300 ;minimum ) kagi.com. 900 IN RRSIG ( SOA 13 2 900 20251205181145 20251205155645 60565 kagi.com. 9fCPTeQkAUS04Bm5Gpp3FirRusZ4h/IKUGZ5I8kRp+9Yfo8NMo+B+2I0braUA+0n2OPb1RgiVB+a b89el7VmiQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns-1728.awsdns-24.co.uk for kagi.com/SOA
	Received 225 bytes from 205.251.198.192
	;; Response received from [205.251.198.192] 225 octets ;; HEADER SECTION ;; id = 17807 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN SOA ;; ANSWER SECTION (2 records) kagi.com. 900 IN SOA ( ns-1728.awsdns-24.co.uk. awsdns-hostmaster.amazon.com. 1 ;serial 7200 ;refresh 900 ;retry 1209600 ;expire 300 ;minimum ) kagi.com. 900 IN RRSIG ( SOA 13 2 900 20251205181145 20251205155645 60565 kagi.com. vF0F5TAEUnD7hAhYTFOaUOhoh6qiGkwtpSRLOsEJiC/LTZ676pzs7xtF1T3o/bvpljxYAudTvAhJ 7EQavvq1cw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns-899.awsdns-48.net for kagi.com/SOA
	Received 225 bytes from 205.251.195.131
	;; Response received from [205.251.195.131] 225 octets ;; HEADER SECTION ;; id = 37099 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN SOA ;; ANSWER SECTION (2 records) kagi.com. 900 IN SOA ( ns-1728.awsdns-24.co.uk. awsdns-hostmaster.amazon.com. 1 ;serial 7200 ;refresh 900 ;retry 1209600 ;expire 300 ;minimum ) kagi.com. 900 IN RRSIG ( SOA 13 2 900 20251205181145 20251205155645 60565 kagi.com. QFH7ZS/JidrC0fMKAi+hGp9UIKAunXyWOMf2G4mLPn9FvVQ9uOHnGIKdF9QMZNOcHxat8hsSwNhN GHrifX0Ayg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns-119.awsdns-14.com for kagi.com/A
	Received 157 bytes from 205.251.192.119
	;; Response received from [205.251.192.119] 157 octets ;; HEADER SECTION ;; id = 7687 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN A ;; ANSWER SECTION (2 records) kagi.com. 300 IN A 34.111.242.115 kagi.com. 300 IN RRSIG ( A 13 2 300 20251205180145 20251205155645 60565 kagi.com. Yf0HzQeDb7NmGvGya45cGFA5do+0XmgqiTjcqETSVzIotPY2rSJnBkFDzPXwBhia3gATnyRjRLHE /XCPMbUyCA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	kagi.com A RR has value 34.111.242.115
	Found 1 RRSIGs over A RRset
	`kagi.com. 300 IN RRSIG ( A 13 2 300 20251205180145 20251205155645 60565 kagi.com. Yf0HzQeDb7NmGvGya45cGFA5do+0XmgqiTjcqETSVzIotPY2rSJnBkFDzPXwBhia3gATnyRjRLHE /XCPMbUyCA== )`
	RRSIG=60565 and DNSKEY=60565 verifies the A RRset

kagi.com

	Query to ns-899.awsdns-48.net for kagi.com/A
	Received 157 bytes from 205.251.195.131
	;; Response received from [205.251.195.131] 157 octets ;; HEADER SECTION ;; id = 11165 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN A ;; ANSWER SECTION (2 records) kagi.com. 300 IN A 34.111.242.115 kagi.com. 300 IN RRSIG ( A 13 2 300 20251205180145 20251205155645 60565 kagi.com. TMX2UJEj/C59mzceYRcClrj9NGBrJnyGBQYHjyxSg9H1xKZW3lBtabyodouXEQp14JgImvjWvYBO OWcLIDpcLQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns-899.awsdns-48.net is authoritative for kagi.com
	Found RRSIG signed by kagi.com zone
	Query to ns-899.awsdns-48.net for kagi.com/A
	Received 157 bytes from 205.251.195.131
	;; Response received from [205.251.195.131] 157 octets ;; HEADER SECTION ;; id = 48305 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN A ;; ANSWER SECTION (2 records) kagi.com. 300 IN A 34.111.242.115 kagi.com. 300 IN RRSIG ( A 13 2 300 20251205180145 20251205155645 60565 kagi.com. dSZYQrmtE7J1jC3TQGK3pbVkEZSDi06z/FMtYSEuVPXZXF8cb7TMrPv2HWexR6opxELb/M0kBTAQ IPNJvGa4Vw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	kagi.com A RR has value 34.111.242.115
	Found 1 RRSIGs over A RRset
	`kagi.com. 300 IN RRSIG ( A 13 2 300 20251205180145 20251205155645 60565 kagi.com. dSZYQrmtE7J1jC3TQGK3pbVkEZSDi06z/FMtYSEuVPXZXF8cb7TMrPv2HWexR6opxELb/M0kBTAQ IPNJvGa4Vw== )`
	RRSIG=60565 and DNSKEY=60565 verifies the A RRset

kagi.com

	Query to ns-1265.awsdns-30.org for kagi.com/A
	Received 157 bytes from 205.251.196.241
	;; Response received from [205.251.196.241] 157 octets ;; HEADER SECTION ;; id = 5039 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN A ;; ANSWER SECTION (2 records) kagi.com. 300 IN A 34.111.242.115 kagi.com. 300 IN RRSIG ( A 13 2 300 20251205180145 20251205155645 60565 kagi.com. +wYbQC+bFTQOoBcEXiSza+9Gg4ThEH8VmFbNAS3mjBEhMa+CXZRVf269F0GJyFum/rs3vhpJaCpC LVm5VuTFPg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns-1265.awsdns-30.org is authoritative for kagi.com
	Found RRSIG signed by kagi.com zone
	Query to ns-1265.awsdns-30.org for kagi.com/A
	Received 157 bytes from 205.251.196.241
	;; Response received from [205.251.196.241] 157 octets ;; HEADER SECTION ;; id = 36235 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN A ;; ANSWER SECTION (2 records) kagi.com. 300 IN A 34.111.242.115 kagi.com. 300 IN RRSIG ( A 13 2 300 20251205180145 20251205155645 60565 kagi.com. XNFEzq02KsMgEH8IvudXKLCMNu1SsFWD4jwAsnWOeE13tIwoFMVbUK774ckNUKUFkPJudMTEfRpx 2IQNn5wPrg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	kagi.com A RR has value 34.111.242.115
	Found 1 RRSIGs over A RRset
	`kagi.com. 300 IN RRSIG ( A 13 2 300 20251205180145 20251205155645 60565 kagi.com. XNFEzq02KsMgEH8IvudXKLCMNu1SsFWD4jwAsnWOeE13tIwoFMVbUK774ckNUKUFkPJudMTEfRpx 2IQNn5wPrg== )`
	RRSIG=60565 and DNSKEY=60565 verifies the A RRset

kagi.com

	Query to ns-1728.awsdns-24.co.uk for kagi.com/A
	Received 157 bytes from 205.251.198.192
	;; Response received from [205.251.198.192] 157 octets ;; HEADER SECTION ;; id = 2547 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN A ;; ANSWER SECTION (2 records) kagi.com. 300 IN A 34.111.242.115 kagi.com. 300 IN RRSIG ( A 13 2 300 20251205180145 20251205155645 60565 kagi.com. UTyMcARoEanf1TIaYv1Y8UG6p45LD+vbkaKaRCmVXqyzeja0RSMbdm7boW9+jsKi+iOism6uyt+6 9vBhSZuKoA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns-1728.awsdns-24.co.uk is authoritative for kagi.com
	Found RRSIG signed by kagi.com zone
	Query to ns-1728.awsdns-24.co.uk for kagi.com/A
	Received 157 bytes from 205.251.198.192
	;; Response received from [205.251.198.192] 157 octets ;; HEADER SECTION ;; id = 44531 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kagi.com. IN A ;; ANSWER SECTION (2 records) kagi.com. 300 IN A 34.111.242.115 kagi.com. 300 IN RRSIG ( A 13 2 300 20251205180145 20251205155645 60565 kagi.com. Nl0gbY9ABmdPifrZxRJPGyzCHSm79+yhLXq0RcXTXMJPoECulYsPpsNWPHMzoxawDXNT8BcOWws6 rPB5xFWzMw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	kagi.com A RR has value 34.111.242.115
	Found 1 RRSIGs over A RRset
	`kagi.com. 300 IN RRSIG ( A 13 2 300 20251205180145 20251205155645 60565 kagi.com. Nl0gbY9ABmdPifrZxRJPGyzCHSm79+yhLXq0RcXTXMJPoECulYsPpsNWPHMzoxawDXNT8BcOWws6 rPB5xFWzMw== )`
	RRSIG=60565 and DNSKEY=60565 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test kagi.com at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: