DNSSEC Debugger

Back to Verisign Labs Tools

Domain Name:

Detail: more(+) / less(-)

Time: 2026-07-21 14:06:14 UTC

Analyzing DNSSEC problems for kg

DS=20326/SHA-256 is now in the chain-of-trust

DS=38696/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	`. IN DS ( 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 )`
	Query to j.root-servers.net for ./DNSKEY
	Received 1139 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 1139 octets ;; HEADER SECTION ;; id = 45541 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAeCYD6Z7WWKVLeuWgowKP+3g+Gs1cnLKq7a3CaQxQpv8bfuFVI0WnG33qaSH/Mw9IBgifrdz f4XY/DQLnyBJ9MfaOyAWuEaEmYJ+GQPiwVVfstGwSA1McfFJUttTgq2Huu74KARhtA8wPo/N3Xcy YQtNhz+qCM5NBb3ecx/naw6sYab9LxS6f2cU0q03++BP5Ks0Uef8WJCa/1izCYE+vMkwoltV+tEN a3hpXiZ7jle/xdgaZrPi5ZGmyLVI34g1XVYrNlsCCTmNvFQIfzW5STFQFsQpizczyFn9r3LzSxxP CNwdlCG84bER0BmdwqbF6Tanv+FxMOavrahkj4wIy5k= ) ; keytag 57780 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20260811000000 20260721000000 20326 . KRNkneCiUAW/3xsn8/6VDpfjYsXUrh19hqxVi2TRYnqbNa9N/fwN0Z/JgTGfigaY6KKSFgTZGZsi ilMiPVdHOirETIVs37XWU6L+dskCttC2rHUShOxnf0lLzy2rFJbolkd3aB5FpbprKmURCyeW/Na/ wtrSCo1kArBAIOGZLHNvDOVKL/MDIAkZJQ6EbfLxY8wkd4Rp93T5sAUyBaSlRpkqDyujUuz/0lCB eApRp0wMGQGC5+3//rdv16be3O5+oi124vJqlskvDw/jIsq3GY2jNjnWBwu7bFeOWHahBsZNROj0 fKTkCYgtWKZfwFp0bwc20chK6hHxPskKEB+AFw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAeCYD6Z7WWKVLeuWgowKP+3g+Gs1cnLKq7a3CaQxQpv8bfuFVI0WnG33qaSH/Mw9IBgifrdz f4XY/DQLnyBJ9MfaOyAWuEaEmYJ+GQPiwVVfstGwSA1McfFJUttTgq2Huu74KARhtA8wPo/N3Xcy YQtNhz+qCM5NBb3ecx/naw6sYab9LxS6f2cU0q03++BP5Ks0Uef8WJCa/1izCYE+vMkwoltV+tEN a3hpXiZ7jle/xdgaZrPi5ZGmyLVI34g1XVYrNlsCCTmNvFQIfzW5STFQFsQpizczyFn9r3LzSxxP CNwdlCG84bER0BmdwqbF6Tanv+FxMOavrahkj4wIy5k= ) ; keytag 57780`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	DNSKEY=38696/SEP is now in the chain-of-trust
	DS=38696/SHA-256 verifies DNSKEY=38696/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20260811000000 20260721000000 20326 . KRNkneCiUAW/3xsn8/6VDpfjYsXUrh19hqxVi2TRYnqbNa9N/fwN0Z/JgTGfigaY6KKSFgTZGZsi ilMiPVdHOirETIVs37XWU6L+dskCttC2rHUShOxnf0lLzy2rFJbolkd3aB5FpbprKmURCyeW/Na/ wtrSCo1kArBAIOGZLHNvDOVKL/MDIAkZJQ6EbfLxY8wkd4Rp93T5sAUyBaSlRpkqDyujUuz/0lCB eApRp0wMGQGC5+3//rdv16be3O5+oi124vJqlskvDw/jIsq3GY2jNjnWBwu7bFeOWHahBsZNROj0 fKTkCYgtWKZfwFp0bwc20chK6hHxPskKEB+AFw== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=57780 is now in the chain-of-trust
	Query to m.root-servers.net for kg/A
	Received 572 bytes from 202.12.27.33
	;; Response received from [202.12.27.33] 572 octets ;; HEADER SECTION ;; id = 51033 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 5 arcount = 7 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kg. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (5 records) kg. 172800 IN NS ns2.kg. kg. 172800 IN NS kg.cctld.authdns.ripe.net. kg. 172800 IN NS ns.kg. kg. 86400 IN DS ( 45982 8 2 d642af8c9bb761e035ce77a48750bbaa64b41cfa0799d8d94498cfa335fa1380 ) kg. 86400 IN RRSIG ( DS 8 1 86400 20260803050000 20260721040000 57780 . El+xv+vzRb5VpH/wKUxiJiXOtDKpsB8E24cg8hXkABpRh54ZPk5GrmHATOysCx69E8m4+OzUIL9d FBh1xK57JN0oQxbaxV8t1ABmK4vBCO21xafI2F+zcffXjbB41OrkUomnNw9VrOK+JENpsxBtrLxl Z8HJIOK+sqCkHKL0h0B3D9M/aX5p561FpAzfM+5pAHaBVSxOchCQQsIIHYynzJxXDn5Dc8c4W1JS pBM3tP3CGAyf4Cy7EzKrUhVNkPFgElJsz1F3LR0H7p93kKpuKJanRV0JlVauDiq212Oz6iSFlxtW bS13YA2HltVA96axtF9pmr+hoHtEh61E5m2TLg== ) ;; ADDITIONAL SECTION (7 records) ns2.kg. 172800 IN A 195.38.160.38 ns.kg. 172800 IN A 195.38.160.36 kg.cctld.authdns.ripe.net. 172800 IN A 193.0.9.84 ns2.kg. 172800 IN AAAA 2a11:a380::195:38:160:38 ns.kg. 172800 IN AAAA 2a11:a380::195:38:160:36 kg.cctld.authdns.ripe.net. 172800 IN AAAA 2a13:27c0:30::84 ;; { "EDNS-VERSION": 0 }
	Query to b.root-servers.net for kg/DNSKEY
	Received 574 bytes from 170.247.170.2
	;; Response received from [170.247.170.2] 574 octets ;; HEADER SECTION ;; id = 1980 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 5 arcount = 7 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kg. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (5 records) kg. 172800 IN NS kg.cctld.authdns.ripe.net. kg. 172800 IN NS ns.kg. kg. 172800 IN NS ns2.kg. kg. 86400 IN DS ( 45982 8 2 d642af8c9bb761e035ce77a48750bbaa64b41cfa0799d8d94498cfa335fa1380 ) kg. 86400 IN RRSIG ( DS 8 1 86400 20260803050000 20260721040000 57780 . El+xv+vzRb5VpH/wKUxiJiXOtDKpsB8E24cg8hXkABpRh54ZPk5GrmHATOysCx69E8m4+OzUIL9d FBh1xK57JN0oQxbaxV8t1ABmK4vBCO21xafI2F+zcffXjbB41OrkUomnNw9VrOK+JENpsxBtrLxl Z8HJIOK+sqCkHKL0h0B3D9M/aX5p561FpAzfM+5pAHaBVSxOchCQQsIIHYynzJxXDn5Dc8c4W1JS pBM3tP3CGAyf4Cy7EzKrUhVNkPFgElJsz1F3LR0H7p93kKpuKJanRV0JlVauDiq212Oz6iSFlxtW bS13YA2HltVA96axtF9pmr+hoHtEh61E5m2TLg== ) ;; ADDITIONAL SECTION (7 records) ns.kg. 172800 IN A 195.38.160.36 ns.kg. 172800 IN AAAA 2a11:a380::195:38:160:36 ns2.kg. 172800 IN A 195.38.160.38 ns2.kg. 172800 IN AAAA 2a11:a380::195:38:160:38 kg.cctld.authdns.ripe.net. 172800 IN A 193.0.9.84 kg.cctld.authdns.ripe.net. 172800 IN AAAA 2a13:27c0:30::84 ;; { "EDNS-VERSION": 0 }
	Found child zone kg

	Checking DS between . and kg
	Query to m.root-servers.net for kg/DS
	Received 366 bytes from 202.12.27.33
	;; Response received from [202.12.27.33] 366 octets ;; HEADER SECTION ;; id = 45817 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kg. IN DS ;; ANSWER SECTION (2 records) kg. 86400 IN DS ( 45982 8 2 d642af8c9bb761e035ce77a48750bbaa64b41cfa0799d8d94498cfa335fa1380 ) kg. 86400 IN RRSIG ( DS 8 1 86400 20260803050000 20260721040000 57780 . El+xv+vzRb5VpH/wKUxiJiXOtDKpsB8E24cg8hXkABpRh54ZPk5GrmHATOysCx69E8m4+OzUIL9d FBh1xK57JN0oQxbaxV8t1ABmK4vBCO21xafI2F+zcffXjbB41OrkUomnNw9VrOK+JENpsxBtrLxl Z8HJIOK+sqCkHKL0h0B3D9M/aX5p561FpAzfM+5pAHaBVSxOchCQQsIIHYynzJxXDn5Dc8c4W1JS pBM3tP3CGAyf4Cy7EzKrUhVNkPFgElJsz1F3LR0H7p93kKpuKJanRV0JlVauDiq212Oz6iSFlxtW bS13YA2HltVA96axtF9pmr+hoHtEh61E5m2TLg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for kg in the . zone
	DS=45982/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`kg. 86400 IN RRSIG ( DS 8 1 86400 20260803050000 20260721040000 57780 . El+xv+vzRb5VpH/wKUxiJiXOtDKpsB8E24cg8hXkABpRh54ZPk5GrmHATOysCx69E8m4+OzUIL9d FBh1xK57JN0oQxbaxV8t1ABmK4vBCO21xafI2F+zcffXjbB41OrkUomnNw9VrOK+JENpsxBtrLxl Z8HJIOK+sqCkHKL0h0B3D9M/aX5p561FpAzfM+5pAHaBVSxOchCQQsIIHYynzJxXDn5Dc8c4W1JS pBM3tP3CGAyf4Cy7EzKrUhVNkPFgElJsz1F3LR0H7p93kKpuKJanRV0JlVauDiq212Oz6iSFlxtW bS13YA2HltVA96axtF9pmr+hoHtEh61E5m2TLg== )`
	RRSIG=57780 and DNSKEY=57780 verifies the DS RRset
	DS=45982/SHA-256 is now in the chain-of-trust
	`kg. 86400 IN DS ( 45982 8 2 d642af8c9bb761e035ce77a48750bbaa64b41cfa0799d8d94498cfa335fa1380 )`
	Query to ns.kg for kg/DNSKEY
	Received 873 bytes from 195.38.160.36
	;; Response received from [195.38.160.36] 873 octets ;; HEADER SECTION ;; id = 23319 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kg. IN DNSKEY ;; ANSWER SECTION (3 records) kg. 86400 IN DNSKEY ( 256 3 8 AwEAAZUDpMl27G13MvOzhdArl23nz5pXHYVxVf0V6p+DhGu57KF2BWjOj3ea71lPbwJjsNRZ049b gV3kizwm06i/JIHgBUJf2m4BUN/OB3/7H2YQyoa5nOmqH0uDDe4ZBEocKDSwhy80tBdAyd9fDyQW 8iBMYEw6YruC51laxL15wSUEpuVy/grLRXEETqE3pk/C/W2gbJqyGptuCCFGu0WQDbcHnbWHT2lj CX3KM7DzXUEisWB1WfPf2/CozyZ4Z0a0pnC+fz5WKuZAz3GTxWyxpPJsnpu5ECiZEktN7w8W96+b YHX3cF1RiX4bMGpuvJQU5KpqEfKGINsejb8Y2KMC/aM= ) ; keytag 3529 kg. 86400 IN RRSIG ( DNSKEY 8 1 86400 20260730000000 20260709000000 45982 kg. v0kfWtYW2c2dQqy7ORHVtcmgWP5S4qoJDg76ID9hMpWWeQgsEXUgNGDa/hHTv/3KGINI9OVqDRGF 9F+ClK9C4S4G8Rf8e3hLHLo7IBBw59+wJ7CJY/UWM1ZPgUX9dBAJT0pS9nDW/fz5CUXo3c2UwOL1 7s2NxCi0/IZD41n22KtJYmZkSyPbtsJEgJnkbikto3DkccVg1tIYWdZyMcU36eth4gNa2qNgFQ+g 3zDieMJJI4AvvfwzJp29b/MkPOcDU2CVs9wr+t5G8rgmuDDyNKpDNC8WU/ub5roJ2oVtzD5SnS4I DW8Ax3aMdQnbUVKcivXnBL14raFF91A8M32ZAg== ) kg. 86400 IN DNSKEY ( 257 3 8 AwEAAebLPAhyONUrCidoxPKNSIilh4YcvqDuP+JJHsMikVAiIlRMhIJWnuZ/l/BUKtW9G8JNZKAI BoDA9EhJRfFwx8bGfjn4RYd/tSgtQcelaj/HVbf/eK+f1gSMtzxc5so+Mx5lCx2auEPV3uDEn0k7 rnApJ/fstlxcXenW6aA1uY///W1Bv3PMvbui7y4pdF1cJY1W/rOgNpO4rnxu75xH5Yvnh11WWOiL j+NoZELNFW6QIWT28IWRaNquDAjyqLKiGf7YIPFpZQ+q+PZDQwI+jf5njD/km1YeaLlGn7YaBR5w Tu6WMvuZKkrWTZPjxvH/5Bx0Jy6YljCW/HA9xWKqBz0= ) ; keytag 45982 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for kg
	`kg. 86400 IN DNSKEY ( 256 3 8 AwEAAZUDpMl27G13MvOzhdArl23nz5pXHYVxVf0V6p+DhGu57KF2BWjOj3ea71lPbwJjsNRZ049b gV3kizwm06i/JIHgBUJf2m4BUN/OB3/7H2YQyoa5nOmqH0uDDe4ZBEocKDSwhy80tBdAyd9fDyQW 8iBMYEw6YruC51laxL15wSUEpuVy/grLRXEETqE3pk/C/W2gbJqyGptuCCFGu0WQDbcHnbWHT2lj CX3KM7DzXUEisWB1WfPf2/CozyZ4Z0a0pnC+fz5WKuZAz3GTxWyxpPJsnpu5ECiZEktN7w8W96+b YHX3cF1RiX4bMGpuvJQU5KpqEfKGINsejb8Y2KMC/aM= ) ; keytag 3529`
	`kg. 86400 IN DNSKEY ( 257 3 8 AwEAAebLPAhyONUrCidoxPKNSIilh4YcvqDuP+JJHsMikVAiIlRMhIJWnuZ/l/BUKtW9G8JNZKAI BoDA9EhJRfFwx8bGfjn4RYd/tSgtQcelaj/HVbf/eK+f1gSMtzxc5so+Mx5lCx2auEPV3uDEn0k7 rnApJ/fstlxcXenW6aA1uY///W1Bv3PMvbui7y4pdF1cJY1W/rOgNpO4rnxu75xH5Yvnh11WWOiL j+NoZELNFW6QIWT28IWRaNquDAjyqLKiGf7YIPFpZQ+q+PZDQwI+jf5njD/km1YeaLlGn7YaBR5w Tu6WMvuZKkrWTZPjxvH/5Bx0Jy6YljCW/HA9xWKqBz0= ) ; keytag 45982`
	DNSKEY=45982/SEP is now in the chain-of-trust
	DS=45982/SHA-256 verifies DNSKEY=45982/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`kg. 86400 IN RRSIG ( DNSKEY 8 1 86400 20260730000000 20260709000000 45982 kg. v0kfWtYW2c2dQqy7ORHVtcmgWP5S4qoJDg76ID9hMpWWeQgsEXUgNGDa/hHTv/3KGINI9OVqDRGF 9F+ClK9C4S4G8Rf8e3hLHLo7IBBw59+wJ7CJY/UWM1ZPgUX9dBAJT0pS9nDW/fz5CUXo3c2UwOL1 7s2NxCi0/IZD41n22KtJYmZkSyPbtsJEgJnkbikto3DkccVg1tIYWdZyMcU36eth4gNa2qNgFQ+g 3zDieMJJI4AvvfwzJp29b/MkPOcDU2CVs9wr+t5G8rgmuDDyNKpDNC8WU/ub5roJ2oVtzD5SnS4I DW8Ax3aMdQnbUVKcivXnBL14raFF91A8M32ZAg== )`
	RRSIG=45982 and DNSKEY=45982/SEP verifies the DNSKEY RRset
	DNSKEY=3529 is now in the chain-of-trust
	Query to ns.kg for kg/A
	Received 689 bytes from 195.38.160.36
	;; Response received from [195.38.160.36] 689 octets ;; HEADER SECTION ;; id = 29001 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kg. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) kg. 1800 IN SOA ( ns.kg. adm.infotel.kg. 1784642400 ;serial 1800 ;refresh 600 ;retry 604800 ;expire 86400 ;minimum ) kg. 1800 IN RRSIG ( SOA 8 1 1800 20260730000000 20260709000000 3529 kg. JRby6u918Q767EnyGQjViH9S5lfkArkBON9gHgbupBNiglFmLE/vtv5Kf2NbnpV9imTeDs66Gecu Us8ZunSQZ98tEvCFTjKuHnTyrlylWqNq1p/KgPReKR+WwYZPU+xOfTX6acjRbDp/hhy3UIaWXu7E Y4WxLLBBR4vgxUmCFFGq2VqiBvdWfpOiDI6cVS3baTYlB+3PRcs/Kijee1Z9rRlpj+EMf7IE5m6D E607QlH4BniTaru0GKH5VgjFJq4p3JrRs0Xse/rH3TVNQyDNG8FmZBwmjgT97rM5fV3AQLC8b4IQ a/SaG3pNz3m3mSTEAkaqNDcEKi1LrE5wkCcgbw== ) kg. 1800 IN NSEC 0.kg. NS SOA RRSIG NSEC DNSKEY kg. 1800 IN RRSIG ( NSEC 8 1 1800 20260730000000 20260709000000 3529 kg. RySPbM9vZ5H8K9hgp9hxNlX401SqNXIhB8BQpoFvNFFr63c2wDBoet0yUsQeUra9azLUkXExkhV+ n9IXtHMurZtUNIkMfxV0vXg5//dVzdA5BsOIhnH6G8pQ+gSREeXRk9iGjLXI8M1L5sXQJy3YRvxT MjFRpPGS4Msu1vDSDIx56dReSvOZ50wYwWIQ/oHaStblibNKruMnfg2aWs9f/vQQ5iS3WDhmC1tn S63uvChyT+GebzqrJEnNBjkokrGU1ndrQBhzGOrobxtqgrKIOet2yPH9mTfBev8KLttniwWDddEX nTbgV1lzhEJ83Fu1YIG2yQmVLJ2ns4byZx0Q1w== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns.kg is authoritative for kg
	Found RRSIG signed by kg zone
	Query to kg.cctld.authdns.ripe.net for kg/SOA
	Received 372 bytes from 193.0.9.84
	;; Response received from [193.0.9.84] 372 octets ;; HEADER SECTION ;; id = 557 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kg. IN SOA ;; ANSWER SECTION (2 records) kg. 1800 IN SOA ( ns.kg. adm.infotel.kg. 1784640600 ;serial 1800 ;refresh 600 ;retry 604800 ;expire 86400 ;minimum ) kg. 1800 IN RRSIG ( SOA 8 1 1800 20260730000000 20260709000000 3529 kg. evri/rRlz9b9RsNci9FBPKlTD3l6MuBfJgGXB3TNsL19ZZGxHozLYqSnFbk8Wx556Go2VRfLSeHG AmbpNI8R0jTWUahis048fRVQ1GVJAsxWupJdULCBsML+4AJhIH7mIr4rV4WleF6c+nnJcVrdZ/Mv QTn8DRNral1OeTBZpCUwGlyhS+o2lpBqcNctGzJmLsDaFEmoU8H3k5yVweLby+u//ALvUayQp9B2 y+4i0tO+/X4T9Qikkly+SX2243O3NuJ1vRbVVweTl0wHXwNCTae00oCi0bApvkyEUhVRlckRtpBG S03OGibUMxDptMGLj6lqQOWR9BhrxCE2+3zzCg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns2.kg for kg/SOA
	Received 372 bytes from 195.38.160.38
	;; Response received from [195.38.160.38] 372 octets ;; HEADER SECTION ;; id = 53947 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kg. IN SOA ;; ANSWER SECTION (2 records) kg. 1800 IN SOA ( ns.kg. adm.infotel.kg. 1784640600 ;serial 1800 ;refresh 600 ;retry 604800 ;expire 86400 ;minimum ) kg. 1800 IN RRSIG ( SOA 8 1 1800 20260730000000 20260709000000 3529 kg. evri/rRlz9b9RsNci9FBPKlTD3l6MuBfJgGXB3TNsL19ZZGxHozLYqSnFbk8Wx556Go2VRfLSeHG AmbpNI8R0jTWUahis048fRVQ1GVJAsxWupJdULCBsML+4AJhIH7mIr4rV4WleF6c+nnJcVrdZ/Mv QTn8DRNral1OeTBZpCUwGlyhS+o2lpBqcNctGzJmLsDaFEmoU8H3k5yVweLby+u//ALvUayQp9B2 y+4i0tO+/X4T9Qikkly+SX2243O3NuJ1vRbVVweTl0wHXwNCTae00oCi0bApvkyEUhVRlckRtpBG S03OGibUMxDptMGLj6lqQOWR9BhrxCE2+3zzCg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns.kg for kg/A
	Checking NSEC records for a NODATA response
	Found 1 RRSIGs over NSEC RRset
	`kg. 1800 IN RRSIG ( NSEC 8 1 1800 20260730000000 20260709000000 3529 kg. RySPbM9vZ5H8K9hgp9hxNlX401SqNXIhB8BQpoFvNFFr63c2wDBoet0yUsQeUra9azLUkXExkhV+ n9IXtHMurZtUNIkMfxV0vXg5//dVzdA5BsOIhnH6G8pQ+gSREeXRk9iGjLXI8M1L5sXQJy3YRvxT MjFRpPGS4Msu1vDSDIx56dReSvOZ50wYwWIQ/oHaStblibNKruMnfg2aWs9f/vQQ5iS3WDhmC1tn S63uvChyT+GebzqrJEnNBjkokrGU1ndrQBhzGOrobxtqgrKIOet2yPH9mTfBev8KLttniwWDddEX nTbgV1lzhEJ83Fu1YIG2yQmVLJ2ns4byZx0Q1w== )`
	RRSIG=3529 and DNSKEY=3529 verifies the NSEC RRset
	NSEC proves no records of type A exist for kg
	Found 1 RRSIGs over SOA RRset
	`kg. 1800 IN RRSIG ( SOA 8 1 1800 20260730000000 20260709000000 3529 kg. JRby6u918Q767EnyGQjViH9S5lfkArkBON9gHgbupBNiglFmLE/vtv5Kf2NbnpV9imTeDs66Gecu Us8ZunSQZ98tEvCFTjKuHnTyrlylWqNq1p/KgPReKR+WwYZPU+xOfTX6acjRbDp/hhy3UIaWXu7E Y4WxLLBBR4vgxUmCFFGq2VqiBvdWfpOiDI6cVS3baTYlB+3PRcs/Kijee1Z9rRlpj+EMf7IE5m6D E607QlH4BniTaru0GKH5VgjFJq4p3JrRs0Xse/rH3TVNQyDNG8FmZBwmjgT97rM5fV3AQLC8b4IQ a/SaG3pNz3m3mSTEAkaqNDcEKi1LrE5wkCcgbw== )`
	RRSIG=3529 and DNSKEY=3529 verifies the SOA RRset

	Query to ns2.kg for kg/A
	Received 689 bytes from 195.38.160.38
	;; Response received from [195.38.160.38] 689 octets ;; HEADER SECTION ;; id = 1430 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kg. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) kg. 1800 IN SOA ( ns.kg. adm.infotel.kg. 1784640600 ;serial 1800 ;refresh 600 ;retry 604800 ;expire 86400 ;minimum ) kg. 1800 IN RRSIG ( SOA 8 1 1800 20260730000000 20260709000000 3529 kg. evri/rRlz9b9RsNci9FBPKlTD3l6MuBfJgGXB3TNsL19ZZGxHozLYqSnFbk8Wx556Go2VRfLSeHG AmbpNI8R0jTWUahis048fRVQ1GVJAsxWupJdULCBsML+4AJhIH7mIr4rV4WleF6c+nnJcVrdZ/Mv QTn8DRNral1OeTBZpCUwGlyhS+o2lpBqcNctGzJmLsDaFEmoU8H3k5yVweLby+u//ALvUayQp9B2 y+4i0tO+/X4T9Qikkly+SX2243O3NuJ1vRbVVweTl0wHXwNCTae00oCi0bApvkyEUhVRlckRtpBG S03OGibUMxDptMGLj6lqQOWR9BhrxCE2+3zzCg== ) kg. 1800 IN NSEC 0.kg. NS SOA RRSIG NSEC DNSKEY kg. 1800 IN RRSIG ( NSEC 8 1 1800 20260730000000 20260709000000 3529 kg. RySPbM9vZ5H8K9hgp9hxNlX401SqNXIhB8BQpoFvNFFr63c2wDBoet0yUsQeUra9azLUkXExkhV+ n9IXtHMurZtUNIkMfxV0vXg5//dVzdA5BsOIhnH6G8pQ+gSREeXRk9iGjLXI8M1L5sXQJy3YRvxT MjFRpPGS4Msu1vDSDIx56dReSvOZ50wYwWIQ/oHaStblibNKruMnfg2aWs9f/vQQ5iS3WDhmC1tn S63uvChyT+GebzqrJEnNBjkokrGU1ndrQBhzGOrobxtqgrKIOet2yPH9mTfBev8KLttniwWDddEX nTbgV1lzhEJ83Fu1YIG2yQmVLJ2ns4byZx0Q1w== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns2.kg is authoritative for kg
	Found RRSIG signed by kg zone
	Query to ns2.kg for kg/A
	Checking NSEC records for a NODATA response
	Found 1 RRSIGs over NSEC RRset
	`kg. 1800 IN RRSIG ( NSEC 8 1 1800 20260730000000 20260709000000 3529 kg. RySPbM9vZ5H8K9hgp9hxNlX401SqNXIhB8BQpoFvNFFr63c2wDBoet0yUsQeUra9azLUkXExkhV+ n9IXtHMurZtUNIkMfxV0vXg5//dVzdA5BsOIhnH6G8pQ+gSREeXRk9iGjLXI8M1L5sXQJy3YRvxT MjFRpPGS4Msu1vDSDIx56dReSvOZ50wYwWIQ/oHaStblibNKruMnfg2aWs9f/vQQ5iS3WDhmC1tn S63uvChyT+GebzqrJEnNBjkokrGU1ndrQBhzGOrobxtqgrKIOet2yPH9mTfBev8KLttniwWDddEX nTbgV1lzhEJ83Fu1YIG2yQmVLJ2ns4byZx0Q1w== )`
	RRSIG=3529 and DNSKEY=3529 verifies the NSEC RRset
	NSEC proves no records of type A exist for kg
	Found 1 RRSIGs over SOA RRset
	`kg. 1800 IN RRSIG ( SOA 8 1 1800 20260730000000 20260709000000 3529 kg. evri/rRlz9b9RsNci9FBPKlTD3l6MuBfJgGXB3TNsL19ZZGxHozLYqSnFbk8Wx556Go2VRfLSeHG AmbpNI8R0jTWUahis048fRVQ1GVJAsxWupJdULCBsML+4AJhIH7mIr4rV4WleF6c+nnJcVrdZ/Mv QTn8DRNral1OeTBZpCUwGlyhS+o2lpBqcNctGzJmLsDaFEmoU8H3k5yVweLby+u//ALvUayQp9B2 y+4i0tO+/X4T9Qikkly+SX2243O3NuJ1vRbVVweTl0wHXwNCTae00oCi0bApvkyEUhVRlckRtpBG S03OGibUMxDptMGLj6lqQOWR9BhrxCE2+3zzCg== )`
	RRSIG=3529 and DNSKEY=3529 verifies the SOA RRset

	Query to kg.cctld.authdns.ripe.net for kg/A
	Received 689 bytes from 193.0.9.84
	;; Response received from [193.0.9.84] 689 octets ;; HEADER SECTION ;; id = 39140 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; kg. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) kg. 1800 IN SOA ( ns.kg. adm.infotel.kg. 1784640600 ;serial 1800 ;refresh 600 ;retry 604800 ;expire 86400 ;minimum ) kg. 1800 IN RRSIG ( SOA 8 1 1800 20260730000000 20260709000000 3529 kg. evri/rRlz9b9RsNci9FBPKlTD3l6MuBfJgGXB3TNsL19ZZGxHozLYqSnFbk8Wx556Go2VRfLSeHG AmbpNI8R0jTWUahis048fRVQ1GVJAsxWupJdULCBsML+4AJhIH7mIr4rV4WleF6c+nnJcVrdZ/Mv QTn8DRNral1OeTBZpCUwGlyhS+o2lpBqcNctGzJmLsDaFEmoU8H3k5yVweLby+u//ALvUayQp9B2 y+4i0tO+/X4T9Qikkly+SX2243O3NuJ1vRbVVweTl0wHXwNCTae00oCi0bApvkyEUhVRlckRtpBG S03OGibUMxDptMGLj6lqQOWR9BhrxCE2+3zzCg== ) kg. 1800 IN NSEC 0.kg. NS SOA RRSIG NSEC DNSKEY kg. 1800 IN RRSIG ( NSEC 8 1 1800 20260730000000 20260709000000 3529 kg. RySPbM9vZ5H8K9hgp9hxNlX401SqNXIhB8BQpoFvNFFr63c2wDBoet0yUsQeUra9azLUkXExkhV+ n9IXtHMurZtUNIkMfxV0vXg5//dVzdA5BsOIhnH6G8pQ+gSREeXRk9iGjLXI8M1L5sXQJy3YRvxT MjFRpPGS4Msu1vDSDIx56dReSvOZ50wYwWIQ/oHaStblibNKruMnfg2aWs9f/vQQ5iS3WDhmC1tn S63uvChyT+GebzqrJEnNBjkokrGU1ndrQBhzGOrobxtqgrKIOet2yPH9mTfBev8KLttniwWDddEX nTbgV1lzhEJ83Fu1YIG2yQmVLJ2ns4byZx0Q1w== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	kg.cctld.authdns.ripe.net is authoritative for kg
	Found RRSIG signed by kg zone
	Query to kg.cctld.authdns.ripe.net for kg/A
	Checking NSEC records for a NODATA response
	Found 1 RRSIGs over NSEC RRset
	`kg. 1800 IN RRSIG ( NSEC 8 1 1800 20260730000000 20260709000000 3529 kg. RySPbM9vZ5H8K9hgp9hxNlX401SqNXIhB8BQpoFvNFFr63c2wDBoet0yUsQeUra9azLUkXExkhV+ n9IXtHMurZtUNIkMfxV0vXg5//dVzdA5BsOIhnH6G8pQ+gSREeXRk9iGjLXI8M1L5sXQJy3YRvxT MjFRpPGS4Msu1vDSDIx56dReSvOZ50wYwWIQ/oHaStblibNKruMnfg2aWs9f/vQQ5iS3WDhmC1tn S63uvChyT+GebzqrJEnNBjkokrGU1ndrQBhzGOrobxtqgrKIOet2yPH9mTfBev8KLttniwWDddEX nTbgV1lzhEJ83Fu1YIG2yQmVLJ2ns4byZx0Q1w== )`
	RRSIG=3529 and DNSKEY=3529 verifies the NSEC RRset
	NSEC proves no records of type A exist for kg
	Found 1 RRSIGs over SOA RRset
	`kg. 1800 IN RRSIG ( SOA 8 1 1800 20260730000000 20260709000000 3529 kg. evri/rRlz9b9RsNci9FBPKlTD3l6MuBfJgGXB3TNsL19ZZGxHozLYqSnFbk8Wx556Go2VRfLSeHG AmbpNI8R0jTWUahis048fRVQ1GVJAsxWupJdULCBsML+4AJhIH7mIr4rV4WleF6c+nnJcVrdZ/Mv QTn8DRNral1OeTBZpCUwGlyhS+o2lpBqcNctGzJmLsDaFEmoU8H3k5yVweLby+u//ALvUayQp9B2 y+4i0tO+/X4T9Qikkly+SX2243O3NuJ1vRbVVweTl0wHXwNCTae00oCi0bApvkyEUhVRlckRtpBG S03OGibUMxDptMGLj6lqQOWR9BhrxCE2+3zzCg== )`
	RRSIG=3529 and DNSKEY=3529 verifies the SOA RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test kg at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: