DNSSEC Debugger

Domain Name:

Time: 2025-11-10 00:45:59 UTC

Analyzing DNSSEC problems for nrd.gov

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to d.root-servers.net for ./DNSKEY
	Received 1139 bytes from 199.7.91.13
	;; Response received from [199.7.91.13] 1139 octets ;; HEADER SECTION ;; id = 50956 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1450, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAeuS7hMRZ7muj1c/ew2DoavxkBw3jUG5R79pKVDI39fxvlD1HfJYGJERnXuV4SrQfUPzWw/l t5Axb0EqXL/sQ2ZyntVmwQwoSXi2l9smlIKh2UrkTmmozRCPe7GS4fZTE4Ew7AV4YprTLgVmxiGP 4unRuXkYOgQJXCIBpVCmEdUli6X2sm0i5ZilU/Q+rX3RDw+eYPP7K0cJnJ+ZnvQDy14+BFtreWl9 enNQljgGpBp26lEp1z7AbvUfzkQNVCVGaM8jEaCSALXiROlwCQMOdj+tpLXFf99kdJnTQw2cpEr1 uGs/yENAJpoGhbjZAoIkXzDUBSlfFeYz7FWzH6gIe7M= ) ; keytag 61809 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20251121000000 20251031000000 20326 . qnzPUNeV8plQe0Se5Fa0uHS0Ygf4DSnEekaMeH7GQRbNhk6ntkneJFKUN+EBJQfd/JoaY//18qf4 G6YrWE/a+FwJ5oefafEhuJWhITrXMle9e4oy4Z7sjb7e1ajwGSKlcfp0Rsulv/aPlLLfl+4jUijr zzZUvUJA10LzOwswvjI16xA3HMG9rEh0mKY0RywLI+R5NkYgDzY0QGL9BMaUHWNV+eTFBmMpmg3j jKGnIg8jmFhqcypUqLXW7md/oO+k0A8QG39nGvhx7rVDUoaQd7atJH2jtzGeXW8n/XI/ncI9fSoX rLXu6NvJY5bX6dXI9ypg+sFnkF7Fd4TdZ8AasA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAeuS7hMRZ7muj1c/ew2DoavxkBw3jUG5R79pKVDI39fxvlD1HfJYGJERnXuV4SrQfUPzWw/l t5Axb0EqXL/sQ2ZyntVmwQwoSXi2l9smlIKh2UrkTmmozRCPe7GS4fZTE4Ew7AV4YprTLgVmxiGP 4unRuXkYOgQJXCIBpVCmEdUli6X2sm0i5ZilU/Q+rX3RDw+eYPP7K0cJnJ+ZnvQDy14+BFtreWl9 enNQljgGpBp26lEp1z7AbvUfzkQNVCVGaM8jEaCSALXiROlwCQMOdj+tpLXFf99kdJnTQw2cpEr1 uGs/yENAJpoGhbjZAoIkXzDUBSlfFeYz7FWzH6gIe7M= ) ; keytag 61809`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20251121000000 20251031000000 20326 . qnzPUNeV8plQe0Se5Fa0uHS0Ygf4DSnEekaMeH7GQRbNhk6ntkneJFKUN+EBJQfd/JoaY//18qf4 G6YrWE/a+FwJ5oefafEhuJWhITrXMle9e4oy4Z7sjb7e1ajwGSKlcfp0Rsulv/aPlLLfl+4jUijr zzZUvUJA10LzOwswvjI16xA3HMG9rEh0mKY0RywLI+R5NkYgDzY0QGL9BMaUHWNV+eTFBmMpmg3j jKGnIg8jmFhqcypUqLXW7md/oO+k0A8QG39nGvhx7rVDUoaQd7atJH2jtzGeXW8n/XI/ncI9fSoX rLXu6NvJY5bX6dXI9ypg+sFnkF7Fd4TdZ8AasA== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=61809 is now in the chain-of-trust
	DNSKEY=38696/SEP is now in the chain-of-trust
	Query to g.root-servers.net for nrd.gov/A
	Received 617 bytes from 192.112.36.4
	;; Response received from [192.112.36.4] 617 octets ;; HEADER SECTION ;; id = 34088 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nrd.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 172800 IN NS a.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20251122170000 20251109160000 61809 . UKAuerckTehHMGg2WTEy+U5TuWQ3+Nmw+vXaNuZc/koIXGdzyw38o5dRb7D1NOtHJkGPC4Q6k5sC 6chQ8r8mCrc+FhlE8o0VO3Ah7zFRLQhvoTXrCY7clheaZ99PLfO8BZkHtJcEue7DSwfUWjetW8fh jCFbejZefOXdlAoe6xhCekgxrAvOpkUPwHAyi1DSp2M5vG7x4q6SH5E7kF0P0YETCroPY8IdHfJs IceMDtiJSfdpY0aWj7Qk4+2VEjsm3Dxsu+J29zD+IhJPjenjTPdES6RH96WbXvvfBx+/xCt/Sm1p X0xoSIPv0wSfnoA/2Bn4/hnzPBLG6YAOAa9F+A== ) ;; ADDITIONAL SECTION (9 records) d.ns.gov. 172800 IN A 199.33.233.1 c.ns.gov. 172800 IN A 199.33.232.1 b.ns.gov. 172800 IN A 199.33.231.1 a.ns.gov. 172800 IN A 199.33.230.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 ;; { "EDNS-VERSION": 0 }
	Query to c.root-servers.net for gov/DNSKEY
	Received 613 bytes from 192.33.4.12
	;; Response received from [192.33.4.12] 613 octets ;; HEADER SECTION ;; id = 15680 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS d.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20251122170000 20251109160000 61809 . UKAuerckTehHMGg2WTEy+U5TuWQ3+Nmw+vXaNuZc/koIXGdzyw38o5dRb7D1NOtHJkGPC4Q6k5sC 6chQ8r8mCrc+FhlE8o0VO3Ah7zFRLQhvoTXrCY7clheaZ99PLfO8BZkHtJcEue7DSwfUWjetW8fh jCFbejZefOXdlAoe6xhCekgxrAvOpkUPwHAyi1DSp2M5vG7x4q6SH5E7kF0P0YETCroPY8IdHfJs IceMDtiJSfdpY0aWj7Qk4+2VEjsm3Dxsu+J29zD+IhJPjenjTPdES6RH96WbXvvfBx+/xCt/Sm1p X0xoSIPv0wSfnoA/2Bn4/hnzPBLG6YAOAa9F+A== ) ;; ADDITIONAL SECTION (9 records) d.ns.gov. 172800 IN A 199.33.233.1 c.ns.gov. 172800 IN A 199.33.232.1 b.ns.gov. 172800 IN A 199.33.231.1 a.ns.gov. 172800 IN A 199.33.230.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 ;; { "EDNS-VERSION": 0 }
	Found child zone gov

gov

	Checking DS between . and gov
	Query to g.root-servers.net for gov/DS
	Received 367 bytes from 192.112.36.4
	;; Response received from [192.112.36.4] 367 octets ;; HEADER SECTION ;; id = 39065 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20251122170000 20251109160000 61809 . UKAuerckTehHMGg2WTEy+U5TuWQ3+Nmw+vXaNuZc/koIXGdzyw38o5dRb7D1NOtHJkGPC4Q6k5sC 6chQ8r8mCrc+FhlE8o0VO3Ah7zFRLQhvoTXrCY7clheaZ99PLfO8BZkHtJcEue7DSwfUWjetW8fh jCFbejZefOXdlAoe6xhCekgxrAvOpkUPwHAyi1DSp2M5vG7x4q6SH5E7kF0P0YETCroPY8IdHfJs IceMDtiJSfdpY0aWj7Qk4+2VEjsm3Dxsu+J29zD+IhJPjenjTPdES6RH96WbXvvfBx+/xCt/Sm1p X0xoSIPv0wSfnoA/2Bn4/hnzPBLG6YAOAa9F+A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for gov in the . zone
	DS=2536/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20251122170000 20251109160000 61809 . UKAuerckTehHMGg2WTEy+U5TuWQ3+Nmw+vXaNuZc/koIXGdzyw38o5dRb7D1NOtHJkGPC4Q6k5sC 6chQ8r8mCrc+FhlE8o0VO3Ah7zFRLQhvoTXrCY7clheaZ99PLfO8BZkHtJcEue7DSwfUWjetW8fh jCFbejZefOXdlAoe6xhCekgxrAvOpkUPwHAyi1DSp2M5vG7x4q6SH5E7kF0P0YETCroPY8IdHfJs IceMDtiJSfdpY0aWj7Qk4+2VEjsm3Dxsu+J29zD+IhJPjenjTPdES6RH96WbXvvfBx+/xCt/Sm1p X0xoSIPv0wSfnoA/2Bn4/hnzPBLG6YAOAa9F+A== )`
	RRSIG=61809 and DNSKEY=61809 verifies the DS RRset
	DS=2536/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 )`
	Query to a.ns.gov for gov/DNSKEY
	Received 291 bytes from 199.33.230.1
	;; Response received from [199.33.230.1] 291 octets ;; HEADER SECTION ;; id = 18618 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536 gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496 gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20251219110613 20251019110613 2536 gov. j3FRDkQ+/qhx8n7XWgDk7DC6YuMd0K42x1BaoJP4SEm+WtzI5LbaxO7OS3rDz3G0nG4HtRwBe8wW 1w4LNc5mNA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for gov
	`gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536`
	`gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496`
	DNSKEY=2536/SEP is now in the chain-of-trust
	DS=2536/SHA-256 verifies DNSKEY=2536/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20251219110613 20251019110613 2536 gov. j3FRDkQ+/qhx8n7XWgDk7DC6YuMd0K42x1BaoJP4SEm+WtzI5LbaxO7OS3rDz3G0nG4HtRwBe8wW 1w4LNc5mNA== )`
	RRSIG=2536 and DNSKEY=2536/SEP verifies the DNSKEY RRset
	DNSKEY=35496 is now in the chain-of-trust
	Query to a.ns.gov for nrd.gov/A
	Received 489 bytes from 199.33.230.1
	;; Response received from [199.33.230.1] 489 octets ;; HEADER SECTION ;; id = 41946 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 7 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nrd.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) nrd.gov. 10800 IN NS ns1.nrd.gov. nrd.gov. 10800 IN NS ns2.nrd.gov. nrd.gov. 10800 IN NS ns3.nrd.gov. nrd.gov. 3600 IN DS 28061 8 1 bbd727fdb000c6381a95cb75a71022b937629b27 nrd.gov. 3600 IN DS ( 28061 8 2 1a62c365c43826f5afef8d4321bdebeed19c4c34186feb3947e2ef54cf41bd21 ) nrd.gov. 3600 IN DS 31156 8 1 ea6d3198a583e1705acfc3c80499a8b662b71433 nrd.gov. 3600 IN DS ( 31156 8 2 811f672a8071b973836aa169f93807f2ff1b8a7aa18bf3436e39df980179f1ab ) nrd.gov. 3600 IN RRSIG ( DS 13 2 3600 20251111014559 20251108234559 35496 gov. wbzNIKM8Eg03P/Gj5u8Mw53bb7EWm0cV1xQFJ2gOh2laZnvMD8P4sOSPAtr9fbC9hpCpQAfLPLuP aApkehJang== ) ;; ADDITIONAL SECTION (7 records) ns1.nrd.gov. 3600 IN A 52.222.56.242 ns1.nrd.gov. 3600 IN AAAA 2600:1f12:cf5:601:a5ba:93b4:6c32:f169 ns2.nrd.gov. 3600 IN A 52.222.67.179 ns2.nrd.gov. 3600 IN AAAA 2600:1f12:cf5:602:7618:eea7:8c20:e4ad ns3.nrd.gov. 3600 IN A 52.61.51.239 ns3.nrd.gov. 3600 IN AAAA 2600:1f12:cf5:601:6ffb:8ad6:57c5:3b9c ;; { "EDNS-VERSION": 0 }
	Query to c.ns.gov for nrd.gov/DNSKEY
	Received 489 bytes from 199.33.232.1
	;; Response received from [199.33.232.1] 489 octets ;; HEADER SECTION ;; id = 26182 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 7 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nrd.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) nrd.gov. 10800 IN NS ns1.nrd.gov. nrd.gov. 10800 IN NS ns2.nrd.gov. nrd.gov. 10800 IN NS ns3.nrd.gov. nrd.gov. 3600 IN DS 28061 8 1 bbd727fdb000c6381a95cb75a71022b937629b27 nrd.gov. 3600 IN DS ( 28061 8 2 1a62c365c43826f5afef8d4321bdebeed19c4c34186feb3947e2ef54cf41bd21 ) nrd.gov. 3600 IN DS 31156 8 1 ea6d3198a583e1705acfc3c80499a8b662b71433 nrd.gov. 3600 IN DS ( 31156 8 2 811f672a8071b973836aa169f93807f2ff1b8a7aa18bf3436e39df980179f1ab ) nrd.gov. 3600 IN RRSIG ( DS 13 2 3600 20251111014559 20251108234559 35496 gov. c0eYT9dbY8RB2Y6H33om/xaVD/VlRJa1N5lH6bArjKOLlDPnuKD2JXiCAAEkDUZ3p5GckmplCCtH vCxDn8KFHA== ) ;; ADDITIONAL SECTION (7 records) ns1.nrd.gov. 3600 IN A 52.222.56.242 ns1.nrd.gov. 3600 IN AAAA 2600:1f12:cf5:601:a5ba:93b4:6c32:f169 ns2.nrd.gov. 3600 IN A 52.222.67.179 ns2.nrd.gov. 3600 IN AAAA 2600:1f12:cf5:602:7618:eea7:8c20:e4ad ns3.nrd.gov. 3600 IN A 52.61.51.239 ns3.nrd.gov. 3600 IN AAAA 2600:1f12:cf5:601:6ffb:8ad6:57c5:3b9c ;; { "EDNS-VERSION": 0 }
	Found child zone nrd.gov

nrd.gov

	Checking DS between gov and nrd.gov
	Query to d.ns.gov for nrd.gov/DS
	Received 303 bytes from 199.33.233.1
	;; Response received from [199.33.233.1] 303 octets ;; HEADER SECTION ;; id = 42989 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 5 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nrd.gov. IN DS ;; ANSWER SECTION (5 records) nrd.gov. 3600 IN DS 28061 8 1 bbd727fdb000c6381a95cb75a71022b937629b27 nrd.gov. 3600 IN DS ( 28061 8 2 1a62c365c43826f5afef8d4321bdebeed19c4c34186feb3947e2ef54cf41bd21 ) nrd.gov. 3600 IN DS 31156 8 1 ea6d3198a583e1705acfc3c80499a8b662b71433 nrd.gov. 3600 IN DS ( 31156 8 2 811f672a8071b973836aa169f93807f2ff1b8a7aa18bf3436e39df980179f1ab ) nrd.gov. 3600 IN RRSIG ( DS 13 2 3600 20251111014559 20251108234559 35496 gov. DE0G5MHW/32wqZiTr3lId+9WX5AHV7ucY5W4jgJdOQm7SZEnZ+VvOefSKvS8zi4D5iCHNftHmUrP 8lC0cIuMfA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 4 DS records for nrd.gov in the gov zone
	DS=28061/SHA-1 uses a deprecated digest algorithm
	DS=31156/SHA-1 uses a deprecated digest algorithm
	DS=28061/SHA-1 has algorithm RSASHA256
	DS=28061/SHA-256 has algorithm RSASHA256
	DS=31156/SHA-1 has algorithm RSASHA256
	DS=31156/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`nrd.gov. 3600 IN RRSIG ( DS 13 2 3600 20251111014559 20251108234559 35496 gov. DE0G5MHW/32wqZiTr3lId+9WX5AHV7ucY5W4jgJdOQm7SZEnZ+VvOefSKvS8zi4D5iCHNftHmUrP 8lC0cIuMfA== )`
	RRSIG=35496 and DNSKEY=35496 verifies the DS RRset
	DS=28061/SHA-1 is now in the chain-of-trust
	DS=31156/SHA-1 is now in the chain-of-trust
	`nrd.gov. 3600 IN DS 28061 8 1 bbd727fdb000c6381a95cb75a71022b937629b27`
	`nrd.gov. 3600 IN DS ( 28061 8 2 1a62c365c43826f5afef8d4321bdebeed19c4c34186feb3947e2ef54cf41bd21 )`
	`nrd.gov. 3600 IN DS 31156 8 1 ea6d3198a583e1705acfc3c80499a8b662b71433`
	`nrd.gov. 3600 IN DS ( 31156 8 2 811f672a8071b973836aa169f93807f2ff1b8a7aa18bf3436e39df980179f1ab )`
	Query to ns1.nrd.gov for nrd.gov/DNSKEY
	Received 1346 bytes from 52.222.56.242
	;; Response received from [52.222.56.242] 1346 octets ;; HEADER SECTION ;; id = 21226 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 6 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4000, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nrd.gov. IN DNSKEY ;; ANSWER SECTION (6 records) nrd.gov. 3600 IN DNSKEY ( 257 3 8 AwEAAc45VrP4PsQYfWvxXb4YVLWzRCaupp0a/jretFZ7f1tpOx8C+7oq8GqjUY2Jt8SfxmRX0ekm xtOO8gUasygRd4MSGT6zSmmomB4cQiLxJ1vugtRzKgbeEciuvn8rjP0ayCl9Enzvnny40Fxtai9n dZhm7Vy/9U+yVzCoJKr7Bmm8KPDRpogd9cOzHk9cCuwvAaJjJdMkyVxWXl6tPxt6U3MXtbsri7La DwIbkIteF9XoRVfh4878QeRTkOD9coFFl6wWS0VTF7lFQn+6lpQxVsX8Qu7mK/vk6q6nXgFqKFI+ ieNHm5a8M58lkbwhd9saAsL0v6o25sDMZiDTMDqLjt0= ) ; keytag 31156 nrd.gov. 3600 IN DNSKEY ( 256 3 8 AwEAAbudKiMk7JAcacVunYvPl8PaNuv4mh40FrVp53o60u3MmbE9HyPvia/YQJvFXk3MprU9878X PUqcXdjCCO+0Scb5uBRiLn3Y1uunK07waOBtkIFGQrIlQosl8gMniW5CYYPaGBNdz3K0wcZsF/RE 57mJKDdcPgZOxxds3OJk59Vh ) ; keytag 12066 nrd.gov. 3600 IN DNSKEY ( 256 3 8 AwEAAddv8yv6HM/gv+1uQXOau4sGs5av59KlPUqHTrA/jgwS2OauHMe2v/JCLkW5Sq7IKd1T5I7j 9TBDK78sUe/bamRWw6wFVtqh0Urs1/WmlSpY3skM99f64xouexNeiOIMwnR4PZhgg+U1vwqzw2c+ JzsQ5ogtutSS9iPIq8VRPZw9 ) ; keytag 17584 nrd.gov. 3600 IN DNSKEY ( 257 3 8 AwEAAcnjBsruOqsUWrfaO+2EmJH7pu4DMIf8835MC05oG3AP0OV/i1haf9ZzW/uEf4zRlPHCASlG tSEZ0GOmYsd1cbdgMXzLGN8Tya+VqIsx9hhD/P24GrE4AdAbpajzDOwIbtQ0undp0Va8uCL6/3mr 8CbtQmrzV+Xf8iMPT44W3PE8tf4PTzuPEMrT/bst2m02ehNCnOtn2EGyWJfU9Wd8flGwiL7+45V1 FUnB6e5a8KjtBbgDmMNSpBP2KztjnvVPe8BpmpL7edlyRdRTThh+dnrYC77ACUbQMp3Ctylq6isE TW6SkVjOuxtdOHvleUJymUNvQUhuS9QlHR4jqDd3FZE= ) ; keytag 28061 nrd.gov. 3600 IN RRSIG ( DNSKEY 8 2 3600 20251112033705 20251105023705 31156 nrd.gov. jHKzl02yQnFllBMtNEvy+F+mVB7lxmRq4x/MHeTumBDfSqnQlCPGYJZ01tNBSjcq0fqUZfSh+0T0 lhco3XWBi3MklyufJpCo1wKUF+BK0mMChRcUPLTH5yNN2dWAsQ+2K/absPSQ/DQbIZMnHWzXtkih 7ngyrXxa7LG4H9on0Vq28VnSVAlOt5q+3S2Wl2IbYDcbnvrsOwnBlKf8fX6kac/KpYAYIUfd+Z3R bffp2BKlYAQJSQSQRG003P/tzVDdkV96KoUP3Sm27Iha31LQBYV/VEe+/5iEjr65QEiiTPABp6Qv NrX0cNr8VgzNEVXU5SYs/A4YCop2Q9u8TZbzZw== ) nrd.gov. 3600 IN RRSIG ( DNSKEY 8 2 3600 20251112033705 20251105023705 17584 nrd.gov. ULCggead5hXTy/Q05ZaY/UsvvwiOZjaV682adKXmEdCBOAwc1587MFEz4OOFrWDsT3q4Lh6Cvakn 3HQi47tNAsNIfzi0NlAWpJuM1u48cMOua5OD1CbEDQxOtpSjbGZqdxlHLydhM0ohisGjpmgiWbQH 8sMIprppp1PKKuZ9UJc= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 4 DNSKEY records for nrd.gov
	`nrd.gov. 3600 IN DNSKEY ( 257 3 8 AwEAAc45VrP4PsQYfWvxXb4YVLWzRCaupp0a/jretFZ7f1tpOx8C+7oq8GqjUY2Jt8SfxmRX0ekm xtOO8gUasygRd4MSGT6zSmmomB4cQiLxJ1vugtRzKgbeEciuvn8rjP0ayCl9Enzvnny40Fxtai9n dZhm7Vy/9U+yVzCoJKr7Bmm8KPDRpogd9cOzHk9cCuwvAaJjJdMkyVxWXl6tPxt6U3MXtbsri7La DwIbkIteF9XoRVfh4878QeRTkOD9coFFl6wWS0VTF7lFQn+6lpQxVsX8Qu7mK/vk6q6nXgFqKFI+ ieNHm5a8M58lkbwhd9saAsL0v6o25sDMZiDTMDqLjt0= ) ; keytag 31156`
	`nrd.gov. 3600 IN DNSKEY ( 256 3 8 AwEAAbudKiMk7JAcacVunYvPl8PaNuv4mh40FrVp53o60u3MmbE9HyPvia/YQJvFXk3MprU9878X PUqcXdjCCO+0Scb5uBRiLn3Y1uunK07waOBtkIFGQrIlQosl8gMniW5CYYPaGBNdz3K0wcZsF/RE 57mJKDdcPgZOxxds3OJk59Vh ) ; keytag 12066`
	`nrd.gov. 3600 IN DNSKEY ( 256 3 8 AwEAAddv8yv6HM/gv+1uQXOau4sGs5av59KlPUqHTrA/jgwS2OauHMe2v/JCLkW5Sq7IKd1T5I7j 9TBDK78sUe/bamRWw6wFVtqh0Urs1/WmlSpY3skM99f64xouexNeiOIMwnR4PZhgg+U1vwqzw2c+ JzsQ5ogtutSS9iPIq8VRPZw9 ) ; keytag 17584`
	`nrd.gov. 3600 IN DNSKEY ( 257 3 8 AwEAAcnjBsruOqsUWrfaO+2EmJH7pu4DMIf8835MC05oG3AP0OV/i1haf9ZzW/uEf4zRlPHCASlG tSEZ0GOmYsd1cbdgMXzLGN8Tya+VqIsx9hhD/P24GrE4AdAbpajzDOwIbtQ0undp0Va8uCL6/3mr 8CbtQmrzV+Xf8iMPT44W3PE8tf4PTzuPEMrT/bst2m02ehNCnOtn2EGyWJfU9Wd8flGwiL7+45V1 FUnB6e5a8KjtBbgDmMNSpBP2KztjnvVPe8BpmpL7edlyRdRTThh+dnrYC77ACUbQMp3Ctylq6isE TW6SkVjOuxtdOHvleUJymUNvQUhuS9QlHR4jqDd3FZE= ) ; keytag 28061`
	DNSKEY=31156/SEP is now in the chain-of-trust
	DS=31156/SHA-1 verifies DNSKEY=31156/SEP
	DS=31156/SHA-256 verifies DNSKEY=31156/SEP
	DNSKEY=28061/SEP is now in the chain-of-trust
	DS=28061/SHA-1 verifies DNSKEY=28061/SEP
	DS=28061/SHA-256 verifies DNSKEY=28061/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`nrd.gov. 3600 IN RRSIG ( DNSKEY 8 2 3600 20251112033705 20251105023705 31156 nrd.gov. jHKzl02yQnFllBMtNEvy+F+mVB7lxmRq4x/MHeTumBDfSqnQlCPGYJZ01tNBSjcq0fqUZfSh+0T0 lhco3XWBi3MklyufJpCo1wKUF+BK0mMChRcUPLTH5yNN2dWAsQ+2K/absPSQ/DQbIZMnHWzXtkih 7ngyrXxa7LG4H9on0Vq28VnSVAlOt5q+3S2Wl2IbYDcbnvrsOwnBlKf8fX6kac/KpYAYIUfd+Z3R bffp2BKlYAQJSQSQRG003P/tzVDdkV96KoUP3Sm27Iha31LQBYV/VEe+/5iEjr65QEiiTPABp6Qv NrX0cNr8VgzNEVXU5SYs/A4YCop2Q9u8TZbzZw== )`
	`nrd.gov. 3600 IN RRSIG ( DNSKEY 8 2 3600 20251112033705 20251105023705 17584 nrd.gov. ULCggead5hXTy/Q05ZaY/UsvvwiOZjaV682adKXmEdCBOAwc1587MFEz4OOFrWDsT3q4Lh6Cvakn 3HQi47tNAsNIfzi0NlAWpJuM1u48cMOua5OD1CbEDQxOtpSjbGZqdxlHLydhM0ohisGjpmgiWbQH 8sMIprppp1PKKuZ9UJc= )`
	RRSIG=31156 and DNSKEY=31156/SEP verifies the DNSKEY RRset
	RRSIG=17584 and DNSKEY=17584 verifies the DNSKEY RRset
	DNSKEY=12066 is now in the chain-of-trust
	DNSKEY=17584 is now in the chain-of-trust
	Query to ns1.nrd.gov for nrd.gov/A
	Received 219 bytes from 52.222.56.242
	;; Response received from [52.222.56.242] 219 octets ;; HEADER SECTION ;; id = 698 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4000, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nrd.gov. IN A ;; ANSWER SECTION (2 records) nrd.gov. 900 IN A 52.61.51.239 nrd.gov. 900 IN RRSIG ( A 8 2 900 20251119202510 20251109192510 17584 nrd.gov. MMwV7bBVkUmyiSTKrSm3Pg4oAph4yO7AA/YnmVPwaqNsyLKikqMZSeaEp3EVyOzs9dGa9A+wNjdR Ai+ckrQgH1jSl/rWaPsXeP2cMnsV8fvtEJ5anodGd75zT1p+rGfNbG2RbH1dd4hUFEQBgdXi+WYW rSb7weo4LIS+x+gU2i0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns1.nrd.gov is authoritative for nrd.gov
	Found RRSIG signed by nrd.gov zone
	Query to ns3.nrd.gov for nrd.gov/SOA
	Received 653 bytes from 52.61.51.239
	;; Response received from [52.61.51.239] 653 octets ;; HEADER SECTION ;; id = 65053 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 5 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4000, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nrd.gov. IN SOA ;; ANSWER SECTION (2 records) nrd.gov. 300 IN SOA ( ns1.nrd.gov. jonathon.a.morris12.civ.mail.mil. 2023082029 ;serial 1800 ;refresh 900 ;retry 2419200 ;expire 900 ;minimum ) nrd.gov. 300 IN RRSIG ( SOA 8 2 300 20251119202510 20251109192510 17584 nrd.gov. ePMb/2LEdkz11p3sKIpM28a74EzbpqLCJIl6Ms9ZZ0WH5Omgr6rLQkIBZnHcv6iYZOSB4uiXnRec oljyAFZtFomSYH4/6OX2YRkHdW2oLu93+X2Woqk4Jxi1Ovvt5WGH4w+VWmqd9z0VpVjULOKjV+Af zpgVeDh3wdwMIKjhBGs= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (5 records) ns1.nrd.gov. 900 IN A 52.222.56.242 ns1.nrd.gov. 900 IN RRSIG ( A 8 3 900 20251119202510 20251109192510 17584 nrd.gov. JtWG9gZaAkkdHdsCtLSpg7aJIi4ewJ44AFFc+5RDNnBHje+xBr+xVjAbdoeoybq5KB16hBuX8o7G 9YVmA/JKqJR1PoQUgEm29YJF3iEvk2MAK4V5+XwT2d2t0s5mylPcLXu/TMADpUXf6C8ZcwMyVoFJ pobN3GpPSZxlefiVIao= ) ns1.nrd.gov. 900 IN AAAA 2600:1f12:cf5:601:a5ba:93b4:6c32:f169 ns1.nrd.gov. 900 IN RRSIG ( AAAA 8 3 900 20251119202510 20251109192510 17584 nrd.gov. yvmHD7U1WvB1L3z0yk44DnXzFsQbbTleEy2XJlm7OjfpRmwmwsbhL/iDf3iT6z+kvPawwreJf8OF GMQEujqZkaCQwTe/ISXarBxeG3tnCJ3J9uU1dyUo5pafaW2Ij8z9/+Itw2sJIbCrrSRACXzI9CAc ZvB9esq79h/cRdh8cOk= ) ;; { "EDNS-VERSION": 0 }
	Query to ns2.nrd.gov for nrd.gov/SOA
	Received 653 bytes from 52.222.67.179
	;; Response received from [52.222.67.179] 653 octets ;; HEADER SECTION ;; id = 12573 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 5 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4000, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nrd.gov. IN SOA ;; ANSWER SECTION (2 records) nrd.gov. 300 IN SOA ( ns1.nrd.gov. jonathon.a.morris12.civ.mail.mil. 2023082029 ;serial 1800 ;refresh 900 ;retry 2419200 ;expire 900 ;minimum ) nrd.gov. 300 IN RRSIG ( SOA 8 2 300 20251119202510 20251109192510 17584 nrd.gov. ePMb/2LEdkz11p3sKIpM28a74EzbpqLCJIl6Ms9ZZ0WH5Omgr6rLQkIBZnHcv6iYZOSB4uiXnRec oljyAFZtFomSYH4/6OX2YRkHdW2oLu93+X2Woqk4Jxi1Ovvt5WGH4w+VWmqd9z0VpVjULOKjV+Af zpgVeDh3wdwMIKjhBGs= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (5 records) ns1.nrd.gov. 900 IN A 52.222.56.242 ns1.nrd.gov. 900 IN RRSIG ( A 8 3 900 20251119202510 20251109192510 17584 nrd.gov. JtWG9gZaAkkdHdsCtLSpg7aJIi4ewJ44AFFc+5RDNnBHje+xBr+xVjAbdoeoybq5KB16hBuX8o7G 9YVmA/JKqJR1PoQUgEm29YJF3iEvk2MAK4V5+XwT2d2t0s5mylPcLXu/TMADpUXf6C8ZcwMyVoFJ pobN3GpPSZxlefiVIao= ) ns1.nrd.gov. 900 IN AAAA 2600:1f12:cf5:601:a5ba:93b4:6c32:f169 ns1.nrd.gov. 900 IN RRSIG ( AAAA 8 3 900 20251119202510 20251109192510 17584 nrd.gov. yvmHD7U1WvB1L3z0yk44DnXzFsQbbTleEy2XJlm7OjfpRmwmwsbhL/iDf3iT6z+kvPawwreJf8OF GMQEujqZkaCQwTe/ISXarBxeG3tnCJ3J9uU1dyUo5pafaW2Ij8z9/+Itw2sJIbCrrSRACXzI9CAc ZvB9esq79h/cRdh8cOk= ) ;; { "EDNS-VERSION": 0 }
	Query to ns1.nrd.gov for nrd.gov/A
	Received 219 bytes from 52.222.56.242
	;; Response received from [52.222.56.242] 219 octets ;; HEADER SECTION ;; id = 5961 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4000, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nrd.gov. IN A ;; ANSWER SECTION (2 records) nrd.gov. 900 IN A 52.61.51.239 nrd.gov. 900 IN RRSIG ( A 8 2 900 20251119202510 20251109192510 17584 nrd.gov. MMwV7bBVkUmyiSTKrSm3Pg4oAph4yO7AA/YnmVPwaqNsyLKikqMZSeaEp3EVyOzs9dGa9A+wNjdR Ai+ckrQgH1jSl/rWaPsXeP2cMnsV8fvtEJ5anodGd75zT1p+rGfNbG2RbH1dd4hUFEQBgdXi+WYW rSb7weo4LIS+x+gU2i0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nrd.gov A RR has value 52.61.51.239
	Found 1 RRSIGs over A RRset
	`nrd.gov. 900 IN RRSIG ( A 8 2 900 20251119202510 20251109192510 17584 nrd.gov. MMwV7bBVkUmyiSTKrSm3Pg4oAph4yO7AA/YnmVPwaqNsyLKikqMZSeaEp3EVyOzs9dGa9A+wNjdR Ai+ckrQgH1jSl/rWaPsXeP2cMnsV8fvtEJ5anodGd75zT1p+rGfNbG2RbH1dd4hUFEQBgdXi+WYW rSb7weo4LIS+x+gU2i0= )`
	RRSIG=17584 and DNSKEY=17584 verifies the A RRset

nrd.gov

	Query to ns2.nrd.gov for nrd.gov/A
	Received 219 bytes from 52.222.67.179
	;; Response received from [52.222.67.179] 219 octets ;; HEADER SECTION ;; id = 29533 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4000, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nrd.gov. IN A ;; ANSWER SECTION (2 records) nrd.gov. 900 IN A 52.61.51.239 nrd.gov. 900 IN RRSIG ( A 8 2 900 20251119202510 20251109192510 17584 nrd.gov. MMwV7bBVkUmyiSTKrSm3Pg4oAph4yO7AA/YnmVPwaqNsyLKikqMZSeaEp3EVyOzs9dGa9A+wNjdR Ai+ckrQgH1jSl/rWaPsXeP2cMnsV8fvtEJ5anodGd75zT1p+rGfNbG2RbH1dd4hUFEQBgdXi+WYW rSb7weo4LIS+x+gU2i0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns2.nrd.gov is authoritative for nrd.gov
	Found RRSIG signed by nrd.gov zone
	Query to ns2.nrd.gov for nrd.gov/A
	Received 219 bytes from 52.222.67.179
	;; Response received from [52.222.67.179] 219 octets ;; HEADER SECTION ;; id = 25106 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4000, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nrd.gov. IN A ;; ANSWER SECTION (2 records) nrd.gov. 900 IN A 52.61.51.239 nrd.gov. 900 IN RRSIG ( A 8 2 900 20251119202510 20251109192510 17584 nrd.gov. MMwV7bBVkUmyiSTKrSm3Pg4oAph4yO7AA/YnmVPwaqNsyLKikqMZSeaEp3EVyOzs9dGa9A+wNjdR Ai+ckrQgH1jSl/rWaPsXeP2cMnsV8fvtEJ5anodGd75zT1p+rGfNbG2RbH1dd4hUFEQBgdXi+WYW rSb7weo4LIS+x+gU2i0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nrd.gov A RR has value 52.61.51.239
	Found 1 RRSIGs over A RRset
	`nrd.gov. 900 IN RRSIG ( A 8 2 900 20251119202510 20251109192510 17584 nrd.gov. MMwV7bBVkUmyiSTKrSm3Pg4oAph4yO7AA/YnmVPwaqNsyLKikqMZSeaEp3EVyOzs9dGa9A+wNjdR Ai+ckrQgH1jSl/rWaPsXeP2cMnsV8fvtEJ5anodGd75zT1p+rGfNbG2RbH1dd4hUFEQBgdXi+WYW rSb7weo4LIS+x+gU2i0= )`
	RRSIG=17584 and DNSKEY=17584 verifies the A RRset

nrd.gov

	Query to ns3.nrd.gov for nrd.gov/A
	Received 219 bytes from 52.61.51.239
	;; Response received from [52.61.51.239] 219 octets ;; HEADER SECTION ;; id = 33664 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4000, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nrd.gov. IN A ;; ANSWER SECTION (2 records) nrd.gov. 900 IN A 52.61.51.239 nrd.gov. 900 IN RRSIG ( A 8 2 900 20251119202510 20251109192510 17584 nrd.gov. MMwV7bBVkUmyiSTKrSm3Pg4oAph4yO7AA/YnmVPwaqNsyLKikqMZSeaEp3EVyOzs9dGa9A+wNjdR Ai+ckrQgH1jSl/rWaPsXeP2cMnsV8fvtEJ5anodGd75zT1p+rGfNbG2RbH1dd4hUFEQBgdXi+WYW rSb7weo4LIS+x+gU2i0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns3.nrd.gov is authoritative for nrd.gov
	Found RRSIG signed by nrd.gov zone
	Query to ns3.nrd.gov for nrd.gov/A
	Received 219 bytes from 52.61.51.239
	;; Response received from [52.61.51.239] 219 octets ;; HEADER SECTION ;; id = 55599 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4000, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nrd.gov. IN A ;; ANSWER SECTION (2 records) nrd.gov. 900 IN A 52.61.51.239 nrd.gov. 900 IN RRSIG ( A 8 2 900 20251119202510 20251109192510 17584 nrd.gov. MMwV7bBVkUmyiSTKrSm3Pg4oAph4yO7AA/YnmVPwaqNsyLKikqMZSeaEp3EVyOzs9dGa9A+wNjdR Ai+ckrQgH1jSl/rWaPsXeP2cMnsV8fvtEJ5anodGd75zT1p+rGfNbG2RbH1dd4hUFEQBgdXi+WYW rSb7weo4LIS+x+gU2i0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nrd.gov A RR has value 52.61.51.239
	Found 1 RRSIGs over A RRset
	`nrd.gov. 900 IN RRSIG ( A 8 2 900 20251119202510 20251109192510 17584 nrd.gov. MMwV7bBVkUmyiSTKrSm3Pg4oAph4yO7AA/YnmVPwaqNsyLKikqMZSeaEp3EVyOzs9dGa9A+wNjdR Ai+ckrQgH1jSl/rWaPsXeP2cMnsV8fvtEJ5anodGd75zT1p+rGfNbG2RbH1dd4hUFEQBgdXi+WYW rSb7weo4LIS+x+gU2i0= )`
	RRSIG=17584 and DNSKEY=17584 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test nrd.gov at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: