DNSSEC Debugger

Back to Verisign Labs Tools

Domain Name:

Detail: more(+) / less(-)

Time: 2026-10-02 10:56:40 UTC

Analyzing DNSSEC problems for mail.ch

DS=20326/SHA-256 is now in the chain-of-trust

DS=38696/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	`. IN DS ( 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 )`
	Query to c.root-servers.net for ./DNSKEY
	Received 1414 bytes from 192.33.4.12
	;; Response received from [192.33.4.12] 1414 octets ;; HEADER SECTION ;; id = 4938 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 5 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (5 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAeCYD6Z7WWKVLeuWgowKP+3g+Gs1cnLKq7a3CaQxQpv8bfuFVI0WnG33qaSH/Mw9IBgifrdz f4XY/DQLnyBJ9MfaOyAWuEaEmYJ+GQPiwVVfstGwSA1McfFJUttTgq2Huu74KARhtA8wPo/N3Xcy YQtNhz+qCM5NBb3ecx/naw6sYab9LxS6f2cU0q03++BP5Ks0Uef8WJCa/1izCYE+vMkwoltV+tEN a3hpXiZ7jle/xdgaZrPi5ZGmyLVI34g1XVYrNlsCCTmNvFQIfzW5STFQFsQpizczyFn9r3LzSxxP CNwdlCG84bER0BmdwqbF6Tanv+FxMOavrahkj4wIy5k= ) ; keytag 57780 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN DNSKEY ( 256 3 8 AwEAAcorNxNc9t0ue1ZenPjVMRujlQ2YLBJ0pR/4XMjHby9vr03cRxFSKnWpxeg5PL384D9VeqdS 1bjrGyTsHtoagzI3NiXFd8sjHMOnZxu5pp/+UBIg7tasYgVMMdUiM1Yu/c+t30d1Qw/v6NYLNnOn ywTu6HuUh7Y1sZRq/GZcrxLENXHQoyKpOrOr8R3+qd6wK69IKB80ZBZtkX9rdEqKJk+yYXjEZzZ0 zkAFthmNgCreAoU9PVlU66dyOsaLjf3wKUlUm9SNOKs+tK6LuSmRbK6+1T/tPaRaMBSEuv2G6vXf nJ1uyMbGvtpRn/YDcvTjrp6DzE6XyF44QdwJ3oKx4ek= ) ; keytag 8763 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20261022000000 20261001000000 20326 . ARGOmBDyLkr5oQdR5OaIeoeBti1KWEX/LY/jZlRRXwF0f0eRZaljFpyVKFuZMzpafSYVs7eLOYjV yWJ3iENn4AEhvX9iaKmWu3XpSSV0D6bhv5D6bk4GVPJ7NGTnA2lr4fC9lq9UD1kK1Q3jYJsxZSoQ gjExDBfzwQUw1eYLLPPi7TQf+zA1wakHy2mkWnX1+bKDyrQ/p5ra4fgo/Pu7F47FXqRZEJ+K9o/T wA+nJn3RMS6dPaS46ERBSWHIeJAzQvNQELI4pAbdVp3d3N33R2C5MxX6kUzNku8CtyXGYukSi9LK 9GT3nrH9O97tDADq01z78aPnjl+6hLTgMkiupw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 4 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAeCYD6Z7WWKVLeuWgowKP+3g+Gs1cnLKq7a3CaQxQpv8bfuFVI0WnG33qaSH/Mw9IBgifrdz f4XY/DQLnyBJ9MfaOyAWuEaEmYJ+GQPiwVVfstGwSA1McfFJUttTgq2Huu74KARhtA8wPo/N3Xcy YQtNhz+qCM5NBb3ecx/naw6sYab9LxS6f2cU0q03++BP5Ks0Uef8WJCa/1izCYE+vMkwoltV+tEN a3hpXiZ7jle/xdgaZrPi5ZGmyLVI34g1XVYrNlsCCTmNvFQIfzW5STFQFsQpizczyFn9r3LzSxxP CNwdlCG84bER0BmdwqbF6Tanv+FxMOavrahkj4wIy5k= ) ; keytag 57780`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAcorNxNc9t0ue1ZenPjVMRujlQ2YLBJ0pR/4XMjHby9vr03cRxFSKnWpxeg5PL384D9VeqdS 1bjrGyTsHtoagzI3NiXFd8sjHMOnZxu5pp/+UBIg7tasYgVMMdUiM1Yu/c+t30d1Qw/v6NYLNnOn ywTu6HuUh7Y1sZRq/GZcrxLENXHQoyKpOrOr8R3+qd6wK69IKB80ZBZtkX9rdEqKJk+yYXjEZzZ0 zkAFthmNgCreAoU9PVlU66dyOsaLjf3wKUlUm9SNOKs+tK6LuSmRbK6+1T/tPaRaMBSEuv2G6vXf nJ1uyMbGvtpRn/YDcvTjrp6DzE6XyF44QdwJ3oKx4ek= ) ; keytag 8763`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	DNSKEY=38696/SEP is now in the chain-of-trust
	DS=38696/SHA-256 verifies DNSKEY=38696/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20261022000000 20261001000000 20326 . ARGOmBDyLkr5oQdR5OaIeoeBti1KWEX/LY/jZlRRXwF0f0eRZaljFpyVKFuZMzpafSYVs7eLOYjV yWJ3iENn4AEhvX9iaKmWu3XpSSV0D6bhv5D6bk4GVPJ7NGTnA2lr4fC9lq9UD1kK1Q3jYJsxZSoQ gjExDBfzwQUw1eYLLPPi7TQf+zA1wakHy2mkWnX1+bKDyrQ/p5ra4fgo/Pu7F47FXqRZEJ+K9o/T wA+nJn3RMS6dPaS46ERBSWHIeJAzQvNQELI4pAbdVp3d3N33R2C5MxX6kUzNku8CtyXGYukSi9LK 9GT3nrH9O97tDADq01z78aPnjl+6hLTgMkiupw== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=57780 is now in the chain-of-trust
	DNSKEY=8763 is now in the chain-of-trust
	Query to k.root-servers.net for mail.ch/A
	Received 675 bytes from 193.0.14.129
	;; Response received from [193.0.14.129] 675 octets ;; HEADER SECTION ;; id = 35498 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 11 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mail.ch. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) ch. 172800 IN NS a.nic.ch. ch. 172800 IN NS b.nic.ch. ch. 172800 IN NS d.nic.ch. ch. 172800 IN NS e.nic.ch. ch. 172800 IN NS f.nic.ch. ch. 86400 IN DS ( 58745 13 2 083ed7735a6aad21d51cb0af5c485055602b392435e92b2c13614a6bc8d46b92 ) ch. 86400 IN RRSIG ( DS 8 1 86400 20261015050000 20261002040000 8763 . MAdSmBx8zGUA7OSAhzlej/Bdqz9XRy5OWA2Xookcl6jzzirTRcaBve0uV+bmabRxaVkRiBDF8JU9 0YV1VLD7g9EoLrL9AEcUqZRj56J/3L1LoZly6LQxxHTipX+jpiwSbr4A9M59XLU2uJjhyfB6GxAk SkU5qbXD+Dw607PC48ddCrdf9qXM3/Rb4FzqAB2g3IWl3KEtM4l8fnZ9v7coZLH1ayCqn5J71dcJ PaeKtb/k7A7nmy4YQZPbD5CYZxxhe7OC3XLkxdFrRI/9RHDXehSNQziJwULAUouMiIEoH9D7UIrG yM22gGLWbCALWgUJRA+JMjhw3WE6V7MCVpK9Gg== ) ;; ADDITIONAL SECTION (11 records) a.nic.ch. 172800 IN A 130.59.31.41 b.nic.ch. 172800 IN A 130.59.31.43 d.nic.ch. 172800 IN A 194.0.25.39 e.nic.ch. 172800 IN A 194.0.17.1 f.nic.ch. 172800 IN A 194.146.106.10 a.nic.ch. 172800 IN AAAA 2001:620:0:ff::56 b.nic.ch. 172800 IN AAAA 2001:620:0:ff::58 d.nic.ch. 172800 IN AAAA 2001:678:20::39 e.nic.ch. 172800 IN AAAA 2001:678:3::1 f.nic.ch. 172800 IN AAAA 2001:67c:1010:2::53 ;; { "EDNS-VERSION": 0 }
	Query to k.root-servers.net for ch/DNSKEY
	Received 670 bytes from 193.0.14.129
	;; Response received from [193.0.14.129] 670 octets ;; HEADER SECTION ;; id = 21102 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 11 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ch. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) ch. 172800 IN NS a.nic.ch. ch. 172800 IN NS b.nic.ch. ch. 172800 IN NS d.nic.ch. ch. 172800 IN NS e.nic.ch. ch. 172800 IN NS f.nic.ch. ch. 86400 IN DS ( 58745 13 2 083ed7735a6aad21d51cb0af5c485055602b392435e92b2c13614a6bc8d46b92 ) ch. 86400 IN RRSIG ( DS 8 1 86400 20261015050000 20261002040000 8763 . MAdSmBx8zGUA7OSAhzlej/Bdqz9XRy5OWA2Xookcl6jzzirTRcaBve0uV+bmabRxaVkRiBDF8JU9 0YV1VLD7g9EoLrL9AEcUqZRj56J/3L1LoZly6LQxxHTipX+jpiwSbr4A9M59XLU2uJjhyfB6GxAk SkU5qbXD+Dw607PC48ddCrdf9qXM3/Rb4FzqAB2g3IWl3KEtM4l8fnZ9v7coZLH1ayCqn5J71dcJ PaeKtb/k7A7nmy4YQZPbD5CYZxxhe7OC3XLkxdFrRI/9RHDXehSNQziJwULAUouMiIEoH9D7UIrG yM22gGLWbCALWgUJRA+JMjhw3WE6V7MCVpK9Gg== ) ;; ADDITIONAL SECTION (11 records) a.nic.ch. 172800 IN A 130.59.31.41 b.nic.ch. 172800 IN A 130.59.31.43 d.nic.ch. 172800 IN A 194.0.25.39 e.nic.ch. 172800 IN A 194.0.17.1 f.nic.ch. 172800 IN A 194.146.106.10 a.nic.ch. 172800 IN AAAA 2001:620:0:ff::56 b.nic.ch. 172800 IN AAAA 2001:620:0:ff::58 d.nic.ch. 172800 IN AAAA 2001:678:20::39 e.nic.ch. 172800 IN AAAA 2001:678:3::1 f.nic.ch. 172800 IN AAAA 2001:67c:1010:2::53 ;; { "EDNS-VERSION": 0 }
	Found child zone ch

	Checking DS between . and ch
	Query to l.root-servers.net for ch/DS
	Received 366 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 366 octets ;; HEADER SECTION ;; id = 22863 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ch. IN DS ;; ANSWER SECTION (2 records) ch. 86400 IN DS ( 58745 13 2 083ed7735a6aad21d51cb0af5c485055602b392435e92b2c13614a6bc8d46b92 ) ch. 86400 IN RRSIG ( DS 8 1 86400 20261015050000 20261002040000 8763 . MAdSmBx8zGUA7OSAhzlej/Bdqz9XRy5OWA2Xookcl6jzzirTRcaBve0uV+bmabRxaVkRiBDF8JU9 0YV1VLD7g9EoLrL9AEcUqZRj56J/3L1LoZly6LQxxHTipX+jpiwSbr4A9M59XLU2uJjhyfB6GxAk SkU5qbXD+Dw607PC48ddCrdf9qXM3/Rb4FzqAB2g3IWl3KEtM4l8fnZ9v7coZLH1ayCqn5J71dcJ PaeKtb/k7A7nmy4YQZPbD5CYZxxhe7OC3XLkxdFrRI/9RHDXehSNQziJwULAUouMiIEoH9D7UIrG yM22gGLWbCALWgUJRA+JMjhw3WE6V7MCVpK9Gg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for ch in the . zone
	DS=58745/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`ch. 86400 IN RRSIG ( DS 8 1 86400 20261015050000 20261002040000 8763 . MAdSmBx8zGUA7OSAhzlej/Bdqz9XRy5OWA2Xookcl6jzzirTRcaBve0uV+bmabRxaVkRiBDF8JU9 0YV1VLD7g9EoLrL9AEcUqZRj56J/3L1LoZly6LQxxHTipX+jpiwSbr4A9M59XLU2uJjhyfB6GxAk SkU5qbXD+Dw607PC48ddCrdf9qXM3/Rb4FzqAB2g3IWl3KEtM4l8fnZ9v7coZLH1ayCqn5J71dcJ PaeKtb/k7A7nmy4YQZPbD5CYZxxhe7OC3XLkxdFrRI/9RHDXehSNQziJwULAUouMiIEoH9D7UIrG yM22gGLWbCALWgUJRA+JMjhw3WE6V7MCVpK9Gg== )`
	RRSIG=8763 and DNSKEY=8763 verifies the DS RRset
	DS=58745/SHA-256 is now in the chain-of-trust
	`ch. 86400 IN DS ( 58745 13 2 083ed7735a6aad21d51cb0af5c485055602b392435e92b2c13614a6bc8d46b92 )`
	Query to d.nic.ch for ch/DNSKEY
	Received 369 bytes from 194.0.25.39
	;; Response received from [194.0.25.39] 369 octets ;; HEADER SECTION ;; id = 40363 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1400, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ch. IN DNSKEY ;; ANSWER SECTION (4 records) ch. 86400 IN DNSKEY ( 256 3 13 FO+tvH3+WFgU4V5TQ6G/P5draexIplg0Icfnmr1Txh48H8x/+3f2DQRcjv4zlZqT5L2qleXEDpm3 aaM/oYpQEA== ) ; keytag 28106 ch. 86400 IN DNSKEY ( 257 3 13 af3VgrsVYa6Jm3d1lwsoCAEqQbeNpLUJ5kHjkUksCCPvubXuPEwTJGDUUbw9QRJtm6lBIAjbjtAc cGemAgcyZQ== ) ; keytag 58745 ch. 86400 IN DNSKEY ( 256 3 13 cVfObwOTrQhK74lsGQgU2EVstLPKx79zNaSp8dRuI1hcWxx+gWgJycqSjfsOtSyKER4wQqKRXXAL Gx30R1OlTQ== ) ; keytag 16719 ch. 86400 IN RRSIG ( DNSKEY 13 1 86400 20261026100909 20260910090909 58745 ch. qd7+JUWT9ICxxN0bKSXe1hR+w/0Pn3PllhD8ZztDKVm5hk5AYCZkowN2rRLeeCn3LaJyOASsDRz0 Dvjl3em8UQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for ch
	`ch. 86400 IN DNSKEY ( 256 3 13 FO+tvH3+WFgU4V5TQ6G/P5draexIplg0Icfnmr1Txh48H8x/+3f2DQRcjv4zlZqT5L2qleXEDpm3 aaM/oYpQEA== ) ; keytag 28106`
	`ch. 86400 IN DNSKEY ( 257 3 13 af3VgrsVYa6Jm3d1lwsoCAEqQbeNpLUJ5kHjkUksCCPvubXuPEwTJGDUUbw9QRJtm6lBIAjbjtAc cGemAgcyZQ== ) ; keytag 58745`
	`ch. 86400 IN DNSKEY ( 256 3 13 cVfObwOTrQhK74lsGQgU2EVstLPKx79zNaSp8dRuI1hcWxx+gWgJycqSjfsOtSyKER4wQqKRXXAL Gx30R1OlTQ== ) ; keytag 16719`
	DNSKEY=58745/SEP is now in the chain-of-trust
	DS=58745/SHA-256 verifies DNSKEY=58745/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`ch. 86400 IN RRSIG ( DNSKEY 13 1 86400 20261026100909 20260910090909 58745 ch. qd7+JUWT9ICxxN0bKSXe1hR+w/0Pn3PllhD8ZztDKVm5hk5AYCZkowN2rRLeeCn3LaJyOASsDRz0 Dvjl3em8UQ== )`
	RRSIG=58745 and DNSKEY=58745/SEP verifies the DNSKEY RRset
	DNSKEY=28106 is now in the chain-of-trust
	DNSKEY=16719 is now in the chain-of-trust
	Query to b.nic.ch for mail.ch/A
	Received 284 bytes from 130.59.31.43
	;; Response received from [130.59.31.43] 284 octets ;; HEADER SECTION ;; id = 24051 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mail.ch. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) mail.ch. 3600 IN NS anycast2.irondns.net. mail.ch. 3600 IN NS sec1.rcode0.net. mail.ch. 3600 IN NS sec2.rcode0.net. mail.ch. 3600 IN NS anycast1.irondns.net. mail.ch. 3600 IN DS ( 45727 10 2 30d564aef562e744e5700a4cdbc04587f07452fa74daf8940d2004a45db01da4 ) mail.ch. 3600 IN RRSIG ( DS 13 2 3600 20261026143213 20260926133215 28106 ch. LBzXh4FBf6l0QFc/VIQBauNz6CXwwBUusKVBCMe9Khq+GLaqdHmbDX2gkrf/sZJ8b9j+oT9Ucfs1 YS6BsR6xhw== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to f.nic.ch for mail.ch/DNSKEY
	Received 284 bytes from 194.146.106.10
	;; Response received from [194.146.106.10] 284 octets ;; HEADER SECTION ;; id = 26508 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mail.ch. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) mail.ch. 3600 IN NS anycast2.irondns.net. mail.ch. 3600 IN NS sec2.rcode0.net. mail.ch. 3600 IN NS sec1.rcode0.net. mail.ch. 3600 IN NS anycast1.irondns.net. mail.ch. 3600 IN DS ( 45727 10 2 30d564aef562e744e5700a4cdbc04587f07452fa74daf8940d2004a45db01da4 ) mail.ch. 3600 IN RRSIG ( DS 13 2 3600 20261026143213 20260926133215 28106 ch. LBzXh4FBf6l0QFc/VIQBauNz6CXwwBUusKVBCMe9Khq+GLaqdHmbDX2gkrf/sZJ8b9j+oT9Ucfs1 YS6BsR6xhw== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone mail.ch

mail.ch

	Checking DS between ch and mail.ch
	Query to e.nic.ch for mail.ch/DS
	Received 182 bytes from 194.0.17.1
	;; Response received from [194.0.17.1] 182 octets ;; HEADER SECTION ;; id = 15622 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mail.ch. IN DS ;; ANSWER SECTION (2 records) mail.ch. 3600 IN DS ( 45727 10 2 30d564aef562e744e5700a4cdbc04587f07452fa74daf8940d2004a45db01da4 ) mail.ch. 3600 IN RRSIG ( DS 13 2 3600 20261026143213 20260926133215 28106 ch. LBzXh4FBf6l0QFc/VIQBauNz6CXwwBUusKVBCMe9Khq+GLaqdHmbDX2gkrf/sZJ8b9j+oT9Ucfs1 YS6BsR6xhw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for mail.ch in the ch zone
	DS=45727/SHA-256 has algorithm RSASHA512
	Found 1 RRSIGs over DS RRset
	`mail.ch. 3600 IN RRSIG ( DS 13 2 3600 20261026143213 20260926133215 28106 ch. LBzXh4FBf6l0QFc/VIQBauNz6CXwwBUusKVBCMe9Khq+GLaqdHmbDX2gkrf/sZJ8b9j+oT9Ucfs1 YS6BsR6xhw== )`
	RRSIG=28106 and DNSKEY=28106 verifies the DS RRset
	DS=45727/SHA-256 is now in the chain-of-trust
	`mail.ch. 3600 IN DS ( 45727 10 2 30d564aef562e744e5700a4cdbc04587f07452fa74daf8940d2004a45db01da4 )`
	Query to sec1.rcode0.net for mail.ch/DNSKEY
	Received 1326 bytes from 192.174.68.100
	;; Response received from [192.174.68.100] 1326 octets ;; HEADER SECTION ;; id = 13120 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 5 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mail.ch. IN DNSKEY ;; ANSWER SECTION (5 records) mail.ch. 43200 IN DNSKEY ( 256 3 10 AwEAAdff3TC5X6G0KgzT78Q8nfWD9BDto3TxSwgyIXzBi6ApJC0iDCRUYPLp1Z3BdJOGlFAei2DD +/ULd26OBKW0Bbj4HD1/Gm41CFgzfraEwwp1mArVMBI1ulVYaZVwCdRrM3lCj4Lj2pd6GUIjecvf 7062ZvzoqTA7wB9Fvvk8kPPJ ) ; keytag 27333 mail.ch. 43200 IN DNSKEY ( 257 3 10 AwEAAYB8I/ioiqUVz73Xd9rlVBZDROSOb8lcC6EkdIP5rnxo7zkVTfF5yQfYSLZO4AUkPH8E7EJw 1aGeilh+lH+kPsO32L7ndOJnK/wxvCT+135jRPQgMhD+E0Jg8Gb31vRnrNP2gfRCNaTVAsQSjrhE tv4vnxyW/3pOhfOf7oTsKbhqalXdg1dYza018gBt58tfXf/ZQV4S1FXQ43O9lWI0BK3B3ComooPM t928YwNirbLupKSzh4VVZr6kwo/8k//JWQJe8YxjFnf0fpfmWH+snWmNJ5RLzak3tj9uVkZqhwzz hNeV6QkikqxGp2SOHGg+Hs5MTaHLrQBtA3sKwXre+5U= ) ; keytag 45727 mail.ch. 43200 IN DNSKEY ( 257 3 10 AwEAAa3SIZ4Mk3FlllrPxrJ9QmXhiWxwsIScHw+FH9VlDeB4QoaKeWYoBhz3y5xefFm7ijz7PcH9 Ifpt9v9Mjrg/qdsrfPu6YQ6fqOEvNdAMpxzZLrKC5DuZDwC3OafoHMH7FM9SzOqAooEVjZLyJFRD 9NG2SYVXPfL0+mRtOoiJKqJaraSUctTy+TrELy2pxx2g/5wbMrS6IxZ4VUTTDs5BYvm+oMjJvjm7 k3rTHqZBi+iq9LNyZqLmHxn4AqCyLl3DRTFYwskTeGf5x1Ir7uM1aNl4eyuzTC7b4sO8KM/TYZLm UebPNsloxNSEj85HNS0lsoa43CfQMCho9XhWZPRjr1s= ) ; keytag 43348 mail.ch. 43200 IN RRSIG ( DNSKEY 10 2 43200 20261008061059 20260924061059 43348 mail.ch. l05cCsqhVEgPILXPsXWx3FDACfITIhIqhi0AZylHN+51nPMICUO1jeoPUF3BqLOQpOhgCqLXyIQe S51cEMbtxCxZ6GR4iB204ze66QE6G/YsNeDqS8TuhtRd1b2qXkwZ4x9h2/vW9o2g+YDWNXpjFs/v erjc+awWn/DK9kOlMLIKLRS9z/WVjkS7L9BmEB5NTtDgQl8A357z9dlLzW1BGboLYeoE3Qm1AAlF jpue12ztoNO1bZuTzsVxRv5kbTn2Gj1hV+ZrvmGUuAdbb4sH/WrHrxHRgeHknd0qfGJ4vna6g13n 8TJxOCWNjRuMcZ+RnC1fCoGgo7swX63vWZWIXg== ) mail.ch. 43200 IN RRSIG ( DNSKEY 10 2 43200 20261008061059 20260924061059 45727 mail.ch. Gj0BXZaS1liB6Tbc/VqKJHcEGY0IV9P60w7pDKoVj26vX3/NWQU+w8TShTQszcX/jmt7h/qQ5ZjB jZ1fdI7UijfOJNZOJWsUNBj9Sj6P6gptveVcTxP5hB9daU8jbAoY03mzaaBrKCHUSpqTz9OnPtKz iSFicX5niRucXXE2vqHioupjthVztsLs5yWjb4cf0o0CTKkYTMUgrFNn0kCXcAWA1jD6ncRsUwQd X/q+hOY2cp7welrPFCHqd6JtDOAYfGTTXk9xNocBLQcQ6PZ5t5A4S4OFFu7hW3LdD/vVPZ+Ghix1 FIszVRIVlveHm5y0tC0QT+trYBYxCRaXp2ctGA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for mail.ch
	`mail.ch. 43200 IN DNSKEY ( 256 3 10 AwEAAdff3TC5X6G0KgzT78Q8nfWD9BDto3TxSwgyIXzBi6ApJC0iDCRUYPLp1Z3BdJOGlFAei2DD +/ULd26OBKW0Bbj4HD1/Gm41CFgzfraEwwp1mArVMBI1ulVYaZVwCdRrM3lCj4Lj2pd6GUIjecvf 7062ZvzoqTA7wB9Fvvk8kPPJ ) ; keytag 27333`
	`mail.ch. 43200 IN DNSKEY ( 257 3 10 AwEAAYB8I/ioiqUVz73Xd9rlVBZDROSOb8lcC6EkdIP5rnxo7zkVTfF5yQfYSLZO4AUkPH8E7EJw 1aGeilh+lH+kPsO32L7ndOJnK/wxvCT+135jRPQgMhD+E0Jg8Gb31vRnrNP2gfRCNaTVAsQSjrhE tv4vnxyW/3pOhfOf7oTsKbhqalXdg1dYza018gBt58tfXf/ZQV4S1FXQ43O9lWI0BK3B3ComooPM t928YwNirbLupKSzh4VVZr6kwo/8k//JWQJe8YxjFnf0fpfmWH+snWmNJ5RLzak3tj9uVkZqhwzz hNeV6QkikqxGp2SOHGg+Hs5MTaHLrQBtA3sKwXre+5U= ) ; keytag 45727`
	`mail.ch. 43200 IN DNSKEY ( 257 3 10 AwEAAa3SIZ4Mk3FlllrPxrJ9QmXhiWxwsIScHw+FH9VlDeB4QoaKeWYoBhz3y5xefFm7ijz7PcH9 Ifpt9v9Mjrg/qdsrfPu6YQ6fqOEvNdAMpxzZLrKC5DuZDwC3OafoHMH7FM9SzOqAooEVjZLyJFRD 9NG2SYVXPfL0+mRtOoiJKqJaraSUctTy+TrELy2pxx2g/5wbMrS6IxZ4VUTTDs5BYvm+oMjJvjm7 k3rTHqZBi+iq9LNyZqLmHxn4AqCyLl3DRTFYwskTeGf5x1Ir7uM1aNl4eyuzTC7b4sO8KM/TYZLm UebPNsloxNSEj85HNS0lsoa43CfQMCho9XhWZPRjr1s= ) ; keytag 43348`
	DNSKEY=45727/SEP is now in the chain-of-trust
	DS=45727/SHA-256 verifies DNSKEY=45727/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`mail.ch. 43200 IN RRSIG ( DNSKEY 10 2 43200 20261008061059 20260924061059 43348 mail.ch. l05cCsqhVEgPILXPsXWx3FDACfITIhIqhi0AZylHN+51nPMICUO1jeoPUF3BqLOQpOhgCqLXyIQe S51cEMbtxCxZ6GR4iB204ze66QE6G/YsNeDqS8TuhtRd1b2qXkwZ4x9h2/vW9o2g+YDWNXpjFs/v erjc+awWn/DK9kOlMLIKLRS9z/WVjkS7L9BmEB5NTtDgQl8A357z9dlLzW1BGboLYeoE3Qm1AAlF jpue12ztoNO1bZuTzsVxRv5kbTn2Gj1hV+ZrvmGUuAdbb4sH/WrHrxHRgeHknd0qfGJ4vna6g13n 8TJxOCWNjRuMcZ+RnC1fCoGgo7swX63vWZWIXg== )`
	`mail.ch. 43200 IN RRSIG ( DNSKEY 10 2 43200 20261008061059 20260924061059 45727 mail.ch. Gj0BXZaS1liB6Tbc/VqKJHcEGY0IV9P60w7pDKoVj26vX3/NWQU+w8TShTQszcX/jmt7h/qQ5ZjB jZ1fdI7UijfOJNZOJWsUNBj9Sj6P6gptveVcTxP5hB9daU8jbAoY03mzaaBrKCHUSpqTz9OnPtKz iSFicX5niRucXXE2vqHioupjthVztsLs5yWjb4cf0o0CTKkYTMUgrFNn0kCXcAWA1jD6ncRsUwQd X/q+hOY2cp7welrPFCHqd6JtDOAYfGTTXk9xNocBLQcQ6PZ5t5A4S4OFFu7hW3LdD/vVPZ+Ghix1 FIszVRIVlveHm5y0tC0QT+trYBYxCRaXp2ctGA== )`
	RRSIG=43348 and DNSKEY=43348/SEP verifies the DNSKEY RRset
	RRSIG=45727 and DNSKEY=45727/SEP verifies the DNSKEY RRset
	DNSKEY=27333 is now in the chain-of-trust
	DNSKEY=43348/SEP is now in the chain-of-trust
	Query to anycast1.irondns.net for mail.ch/A
	Received 219 bytes from 195.253.64.5
	;; Response received from [195.253.64.5] 219 octets ;; HEADER SECTION ;; id = 35537 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mail.ch. IN A ;; ANSWER SECTION (2 records) mail.ch. 3600 IN A 62.201.172.44 mail.ch. 3600 IN RRSIG ( A 10 2 3600 20261016031009 20261002031009 27333 mail.ch. i2N1aByAMttnWkRCs9Ae8uopfBO0glbK0WRSviGKCKeboNTiw2FOKqjmCDFk1ecjliBhS2N4Q4Si Zyv6uyY6v9nUEieui0dLMpx49vOyisudsdvgS4FKqLzSgc4eF0ELNhu/uJbI0nXOs/guQDNyCVCX zGnbJNSBz2MfGFtqZQs= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	anycast1.irondns.net is authoritative for mail.ch
	Found RRSIG signed by mail.ch zone
	Query to sec2.rcode0.net for mail.ch/SOA
	Received 269 bytes from 176.97.158.100
	;; Response received from [176.97.158.100] 269 octets ;; HEADER SECTION ;; id = 41994 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1400, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mail.ch. IN SOA ;; ANSWER SECTION (2 records) mail.ch. 86400 IN RRSIG ( SOA 10 2 86400 20261016040938 20261002040938 27333 mail.ch. jL3Cji5vt2zld8M9KFO0hg3d4SGBhTYWzOKJN+T59XoVr0mBt60Fd2ZguQ8xEiv8/IvYvO5nEnkL wYrsRkjyajZCtjvYxW0V7PgvQfFqJf1Tpt9Iw9jnolqvrBJ/rO/PYB4iz6wxHqvLER3mSzxe7cm+ f4msHpy+bamVsS3VDNM= ) mail.ch. 86400 IN SOA ( anycast1.irondns.net. dnsmaster.irondns.net. 1481 ;serial 10800 ;refresh 3000 ;retry 2419200 ;expire 900 ;minimum ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to sec1.rcode0.net for mail.ch/SOA
	Received 269 bytes from 192.174.68.100
	;; Response received from [192.174.68.100] 269 octets ;; HEADER SECTION ;; id = 48366 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mail.ch. IN SOA ;; ANSWER SECTION (2 records) mail.ch. 86400 IN SOA ( anycast1.irondns.net. dnsmaster.irondns.net. 1481 ;serial 10800 ;refresh 3000 ;retry 2419200 ;expire 900 ;minimum ) mail.ch. 86400 IN RRSIG ( SOA 10 2 86400 20261016040938 20261002040938 27333 mail.ch. jL3Cji5vt2zld8M9KFO0hg3d4SGBhTYWzOKJN+T59XoVr0mBt60Fd2ZguQ8xEiv8/IvYvO5nEnkL wYrsRkjyajZCtjvYxW0V7PgvQfFqJf1Tpt9Iw9jnolqvrBJ/rO/PYB4iz6wxHqvLER3mSzxe7cm+ f4msHpy+bamVsS3VDNM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to anycast2.irondns.net for mail.ch/SOA
	Received 518 bytes from 195.253.65.5
	;; Response received from [195.253.65.5] 518 octets ;; HEADER SECTION ;; id = 30620 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 5 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mail.ch. IN SOA ;; ANSWER SECTION (2 records) mail.ch. 86400 IN SOA ( anycast1.irondns.net. dnsmaster.irondns.net. 1481 ;serial 10800 ;refresh 3000 ;retry 2419200 ;expire 900 ;minimum ) mail.ch. 86400 IN RRSIG ( SOA 10 2 86400 20261016040938 20261002040938 27333 mail.ch. jL3Cji5vt2zld8M9KFO0hg3d4SGBhTYWzOKJN+T59XoVr0mBt60Fd2ZguQ8xEiv8/IvYvO5nEnkL wYrsRkjyajZCtjvYxW0V7PgvQfFqJf1Tpt9Iw9jnolqvrBJ/rO/PYB4iz6wxHqvLER3mSzxe7cm+ f4msHpy+bamVsS3VDNM= ) ;; AUTHORITY SECTION (5 records) mail.ch. 86400 IN NS sec2.rcode0.net. mail.ch. 86400 IN NS anycast2.irondns.net. mail.ch. 86400 IN NS sec1.rcode0.net. mail.ch. 86400 IN NS anycast1.irondns.net. mail.ch. 86400 IN RRSIG ( NS 10 2 86400 20261015041010 20261001041010 27333 mail.ch. BQUM5b7xwjiGdeZSWkJZxmMHSAvcs8Lm2P94SAL1XEpoLomx7mzrtxsWZtZwJ2tZprGtI1Wkw/3K zZFRclCkqVpnalcVeDJ3ONLH/B3JP2XgKf2OXrAaZe2O/KPKnuxwm5d3sGUs5yTP4eIxhaHojDTU L5Pe/Yc+54Ylayz7laI= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to anycast1.irondns.net for mail.ch/A
	mail.ch A RR has value 62.201.172.44
	Found 1 RRSIGs over A RRset
	`mail.ch. 3600 IN RRSIG ( A 10 2 3600 20261016031009 20261002031009 27333 mail.ch. i2N1aByAMttnWkRCs9Ae8uopfBO0glbK0WRSviGKCKeboNTiw2FOKqjmCDFk1ecjliBhS2N4Q4Si Zyv6uyY6v9nUEieui0dLMpx49vOyisudsdvgS4FKqLzSgc4eF0ELNhu/uJbI0nXOs/guQDNyCVCX zGnbJNSBz2MfGFtqZQs= )`
	RRSIG=27333 and DNSKEY=27333 verifies the A RRset

mail.ch

	Query to sec2.rcode0.net for mail.ch/A
	Received 219 bytes from 176.97.158.100
	;; Response received from [176.97.158.100] 219 octets ;; HEADER SECTION ;; id = 62189 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1400, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mail.ch. IN A ;; ANSWER SECTION (2 records) mail.ch. 3600 IN A 62.201.172.44 mail.ch. 3600 IN RRSIG ( A 10 2 3600 20261016031009 20261002031009 27333 mail.ch. i2N1aByAMttnWkRCs9Ae8uopfBO0glbK0WRSviGKCKeboNTiw2FOKqjmCDFk1ecjliBhS2N4Q4Si Zyv6uyY6v9nUEieui0dLMpx49vOyisudsdvgS4FKqLzSgc4eF0ELNhu/uJbI0nXOs/guQDNyCVCX zGnbJNSBz2MfGFtqZQs= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	sec2.rcode0.net is authoritative for mail.ch
	Found RRSIG signed by mail.ch zone
	Query to sec2.rcode0.net for mail.ch/A
	mail.ch A RR has value 62.201.172.44
	Found 1 RRSIGs over A RRset
	`mail.ch. 3600 IN RRSIG ( A 10 2 3600 20261016031009 20261002031009 27333 mail.ch. i2N1aByAMttnWkRCs9Ae8uopfBO0glbK0WRSviGKCKeboNTiw2FOKqjmCDFk1ecjliBhS2N4Q4Si Zyv6uyY6v9nUEieui0dLMpx49vOyisudsdvgS4FKqLzSgc4eF0ELNhu/uJbI0nXOs/guQDNyCVCX zGnbJNSBz2MfGFtqZQs= )`
	RRSIG=27333 and DNSKEY=27333 verifies the A RRset

mail.ch

	Query to anycast2.irondns.net for mail.ch/A
	Received 219 bytes from 195.253.65.5
	;; Response received from [195.253.65.5] 219 octets ;; HEADER SECTION ;; id = 28533 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mail.ch. IN A ;; ANSWER SECTION (2 records) mail.ch. 3600 IN A 62.201.172.44 mail.ch. 3600 IN RRSIG ( A 10 2 3600 20261016031009 20261002031009 27333 mail.ch. i2N1aByAMttnWkRCs9Ae8uopfBO0glbK0WRSviGKCKeboNTiw2FOKqjmCDFk1ecjliBhS2N4Q4Si Zyv6uyY6v9nUEieui0dLMpx49vOyisudsdvgS4FKqLzSgc4eF0ELNhu/uJbI0nXOs/guQDNyCVCX zGnbJNSBz2MfGFtqZQs= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	anycast2.irondns.net is authoritative for mail.ch
	Found RRSIG signed by mail.ch zone
	Query to anycast2.irondns.net for mail.ch/A
	mail.ch A RR has value 62.201.172.44
	Found 1 RRSIGs over A RRset
	`mail.ch. 3600 IN RRSIG ( A 10 2 3600 20261016031009 20261002031009 27333 mail.ch. i2N1aByAMttnWkRCs9Ae8uopfBO0glbK0WRSviGKCKeboNTiw2FOKqjmCDFk1ecjliBhS2N4Q4Si Zyv6uyY6v9nUEieui0dLMpx49vOyisudsdvgS4FKqLzSgc4eF0ELNhu/uJbI0nXOs/guQDNyCVCX zGnbJNSBz2MfGFtqZQs= )`
	RRSIG=27333 and DNSKEY=27333 verifies the A RRset

mail.ch

	Query to sec1.rcode0.net for mail.ch/A
	Received 219 bytes from 192.174.68.100
	;; Response received from [192.174.68.100] 219 octets ;; HEADER SECTION ;; id = 41640 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; mail.ch. IN A ;; ANSWER SECTION (2 records) mail.ch. 3600 IN A 62.201.172.44 mail.ch. 3600 IN RRSIG ( A 10 2 3600 20261016031009 20261002031009 27333 mail.ch. i2N1aByAMttnWkRCs9Ae8uopfBO0glbK0WRSviGKCKeboNTiw2FOKqjmCDFk1ecjliBhS2N4Q4Si Zyv6uyY6v9nUEieui0dLMpx49vOyisudsdvgS4FKqLzSgc4eF0ELNhu/uJbI0nXOs/guQDNyCVCX zGnbJNSBz2MfGFtqZQs= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	sec1.rcode0.net is authoritative for mail.ch
	Found RRSIG signed by mail.ch zone
	Query to sec1.rcode0.net for mail.ch/A
	mail.ch A RR has value 62.201.172.44
	Found 1 RRSIGs over A RRset
	`mail.ch. 3600 IN RRSIG ( A 10 2 3600 20261016031009 20261002031009 27333 mail.ch. i2N1aByAMttnWkRCs9Ae8uopfBO0glbK0WRSviGKCKeboNTiw2FOKqjmCDFk1ecjliBhS2N4Q4Si Zyv6uyY6v9nUEieui0dLMpx49vOyisudsdvgS4FKqLzSgc4eF0ELNhu/uJbI0nXOs/guQDNyCVCX zGnbJNSBz2MfGFtqZQs= )`
	RRSIG=27333 and DNSKEY=27333 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test mail.ch at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: