DNSSEC Debugger

Domain Name:

Time: 2025-11-10 01:50:57 UTC

Analyzing DNSSEC problems for nsa.gov

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to f.root-servers.net for ./DNSKEY
	Received 1139 bytes from 192.5.5.241
	;; Response received from [192.5.5.241] 1139 octets ;; HEADER SECTION ;; id = 41109 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAeuS7hMRZ7muj1c/ew2DoavxkBw3jUG5R79pKVDI39fxvlD1HfJYGJERnXuV4SrQfUPzWw/l t5Axb0EqXL/sQ2ZyntVmwQwoSXi2l9smlIKh2UrkTmmozRCPe7GS4fZTE4Ew7AV4YprTLgVmxiGP 4unRuXkYOgQJXCIBpVCmEdUli6X2sm0i5ZilU/Q+rX3RDw+eYPP7K0cJnJ+ZnvQDy14+BFtreWl9 enNQljgGpBp26lEp1z7AbvUfzkQNVCVGaM8jEaCSALXiROlwCQMOdj+tpLXFf99kdJnTQw2cpEr1 uGs/yENAJpoGhbjZAoIkXzDUBSlfFeYz7FWzH6gIe7M= ) ; keytag 61809 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20251121000000 20251031000000 20326 . qnzPUNeV8plQe0Se5Fa0uHS0Ygf4DSnEekaMeH7GQRbNhk6ntkneJFKUN+EBJQfd/JoaY//18qf4 G6YrWE/a+FwJ5oefafEhuJWhITrXMle9e4oy4Z7sjb7e1ajwGSKlcfp0Rsulv/aPlLLfl+4jUijr zzZUvUJA10LzOwswvjI16xA3HMG9rEh0mKY0RywLI+R5NkYgDzY0QGL9BMaUHWNV+eTFBmMpmg3j jKGnIg8jmFhqcypUqLXW7md/oO+k0A8QG39nGvhx7rVDUoaQd7atJH2jtzGeXW8n/XI/ncI9fSoX rLXu6NvJY5bX6dXI9ypg+sFnkF7Fd4TdZ8AasA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAeuS7hMRZ7muj1c/ew2DoavxkBw3jUG5R79pKVDI39fxvlD1HfJYGJERnXuV4SrQfUPzWw/l t5Axb0EqXL/sQ2ZyntVmwQwoSXi2l9smlIKh2UrkTmmozRCPe7GS4fZTE4Ew7AV4YprTLgVmxiGP 4unRuXkYOgQJXCIBpVCmEdUli6X2sm0i5ZilU/Q+rX3RDw+eYPP7K0cJnJ+ZnvQDy14+BFtreWl9 enNQljgGpBp26lEp1z7AbvUfzkQNVCVGaM8jEaCSALXiROlwCQMOdj+tpLXFf99kdJnTQw2cpEr1 uGs/yENAJpoGhbjZAoIkXzDUBSlfFeYz7FWzH6gIe7M= ) ; keytag 61809`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20251121000000 20251031000000 20326 . qnzPUNeV8plQe0Se5Fa0uHS0Ygf4DSnEekaMeH7GQRbNhk6ntkneJFKUN+EBJQfd/JoaY//18qf4 G6YrWE/a+FwJ5oefafEhuJWhITrXMle9e4oy4Z7sjb7e1ajwGSKlcfp0Rsulv/aPlLLfl+4jUijr zzZUvUJA10LzOwswvjI16xA3HMG9rEh0mKY0RywLI+R5NkYgDzY0QGL9BMaUHWNV+eTFBmMpmg3j jKGnIg8jmFhqcypUqLXW7md/oO+k0A8QG39nGvhx7rVDUoaQd7atJH2jtzGeXW8n/XI/ncI9fSoX rLXu6NvJY5bX6dXI9ypg+sFnkF7Fd4TdZ8AasA== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=61809 is now in the chain-of-trust
	DNSKEY=38696/SEP is now in the chain-of-trust
	Query to k.root-servers.net for nsa.gov/A
	Received 614 bytes from 193.0.14.129
	;; Response received from [193.0.14.129] 614 octets ;; HEADER SECTION ;; id = 44397 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20251122170000 20251109160000 61809 . UKAuerckTehHMGg2WTEy+U5TuWQ3+Nmw+vXaNuZc/koIXGdzyw38o5dRb7D1NOtHJkGPC4Q6k5sC 6chQ8r8mCrc+FhlE8o0VO3Ah7zFRLQhvoTXrCY7clheaZ99PLfO8BZkHtJcEue7DSwfUWjetW8fh jCFbejZefOXdlAoe6xhCekgxrAvOpkUPwHAyi1DSp2M5vG7x4q6SH5E7kF0P0YETCroPY8IdHfJs IceMDtiJSfdpY0aWj7Qk4+2VEjsm3Dxsu+J29zD+IhJPjenjTPdES6RH96WbXvvfBx+/xCt/Sm1p X0xoSIPv0wSfnoA/2Bn4/hnzPBLG6YAOAa9F+A== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN A 199.33.231.1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN A 199.33.232.1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN A 199.33.233.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Query to e.root-servers.net for gov/DNSKEY
	Received 610 bytes from 192.203.230.10
	;; Response received from [192.203.230.10] 610 octets ;; HEADER SECTION ;; id = 4795 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20251122170000 20251109160000 61809 . UKAuerckTehHMGg2WTEy+U5TuWQ3+Nmw+vXaNuZc/koIXGdzyw38o5dRb7D1NOtHJkGPC4Q6k5sC 6chQ8r8mCrc+FhlE8o0VO3Ah7zFRLQhvoTXrCY7clheaZ99PLfO8BZkHtJcEue7DSwfUWjetW8fh jCFbejZefOXdlAoe6xhCekgxrAvOpkUPwHAyi1DSp2M5vG7x4q6SH5E7kF0P0YETCroPY8IdHfJs IceMDtiJSfdpY0aWj7Qk4+2VEjsm3Dxsu+J29zD+IhJPjenjTPdES6RH96WbXvvfBx+/xCt/Sm1p X0xoSIPv0wSfnoA/2Bn4/hnzPBLG6YAOAa9F+A== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN A 199.33.231.1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN A 199.33.232.1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN A 199.33.233.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Found child zone gov

gov

	Checking DS between . and gov
	Query to d.root-servers.net for gov/DS
	Received 367 bytes from 199.7.91.13
	;; Response received from [199.7.91.13] 367 octets ;; HEADER SECTION ;; id = 11167 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1450, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20251122170000 20251109160000 61809 . UKAuerckTehHMGg2WTEy+U5TuWQ3+Nmw+vXaNuZc/koIXGdzyw38o5dRb7D1NOtHJkGPC4Q6k5sC 6chQ8r8mCrc+FhlE8o0VO3Ah7zFRLQhvoTXrCY7clheaZ99PLfO8BZkHtJcEue7DSwfUWjetW8fh jCFbejZefOXdlAoe6xhCekgxrAvOpkUPwHAyi1DSp2M5vG7x4q6SH5E7kF0P0YETCroPY8IdHfJs IceMDtiJSfdpY0aWj7Qk4+2VEjsm3Dxsu+J29zD+IhJPjenjTPdES6RH96WbXvvfBx+/xCt/Sm1p X0xoSIPv0wSfnoA/2Bn4/hnzPBLG6YAOAa9F+A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for gov in the . zone
	DS=2536/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20251122170000 20251109160000 61809 . UKAuerckTehHMGg2WTEy+U5TuWQ3+Nmw+vXaNuZc/koIXGdzyw38o5dRb7D1NOtHJkGPC4Q6k5sC 6chQ8r8mCrc+FhlE8o0VO3Ah7zFRLQhvoTXrCY7clheaZ99PLfO8BZkHtJcEue7DSwfUWjetW8fh jCFbejZefOXdlAoe6xhCekgxrAvOpkUPwHAyi1DSp2M5vG7x4q6SH5E7kF0P0YETCroPY8IdHfJs IceMDtiJSfdpY0aWj7Qk4+2VEjsm3Dxsu+J29zD+IhJPjenjTPdES6RH96WbXvvfBx+/xCt/Sm1p X0xoSIPv0wSfnoA/2Bn4/hnzPBLG6YAOAa9F+A== )`
	RRSIG=61809 and DNSKEY=61809 verifies the DS RRset
	DS=2536/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 )`
	Query to b.ns.gov for gov/DNSKEY
	Received 291 bytes from 199.33.231.1
	;; Response received from [199.33.231.1] 291 octets ;; HEADER SECTION ;; id = 54649 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536 gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496 gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20251219110613 20251019110613 2536 gov. j3FRDkQ+/qhx8n7XWgDk7DC6YuMd0K42x1BaoJP4SEm+WtzI5LbaxO7OS3rDz3G0nG4HtRwBe8wW 1w4LNc5mNA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for gov
	`gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536`
	`gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496`
	DNSKEY=2536/SEP is now in the chain-of-trust
	DS=2536/SHA-256 verifies DNSKEY=2536/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20251219110613 20251019110613 2536 gov. j3FRDkQ+/qhx8n7XWgDk7DC6YuMd0K42x1BaoJP4SEm+WtzI5LbaxO7OS3rDz3G0nG4HtRwBe8wW 1w4LNc5mNA== )`
	RRSIG=2536 and DNSKEY=2536/SEP verifies the DNSKEY RRset
	DNSKEY=35496 is now in the chain-of-trust
	Query to b.ns.gov for nsa.gov/A
	Received 315 bytes from 199.33.231.1
	;; Response received from [199.33.231.1] 315 octets ;; HEADER SECTION ;; id = 33885 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) nsa.gov. 10800 IN NS a1-107.akam.net. nsa.gov. 10800 IN NS a11-66.akam.net. nsa.gov. 10800 IN NS a12-67.akam.net. nsa.gov. 10800 IN NS a2-64.akam.net. nsa.gov. 10800 IN NS a24-65.akam.net. nsa.gov. 10800 IN NS a5-66.akam.net. nsa.gov. 3600 IN DS ( 29356 7 2 17c346b94be3bda883bc22d195b3a8aa4ccdadfc43b26b5c659d70af58e8fd5c ) nsa.gov. 3600 IN RRSIG ( DS 13 2 3600 20251111025058 20251109005058 35496 gov. ICAx6vn0zWpGW7t1yqkbS8Rv7gqTKPxxlUd+cL4GTGU0GF8rOL4FxvGR4jKwk0zQtYiuiCwu1cFQ APb/5kiqqA== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a.ns.gov for nsa.gov/DNSKEY
	Received 315 bytes from 199.33.230.1
	;; Response received from [199.33.230.1] 315 octets ;; HEADER SECTION ;; id = 8705 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) nsa.gov. 10800 IN NS a1-107.akam.net. nsa.gov. 10800 IN NS a11-66.akam.net. nsa.gov. 10800 IN NS a12-67.akam.net. nsa.gov. 10800 IN NS a2-64.akam.net. nsa.gov. 10800 IN NS a24-65.akam.net. nsa.gov. 10800 IN NS a5-66.akam.net. nsa.gov. 3600 IN DS ( 29356 7 2 17c346b94be3bda883bc22d195b3a8aa4ccdadfc43b26b5c659d70af58e8fd5c ) nsa.gov. 3600 IN RRSIG ( DS 13 2 3600 20251111025058 20251109005058 35496 gov. kcNi35AUisIGWPbYds5uWncMEltbvRDrYh7asX+DHufemK1trPI3ssBSBIt6KxOOsYraJxDB7aGK 1Xlb3bmDoQ== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone nsa.gov

nsa.gov

	Checking DS between gov and nsa.gov
	Query to b.ns.gov for nsa.gov/DS
	Received 183 bytes from 199.33.231.1
	;; Response received from [199.33.231.1] 183 octets ;; HEADER SECTION ;; id = 9917 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN DS ;; ANSWER SECTION (2 records) nsa.gov. 3600 IN DS ( 29356 7 2 17c346b94be3bda883bc22d195b3a8aa4ccdadfc43b26b5c659d70af58e8fd5c ) nsa.gov. 3600 IN RRSIG ( DS 13 2 3600 20251111025058 20251109005058 35496 gov. NYMUblNno3jrXlgjmUXoQv/Atm2bQKXAHXhFx1EHY0xF3AA2GE3M4Y3BOZQNL6U4DSkkIDcd/cpi NV2YrB3qUg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for nsa.gov in the gov zone
	DS=29356/SHA-256 has algorithm RSASHA1-NSEC3-SHA1
	Found 1 RRSIGs over DS RRset
	`nsa.gov. 3600 IN RRSIG ( DS 13 2 3600 20251111025058 20251109005058 35496 gov. NYMUblNno3jrXlgjmUXoQv/Atm2bQKXAHXhFx1EHY0xF3AA2GE3M4Y3BOZQNL6U4DSkkIDcd/cpi NV2YrB3qUg== )`
	RRSIG=35496 and DNSKEY=35496 verifies the DS RRset
	DS=29356/SHA-256 is now in the chain-of-trust
	`nsa.gov. 3600 IN DS ( 29356 7 2 17c346b94be3bda883bc22d195b3a8aa4ccdadfc43b26b5c659d70af58e8fd5c )`
	Query to a24-65.akam.net for nsa.gov/DNSKEY
	Received 1474 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 1474 octets ;; HEADER SECTION ;; id = 34113 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 6 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN DNSKEY ;; ANSWER SECTION (6 records) nsa.gov. 7200 IN DNSKEY ( 257 3 7 AwEAAaPv7ik8k0CD/1j0ODb4jdOMXVXyX6BJdXnIISp+LZPXrTdRgGSNzKIoF8sSvEuVvI1W3fCG Z/l0EpVbIEVOMUEduZ7St+wTW1jPpda9VsB8rrsacc6/nZTTEWy+GNzjB1GL02GrwV3ENYUAZZWR fgXikZmYlOFWtz46Li25a1xDZgTAfdIy7T26suRiauyonWeQ9NtVNJ3xuV2uwV24/4osxAzxw7yB d5eJ1CMVGuZkt7+umA2zJVCfdWL9ywQwszazF6mEDdj6SA79XdepdiLs9RLMOUuGeh1rjNUgM4jI PrqN6k9K/OVvApDZlQj4hOC82c/iN5Q7sCFm6KOHQY0= ) ; keytag 29356 nsa.gov. 7200 IN DNSKEY ( 257 3 7 AwEAAa0pWI7x1Fx3GA/XHkPWANn22SvPfuk7Zl2AN4jiRGx/U43iC9RxGZ6xjnNKNnjFLaiXKQIr MVqvOZ+/E82db+jpSQo+NCY1EHobZw8s8lJJkS8ialfpTxIicRv9DAhQpdj+npsJFTS2aP+4xrHt Z4hrlfdd8xcOQhFzBmKHlZAQ+HpKC5u1rZ3q5jzAFCItz+zvNdh4GJ1ACtwAlx8dyH0e7xP4kWbe qyVfONYhUT48GGWBI7y7mSE+ikeb/2sftGzBWNR8Nv/qbNSR3/2l/aHQoBwZ6aemaCNyPWPPl8Qa UiCnMaIQL1zHuxrF2vqaZuZeTQua6XTUTB/UQQe5S5c= ) ; keytag 62806 nsa.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAaiZX9GH91jNbRd5UHJNt4hzJfdmhSHNAEDt/IPZTwFzAz577Dgssv+YwvqV193mGTJPJDVr UhwScYWT+JvOaTShhZKF5Dv28xliomedLez7kdKBpDBBVlBrVUtW1JwNMDTO20A+HSrUytlazLeG MPs4IphxOvn1OssRC12GwuUJ ) ; keytag 52037 nsa.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAcNu5TnX690/e1r2yFf6fV17O4GSbi64PGHlL7qiUUqVf6vaJvd3jyokjJJx4jxTcnLD/HYt 2MUqUkK2NFgmtj+M3GdFUNCDSnlilVYRw9EH/7wvpyZhvBNlA7udYiJ7b/Ga1CkAx5IminPg9qAz 3KRxFVmZfnMqWb0EcytfHB2v ) ; keytag 49037 nsa.gov. 7200 IN RRSIG ( DNSKEY 7 2 7200 20251112074348 20251109064348 29356 nsa.gov. PrmYAILg/AVQGgHu8Tm4pwAvmAfybDnvwzgPsdKGGlObxsBFZL1/70hPCFRtW+m6knNQalpQUUw4 Jp/zahPW4v50isusHpbM8Pslg8Hp4emw8uBXsBVDOsCiaqazgT6aVmVyB0+jTL0Z2xGlyKZ9YDfD 6+wf7OR+3euOC9mcwXfftebQe6HW3YzmKXEn4SBNCi0rCA3jIJqce0CvxsG/JgA6O4P8sMaPAAxl cVOYHRKlLeIgP3P+z0i6wX2AZRBfxBDt2msdf20GutIpXOysDkt0WFukB0mcSkzcVmKMIDBgaw1s aEGbwmXvPpjnYQhvUFRNYhQFn0MXKA5mYgldfw== ) nsa.gov. 7200 IN RRSIG ( DNSKEY 7 2 7200 20251112074348 20251109064348 62806 nsa.gov. n21JMKM0U7HCod8I47UhLiO160YT8WKiMD28a2yD+xoOXbCoNgH2SacGHCp5WEdtmovqDX55PGO9 KQUpGBF5SXqhSfYSdxI5fKyha9Av8m8FBZxMDWQRvI9BldtKTUCu3MoZOehxoDJNtVCDj2DoFTgv A6p/QrL850CrYLB7G2WOkgr+xRNErVpYVWrxULXt+iQsVHfacY1bM50rGiv8YhRjXSvVy33dzw+l BuXm13uOoMPvMzCzOYiOtQGDGC6m5kPT8iKTUyF7U9i2bgH5bTWghkWn/8s8cxoA2o1WH4jZAnww tI1Zhv1VuW9er59b7g4rKC2xdMPgP4LHb2p3dw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 4 DNSKEY records for nsa.gov
	`nsa.gov. 7200 IN DNSKEY ( 257 3 7 AwEAAaPv7ik8k0CD/1j0ODb4jdOMXVXyX6BJdXnIISp+LZPXrTdRgGSNzKIoF8sSvEuVvI1W3fCG Z/l0EpVbIEVOMUEduZ7St+wTW1jPpda9VsB8rrsacc6/nZTTEWy+GNzjB1GL02GrwV3ENYUAZZWR fgXikZmYlOFWtz46Li25a1xDZgTAfdIy7T26suRiauyonWeQ9NtVNJ3xuV2uwV24/4osxAzxw7yB d5eJ1CMVGuZkt7+umA2zJVCfdWL9ywQwszazF6mEDdj6SA79XdepdiLs9RLMOUuGeh1rjNUgM4jI PrqN6k9K/OVvApDZlQj4hOC82c/iN5Q7sCFm6KOHQY0= ) ; keytag 29356`
	`nsa.gov. 7200 IN DNSKEY ( 257 3 7 AwEAAa0pWI7x1Fx3GA/XHkPWANn22SvPfuk7Zl2AN4jiRGx/U43iC9RxGZ6xjnNKNnjFLaiXKQIr MVqvOZ+/E82db+jpSQo+NCY1EHobZw8s8lJJkS8ialfpTxIicRv9DAhQpdj+npsJFTS2aP+4xrHt Z4hrlfdd8xcOQhFzBmKHlZAQ+HpKC5u1rZ3q5jzAFCItz+zvNdh4GJ1ACtwAlx8dyH0e7xP4kWbe qyVfONYhUT48GGWBI7y7mSE+ikeb/2sftGzBWNR8Nv/qbNSR3/2l/aHQoBwZ6aemaCNyPWPPl8Qa UiCnMaIQL1zHuxrF2vqaZuZeTQua6XTUTB/UQQe5S5c= ) ; keytag 62806`
	`nsa.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAaiZX9GH91jNbRd5UHJNt4hzJfdmhSHNAEDt/IPZTwFzAz577Dgssv+YwvqV193mGTJPJDVr UhwScYWT+JvOaTShhZKF5Dv28xliomedLez7kdKBpDBBVlBrVUtW1JwNMDTO20A+HSrUytlazLeG MPs4IphxOvn1OssRC12GwuUJ ) ; keytag 52037`
	`nsa.gov. 7200 IN DNSKEY ( 256 3 7 AwEAAcNu5TnX690/e1r2yFf6fV17O4GSbi64PGHlL7qiUUqVf6vaJvd3jyokjJJx4jxTcnLD/HYt 2MUqUkK2NFgmtj+M3GdFUNCDSnlilVYRw9EH/7wvpyZhvBNlA7udYiJ7b/Ga1CkAx5IminPg9qAz 3KRxFVmZfnMqWb0EcytfHB2v ) ; keytag 49037`
	DNSKEY=29356/SEP is now in the chain-of-trust
	DS=29356/SHA-256 verifies DNSKEY=29356/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`nsa.gov. 7200 IN RRSIG ( DNSKEY 7 2 7200 20251112074348 20251109064348 29356 nsa.gov. PrmYAILg/AVQGgHu8Tm4pwAvmAfybDnvwzgPsdKGGlObxsBFZL1/70hPCFRtW+m6knNQalpQUUw4 Jp/zahPW4v50isusHpbM8Pslg8Hp4emw8uBXsBVDOsCiaqazgT6aVmVyB0+jTL0Z2xGlyKZ9YDfD 6+wf7OR+3euOC9mcwXfftebQe6HW3YzmKXEn4SBNCi0rCA3jIJqce0CvxsG/JgA6O4P8sMaPAAxl cVOYHRKlLeIgP3P+z0i6wX2AZRBfxBDt2msdf20GutIpXOysDkt0WFukB0mcSkzcVmKMIDBgaw1s aEGbwmXvPpjnYQhvUFRNYhQFn0MXKA5mYgldfw== )`
	`nsa.gov. 7200 IN RRSIG ( DNSKEY 7 2 7200 20251112074348 20251109064348 62806 nsa.gov. n21JMKM0U7HCod8I47UhLiO160YT8WKiMD28a2yD+xoOXbCoNgH2SacGHCp5WEdtmovqDX55PGO9 KQUpGBF5SXqhSfYSdxI5fKyha9Av8m8FBZxMDWQRvI9BldtKTUCu3MoZOehxoDJNtVCDj2DoFTgv A6p/QrL850CrYLB7G2WOkgr+xRNErVpYVWrxULXt+iQsVHfacY1bM50rGiv8YhRjXSvVy33dzw+l BuXm13uOoMPvMzCzOYiOtQGDGC6m5kPT8iKTUyF7U9i2bgH5bTWghkWn/8s8cxoA2o1WH4jZAnww tI1Zhv1VuW9er59b7g4rKC2xdMPgP4LHb2p3dw== )`
	RRSIG=29356 and DNSKEY=29356/SEP verifies the DNSKEY RRset
	RRSIG=62806 and DNSKEY=62806/SEP verifies the DNSKEY RRset
	DNSKEY=62806/SEP is now in the chain-of-trust
	DNSKEY=52037 is now in the chain-of-trust
	DNSKEY=49037 is now in the chain-of-trust
	Query to a1-107.akam.net for nsa.gov/A
	Received 219 bytes from 193.108.91.107
	;; Response received from [193.108.91.107] 219 octets ;; HEADER SECTION ;; id = 45109 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 104.100.78.31 nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. HK85vCcnBT/M6JQbwSts6vCU4pzGiSJC4M/wGomDR5Ox77E9SrI0yauFkelxta09CpkKdky7dP9B X1NACYw7WQZ67TIWp08uDzB+Omz0PRqtBiKuDktPg/3XmEQJj8sM29SVA/IUl/3vn3Zdg8HNKjK8 8F6+9g+4qMZz1vCJgcY= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a1-107.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a11-66.akam.net for nsa.gov/SOA
	Received 563 bytes from 84.53.139.66
	;; Response received from [84.53.139.66] 563 octets ;; HEADER SECTION ;; id = 47237 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( w000-dsid-u05.nsa.gov. hostmaster.nsa.gov. 2025050611 ;serial 3600 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20251112074348 20251109064348 49037 nsa.gov. Xbk9paw0E+66Nx4kp2hLtkE4FJ8hEZjfdHJFgiu6qnJ16hwBTFh/ryR0cp0xGC8UWpXDAlfjpJFM BAMrYBht4yieAbUFWbTnGYcR3yyoAYIsyt2c3K4BBsFC/AhMmEmkIL4CIWbeNyaL8pk1u+WBDDed XtqWFV8a4Zt/2726m9o= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20251112074348 20251109064348 49037 nsa.gov. LPRTgOctuKN/zBZ6ahN8GqJ4Hd7CsT4kXPRfcVD6bH4QCsrXK4Vix9eF0QoFi45T6PjylWE6/6as it5HjP9kqxTvg8OdVW/Szz52TUclTFgHQoIQqa++QGbcs4vo3fJliN7ZgoTGK48UyPnC1wt+4avU va7G207DOShaeMrZhFg= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a24-65.akam.net for nsa.gov/SOA
	Received 563 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 563 octets ;; HEADER SECTION ;; id = 39708 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( w000-dsid-u05.nsa.gov. hostmaster.nsa.gov. 2025050611 ;serial 3600 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20251112074348 20251109064348 49037 nsa.gov. Xbk9paw0E+66Nx4kp2hLtkE4FJ8hEZjfdHJFgiu6qnJ16hwBTFh/ryR0cp0xGC8UWpXDAlfjpJFM BAMrYBht4yieAbUFWbTnGYcR3yyoAYIsyt2c3K4BBsFC/AhMmEmkIL4CIWbeNyaL8pk1u+WBDDed XtqWFV8a4Zt/2726m9o= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20251112074348 20251109064348 49037 nsa.gov. LPRTgOctuKN/zBZ6ahN8GqJ4Hd7CsT4kXPRfcVD6bH4QCsrXK4Vix9eF0QoFi45T6PjylWE6/6as it5HjP9kqxTvg8OdVW/Szz52TUclTFgHQoIQqa++QGbcs4vo3fJliN7ZgoTGK48UyPnC1wt+4avU va7G207DOShaeMrZhFg= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a12-67.akam.net for nsa.gov/SOA
	Received 563 bytes from 184.26.160.67
	;; Response received from [184.26.160.67] 563 octets ;; HEADER SECTION ;; id = 49924 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( w000-dsid-u05.nsa.gov. hostmaster.nsa.gov. 2025050611 ;serial 3600 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20251112074348 20251109064348 49037 nsa.gov. Xbk9paw0E+66Nx4kp2hLtkE4FJ8hEZjfdHJFgiu6qnJ16hwBTFh/ryR0cp0xGC8UWpXDAlfjpJFM BAMrYBht4yieAbUFWbTnGYcR3yyoAYIsyt2c3K4BBsFC/AhMmEmkIL4CIWbeNyaL8pk1u+WBDDed XtqWFV8a4Zt/2726m9o= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20251112074348 20251109064348 49037 nsa.gov. LPRTgOctuKN/zBZ6ahN8GqJ4Hd7CsT4kXPRfcVD6bH4QCsrXK4Vix9eF0QoFi45T6PjylWE6/6as it5HjP9kqxTvg8OdVW/Szz52TUclTFgHQoIQqa++QGbcs4vo3fJliN7ZgoTGK48UyPnC1wt+4avU va7G207DOShaeMrZhFg= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a2-64.akam.net for nsa.gov/SOA
	Received 563 bytes from 95.100.174.64
	;; Response received from [95.100.174.64] 563 octets ;; HEADER SECTION ;; id = 62818 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( w000-dsid-u05.nsa.gov. hostmaster.nsa.gov. 2025050611 ;serial 3600 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20251112074348 20251109064348 49037 nsa.gov. Xbk9paw0E+66Nx4kp2hLtkE4FJ8hEZjfdHJFgiu6qnJ16hwBTFh/ryR0cp0xGC8UWpXDAlfjpJFM BAMrYBht4yieAbUFWbTnGYcR3yyoAYIsyt2c3K4BBsFC/AhMmEmkIL4CIWbeNyaL8pk1u+WBDDed XtqWFV8a4Zt/2726m9o= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20251112074348 20251109064348 49037 nsa.gov. LPRTgOctuKN/zBZ6ahN8GqJ4Hd7CsT4kXPRfcVD6bH4QCsrXK4Vix9eF0QoFi45T6PjylWE6/6as it5HjP9kqxTvg8OdVW/Szz52TUclTFgHQoIQqa++QGbcs4vo3fJliN7ZgoTGK48UyPnC1wt+4avU va7G207DOShaeMrZhFg= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a5-66.akam.net for nsa.gov/SOA
	Received 563 bytes from 95.100.168.66
	;; Response received from [95.100.168.66] 563 octets ;; HEADER SECTION ;; id = 35419 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN SOA ;; ANSWER SECTION (2 records) nsa.gov. 28800 IN SOA ( w000-dsid-u05.nsa.gov. hostmaster.nsa.gov. 2025050611 ;serial 3600 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsa.gov. 28800 IN RRSIG ( SOA 7 2 28800 20251112074348 20251109064348 49037 nsa.gov. Xbk9paw0E+66Nx4kp2hLtkE4FJ8hEZjfdHJFgiu6qnJ16hwBTFh/ryR0cp0xGC8UWpXDAlfjpJFM BAMrYBht4yieAbUFWbTnGYcR3yyoAYIsyt2c3K4BBsFC/AhMmEmkIL4CIWbeNyaL8pk1u+WBDDed XtqWFV8a4Zt/2726m9o= ) ;; AUTHORITY SECTION (7 records) nsa.gov. 28800 IN NS a11-66.akam.net. nsa.gov. 28800 IN NS a1-107.akam.net. nsa.gov. 28800 IN NS a24-65.akam.net. nsa.gov. 28800 IN NS a2-64.akam.net. nsa.gov. 28800 IN NS a12-67.akam.net. nsa.gov. 28800 IN NS a5-66.akam.net. nsa.gov. 28800 IN RRSIG ( NS 7 2 28800 20251112074348 20251109064348 49037 nsa.gov. LPRTgOctuKN/zBZ6ahN8GqJ4Hd7CsT4kXPRfcVD6bH4QCsrXK4Vix9eF0QoFi45T6PjylWE6/6as it5HjP9kqxTvg8OdVW/Szz52TUclTFgHQoIQqa++QGbcs4vo3fJliN7ZgoTGK48UyPnC1wt+4avU va7G207DOShaeMrZhFg= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to a1-107.akam.net for nsa.gov/A
	Received 219 bytes from 193.108.91.107
	;; Response received from [193.108.91.107] 219 octets ;; HEADER SECTION ;; id = 51960 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 104.100.78.31 nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. HK85vCcnBT/M6JQbwSts6vCU4pzGiSJC4M/wGomDR5Ox77E9SrI0yauFkelxta09CpkKdky7dP9B X1NACYw7WQZ67TIWp08uDzB+Omz0PRqtBiKuDktPg/3XmEQJj8sM29SVA/IUl/3vn3Zdg8HNKjK8 8F6+9g+4qMZz1vCJgcY= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nsa.gov A RR has value 104.100.78.31
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. HK85vCcnBT/M6JQbwSts6vCU4pzGiSJC4M/wGomDR5Ox77E9SrI0yauFkelxta09CpkKdky7dP9B X1NACYw7WQZ67TIWp08uDzB+Omz0PRqtBiKuDktPg/3XmEQJj8sM29SVA/IUl/3vn3Zdg8HNKjK8 8F6+9g+4qMZz1vCJgcY= )`
	RRSIG=49037 and DNSKEY=49037 verifies the A RRset

nsa.gov

	Query to a12-67.akam.net for nsa.gov/A
	Received 219 bytes from 184.26.160.67
	;; Response received from [184.26.160.67] 219 octets ;; HEADER SECTION ;; id = 8649 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 173.222.219.183 nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. FG7A8FVlncnvLcHRaJDWR7U4mZG/KPCz7ZA2pQIoGjy9C9YVlIb1SBfO54jjtCInxQtfKN2oK7Rl nG6lGWjJoEU1M2knXrIXDNLk9svKx0qXjqPGak3CWGVWboO2DLctoIQQhtQ1NZfu/nrEidhYRSat xTV9JOkPJTP1Qpd1VfI= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a12-67.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a12-67.akam.net for nsa.gov/A
	Received 219 bytes from 184.26.160.67
	;; Response received from [184.26.160.67] 219 octets ;; HEADER SECTION ;; id = 61049 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.35.164.110 nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. E9TWkJNihMd0oWLtoBLl5whiT4SfQNYwGofZhA9hhTk0fcI0/xg9IGgYySuD5ExtOCVcGRGfbCwj sY9476QTXP1IwBjrDuH37j7+UD4f9mdG0HDRi2EyC1rJ4zwcs3PodgjGaYAl4msincdAE6WgIQqw oh4FsVHqW0zmpCecOrw= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nsa.gov A RR has value 23.35.164.110
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. E9TWkJNihMd0oWLtoBLl5whiT4SfQNYwGofZhA9hhTk0fcI0/xg9IGgYySuD5ExtOCVcGRGfbCwj sY9476QTXP1IwBjrDuH37j7+UD4f9mdG0HDRi2EyC1rJ4zwcs3PodgjGaYAl4msincdAE6WgIQqw oh4FsVHqW0zmpCecOrw= )`
	RRSIG=49037 and DNSKEY=49037 verifies the A RRset

nsa.gov

	Query to a24-65.akam.net for nsa.gov/A
	Received 219 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 219 octets ;; HEADER SECTION ;; id = 32512 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.50.77.69 nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. O+BnhXQNAVJu4n31XghGo3rhyK4szp4QQzXRabhigDhZgCxosthIsIHu+Y7fqZid8rpaiWWixBl3 3+PFkb+j33Fjz+FXTtuUiEj0WXnDLpjfDAKiD12dtJ8o4+GBIY/W5U3bbod+Zxqy2VJROgtASES6 ro3LceIW5JcTl+Fbe5w= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a24-65.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a24-65.akam.net for nsa.gov/A
	Received 219 bytes from 2.16.130.65
	;; Response received from [2.16.130.65] 219 octets ;; HEADER SECTION ;; id = 26942 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.50.77.69 nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. O+BnhXQNAVJu4n31XghGo3rhyK4szp4QQzXRabhigDhZgCxosthIsIHu+Y7fqZid8rpaiWWixBl3 3+PFkb+j33Fjz+FXTtuUiEj0WXnDLpjfDAKiD12dtJ8o4+GBIY/W5U3bbod+Zxqy2VJROgtASES6 ro3LceIW5JcTl+Fbe5w= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nsa.gov A RR has value 23.50.77.69
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. O+BnhXQNAVJu4n31XghGo3rhyK4szp4QQzXRabhigDhZgCxosthIsIHu+Y7fqZid8rpaiWWixBl3 3+PFkb+j33Fjz+FXTtuUiEj0WXnDLpjfDAKiD12dtJ8o4+GBIY/W5U3bbod+Zxqy2VJROgtASES6 ro3LceIW5JcTl+Fbe5w= )`
	RRSIG=49037 and DNSKEY=49037 verifies the A RRset

nsa.gov

	Query to a5-66.akam.net for nsa.gov/A
	Received 219 bytes from 95.100.168.66
	;; Response received from [95.100.168.66] 219 octets ;; HEADER SECTION ;; id = 41966 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 104.81.160.180 nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. Mp9xxSfr4e1yNjf6sxHHbgA37GD1q//Egv7/Lv3s/zycP06kc1ew8lvhxfJnpNkmphv2JfXKmjCH +/cIOCU0flHgvy9+6QEuusErAdHGGk7q9iVI6k1Zx++PkBd6Qikxb0GxqhVdgmtj357ke/L32on1 RiaLG0DDM6BYu8khATA= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a5-66.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a5-66.akam.net for nsa.gov/A
	Received 219 bytes from 95.100.168.66
	;; Response received from [95.100.168.66] 219 octets ;; HEADER SECTION ;; id = 25371 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 104.81.160.180 nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. Mp9xxSfr4e1yNjf6sxHHbgA37GD1q//Egv7/Lv3s/zycP06kc1ew8lvhxfJnpNkmphv2JfXKmjCH +/cIOCU0flHgvy9+6QEuusErAdHGGk7q9iVI6k1Zx++PkBd6Qikxb0GxqhVdgmtj357ke/L32on1 RiaLG0DDM6BYu8khATA= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nsa.gov A RR has value 104.81.160.180
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. Mp9xxSfr4e1yNjf6sxHHbgA37GD1q//Egv7/Lv3s/zycP06kc1ew8lvhxfJnpNkmphv2JfXKmjCH +/cIOCU0flHgvy9+6QEuusErAdHGGk7q9iVI6k1Zx++PkBd6Qikxb0GxqhVdgmtj357ke/L32on1 RiaLG0DDM6BYu8khATA= )`
	RRSIG=49037 and DNSKEY=49037 verifies the A RRset

nsa.gov

	Query to a2-64.akam.net for nsa.gov/A
	Received 219 bytes from 95.100.174.64
	;; Response received from [95.100.174.64] 219 octets ;; HEADER SECTION ;; id = 13899 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 104.81.160.180 nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. Mp9xxSfr4e1yNjf6sxHHbgA37GD1q//Egv7/Lv3s/zycP06kc1ew8lvhxfJnpNkmphv2JfXKmjCH +/cIOCU0flHgvy9+6QEuusErAdHGGk7q9iVI6k1Zx++PkBd6Qikxb0GxqhVdgmtj357ke/L32on1 RiaLG0DDM6BYu8khATA= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a2-64.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a2-64.akam.net for nsa.gov/A
	Received 219 bytes from 95.100.174.64
	;; Response received from [95.100.174.64] 219 octets ;; HEADER SECTION ;; id = 20096 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.65.16.65 nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. ATiM/JZtgpFiSpOHPtpf/mD++7haWrV1rN7vmxdVvjCAvAoi/cHo7rXBB/Ur6CVD51IVl8d8tSbp P4O2+kUj0R+ieD0E+7+q9rTS1691//VSXEiz/ZYp8gR3EwxExksU7IzyRYJFRd+e4w0UPuSGL0oL moMvxnp/Nu1Ne2horBA= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nsa.gov A RR has value 23.65.16.65
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. ATiM/JZtgpFiSpOHPtpf/mD++7haWrV1rN7vmxdVvjCAvAoi/cHo7rXBB/Ur6CVD51IVl8d8tSbp P4O2+kUj0R+ieD0E+7+q9rTS1691//VSXEiz/ZYp8gR3EwxExksU7IzyRYJFRd+e4w0UPuSGL0oL moMvxnp/Nu1Ne2horBA= )`
	RRSIG=49037 and DNSKEY=49037 verifies the A RRset

nsa.gov

	Query to a11-66.akam.net for nsa.gov/A
	Received 219 bytes from 84.53.139.66
	;; Response received from [84.53.139.66] 219 octets ;; HEADER SECTION ;; id = 29847 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.221.109.153 nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. NiZgDkNIh31mc8Y0RnB/pwUIH8Dw9n6XWf5521wBnjGbbLkAqIXzXwZmzofvdly0FytUomudn1gw k7fTBFwAbpgexwFlsEzQefrRhCNJIgeW975nAHXUddfHjs6j+lfKqHV5gWachKTETwJy0MDi9Tbt Qlsnp/sj1coBPg7tAqA= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a11-66.akam.net is authoritative for nsa.gov
	Found RRSIG signed by nsa.gov zone
	Query to a11-66.akam.net for nsa.gov/A
	Received 219 bytes from 84.53.139.66
	;; Response received from [84.53.139.66] 219 octets ;; HEADER SECTION ;; id = 33890 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsa.gov. IN A ;; ANSWER SECTION (2 records) nsa.gov. 20 IN A 23.221.109.153 nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. NiZgDkNIh31mc8Y0RnB/pwUIH8Dw9n6XWf5521wBnjGbbLkAqIXzXwZmzofvdly0FytUomudn1gw k7fTBFwAbpgexwFlsEzQefrRhCNJIgeW975nAHXUddfHjs6j+lfKqHV5gWachKTETwJy0MDi9Tbt Qlsnp/sj1coBPg7tAqA= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	nsa.gov A RR has value 23.221.109.153
	Found 1 RRSIGs over A RRset
	`nsa.gov. 20 IN RRSIG ( A 7 2 20 20251112074348 20251109064348 49037 nsa.gov. NiZgDkNIh31mc8Y0RnB/pwUIH8Dw9n6XWf5521wBnjGbbLkAqIXzXwZmzofvdly0FytUomudn1gw k7fTBFwAbpgexwFlsEzQefrRhCNJIgeW975nAHXUddfHjs6j+lfKqHV5gWachKTETwJy0MDi9Tbt Qlsnp/sj1coBPg7tAqA= )`
	RRSIG=49037 and DNSKEY=49037 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test nsa.gov at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: