DNSSEC Debugger

Back to Verisign Labs Tools

Domain Name:

Detail: more(+) / less(-)

Time: 2026-05-17 18:25:44 UTC

Analyzing DNSSEC problems for nsf.gov

DS=20326/SHA-256 is now in the chain-of-trust

DS=38696/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	`. IN DS ( 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 )`
	Query to b.root-servers.net for ./DNSKEY
	Received 1139 bytes from 170.247.170.2
	;; Response received from [170.247.170.2] 1139 octets ;; HEADER SECTION ;; id = 25109 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAb5dDYffpgAJ8VUGLwQtWXPlQWsjIFJtCM00/XaKU+8ln+ofah3q2KxEIjvzQg+nqdxRj+8e mtPne1mtYcbFWP4Q9E+DniOJLK09R05FuzvGbrG7DDdRDUX/cedFdV7O8pFEAYpJqYNR9BCTIAV9 73DO2biauKSA31b7I2lK/woxoR1tf5cqJ4SMbJUviuHicAEoUi2ATswloZNWd5T5thmEFZnxFx7D 5UgKCY7oflS7+GU7dNJwEtmFnWYVETHN0kHXVz6aguouaAZp706YXNIoR/iTgQhmsR7XX+wL0Z8Q M2LxQIyU6vRZ06IyuJMGRMiwkSuGElbumyBt12JZbrU= ) ; keytag 54393 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20260601000000 20260511000000 20326 . Psn+BsMNwRdKsw1pSQPmOm/QeUqgjveusWdT5NL9sOxccMKpzbYOgLqYNmJsOrAjj0MDy0/X/xbU gAGdRVuOt9mv4yk+TaBs7rpd0IgDZu++2bIAvxu3W82fKEKpJqLucDiPu1l+GKZ87zRYrJrQZZWk 01LmCEIIED9P62/QbhdDVIG3ZdcvXQpRPjWyQOom2tZ0APZ+59PyOxjNMgnOaeoAD8QWZ+iKVY8k o2GRoHRqrzEq46SGDh1YuFxuw67oG7mn+Mt2b9HUjYWgQCvBRSUMb4XRxhNnKQiOS4ECEXCDozMD yXk8727l6bFK0THkaFEqW64F/5CAL8adNRyUoQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAb5dDYffpgAJ8VUGLwQtWXPlQWsjIFJtCM00/XaKU+8ln+ofah3q2KxEIjvzQg+nqdxRj+8e mtPne1mtYcbFWP4Q9E+DniOJLK09R05FuzvGbrG7DDdRDUX/cedFdV7O8pFEAYpJqYNR9BCTIAV9 73DO2biauKSA31b7I2lK/woxoR1tf5cqJ4SMbJUviuHicAEoUi2ATswloZNWd5T5thmEFZnxFx7D 5UgKCY7oflS7+GU7dNJwEtmFnWYVETHN0kHXVz6aguouaAZp706YXNIoR/iTgQhmsR7XX+wL0Z8Q M2LxQIyU6vRZ06IyuJMGRMiwkSuGElbumyBt12JZbrU= ) ; keytag 54393`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	DNSKEY=38696/SEP is now in the chain-of-trust
	DS=38696/SHA-256 verifies DNSKEY=38696/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20260601000000 20260511000000 20326 . Psn+BsMNwRdKsw1pSQPmOm/QeUqgjveusWdT5NL9sOxccMKpzbYOgLqYNmJsOrAjj0MDy0/X/xbU gAGdRVuOt9mv4yk+TaBs7rpd0IgDZu++2bIAvxu3W82fKEKpJqLucDiPu1l+GKZ87zRYrJrQZZWk 01LmCEIIED9P62/QbhdDVIG3ZdcvXQpRPjWyQOom2tZ0APZ+59PyOxjNMgnOaeoAD8QWZ+iKVY8k o2GRoHRqrzEq46SGDh1YuFxuw67oG7mn+Mt2b9HUjYWgQCvBRSUMb4XRxhNnKQiOS4ECEXCDozMD yXk8727l6bFK0THkaFEqW64F/5CAL8adNRyUoQ== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=54393 is now in the chain-of-trust
	Query to g.root-servers.net for nsf.gov/A
	Received 617 bytes from 192.112.36.4
	;; Response received from [192.112.36.4] 617 octets ;; HEADER SECTION ;; id = 23711 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsf.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20260530170000 20260517160000 54393 . XQVvv0JJWx6tTfguN71WsFvGJ0dKtcfnGcARpBI3F12VhDq2PM7VoWW7CSZtZAW0IxNxeO3xYOE1 /n+SbMHaqx1gYBuniL10r9jpUFdbr+sHWZd1Uht8l4DNRbNE6FMh0LAUXjygqSyq84lrXRTvCKEb GjBeaOxv521AJ6kofMs327L+dLI3iCRG5fCpwBi5gUG68IHf40nVV+NvZaCkTmpMrw8/IDdCxQC/ fvi5msf62uvTGkcfcGm769tiO0yeyw8eSUBnC7R0mDJQHylqfRxZByK7Gb2sC7tO5BaIEobJkW0r UcZbd78qAsG0zoSUftb3to6ksBuQ2xHhgbv3qA== ) ;; ADDITIONAL SECTION (9 records) d.ns.gov. 172800 IN A 199.33.233.1 c.ns.gov. 172800 IN A 199.33.232.1 b.ns.gov. 172800 IN A 199.33.231.1 a.ns.gov. 172800 IN A 199.33.230.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 ;; { "EDNS-VERSION": 0 }
	Query to m.root-servers.net for gov/DNSKEY
	Received 613 bytes from 202.12.27.33
	;; Response received from [202.12.27.33] 613 octets ;; HEADER SECTION ;; id = 39727 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20260530170000 20260517160000 54393 . XQVvv0JJWx6tTfguN71WsFvGJ0dKtcfnGcARpBI3F12VhDq2PM7VoWW7CSZtZAW0IxNxeO3xYOE1 /n+SbMHaqx1gYBuniL10r9jpUFdbr+sHWZd1Uht8l4DNRbNE6FMh0LAUXjygqSyq84lrXRTvCKEb GjBeaOxv521AJ6kofMs327L+dLI3iCRG5fCpwBi5gUG68IHf40nVV+NvZaCkTmpMrw8/IDdCxQC/ fvi5msf62uvTGkcfcGm769tiO0yeyw8eSUBnC7R0mDJQHylqfRxZByK7Gb2sC7tO5BaIEobJkW0r UcZbd78qAsG0zoSUftb3to6ksBuQ2xHhgbv3qA== ) ;; ADDITIONAL SECTION (9 records) d.ns.gov. 172800 IN A 199.33.233.1 c.ns.gov. 172800 IN A 199.33.232.1 b.ns.gov. 172800 IN A 199.33.231.1 a.ns.gov. 172800 IN A 199.33.230.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 ;; { "EDNS-VERSION": 0 }
	Found child zone gov

gov

	Checking DS between . and gov
	Query to j.root-servers.net for gov/DS
	Received 367 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 367 octets ;; HEADER SECTION ;; id = 41700 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20260530170000 20260517160000 54393 . XQVvv0JJWx6tTfguN71WsFvGJ0dKtcfnGcARpBI3F12VhDq2PM7VoWW7CSZtZAW0IxNxeO3xYOE1 /n+SbMHaqx1gYBuniL10r9jpUFdbr+sHWZd1Uht8l4DNRbNE6FMh0LAUXjygqSyq84lrXRTvCKEb GjBeaOxv521AJ6kofMs327L+dLI3iCRG5fCpwBi5gUG68IHf40nVV+NvZaCkTmpMrw8/IDdCxQC/ fvi5msf62uvTGkcfcGm769tiO0yeyw8eSUBnC7R0mDJQHylqfRxZByK7Gb2sC7tO5BaIEobJkW0r UcZbd78qAsG0zoSUftb3to6ksBuQ2xHhgbv3qA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for gov in the . zone
	DS=2536/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20260530170000 20260517160000 54393 . XQVvv0JJWx6tTfguN71WsFvGJ0dKtcfnGcARpBI3F12VhDq2PM7VoWW7CSZtZAW0IxNxeO3xYOE1 /n+SbMHaqx1gYBuniL10r9jpUFdbr+sHWZd1Uht8l4DNRbNE6FMh0LAUXjygqSyq84lrXRTvCKEb GjBeaOxv521AJ6kofMs327L+dLI3iCRG5fCpwBi5gUG68IHf40nVV+NvZaCkTmpMrw8/IDdCxQC/ fvi5msf62uvTGkcfcGm769tiO0yeyw8eSUBnC7R0mDJQHylqfRxZByK7Gb2sC7tO5BaIEobJkW0r UcZbd78qAsG0zoSUftb3to6ksBuQ2xHhgbv3qA== )`
	RRSIG=54393 and DNSKEY=54393 verifies the DS RRset
	DS=2536/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 )`
	Query to c.ns.gov for gov/DNSKEY
	Received 291 bytes from 199.33.232.1
	;; Response received from [199.33.232.1] 291 octets ;; HEADER SECTION ;; id = 51731 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536 gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496 gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20260629110631 20260429110631 2536 gov. Qgg1Es4+aI25z77ca9+WmIAaFsRI1wiscuQzcuuAK15yizXJ6wuX65HcUGGl9pFfsu4GhrEbjll6 Nm0OGkUh0A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for gov
	`gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536`
	`gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496`
	DNSKEY=2536/SEP is now in the chain-of-trust
	DS=2536/SHA-256 verifies DNSKEY=2536/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20260629110631 20260429110631 2536 gov. Qgg1Es4+aI25z77ca9+WmIAaFsRI1wiscuQzcuuAK15yizXJ6wuX65HcUGGl9pFfsu4GhrEbjll6 Nm0OGkUh0A== )`
	RRSIG=2536 and DNSKEY=2536/SEP verifies the DNSKEY RRset
	DNSKEY=35496 is now in the chain-of-trust
	Query to b.ns.gov for nsf.gov/A
	Received 417 bytes from 199.33.231.1
	;; Response received from [199.33.231.1] 417 octets ;; HEADER SECTION ;; id = 42499 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 7 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsf.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) nsf.gov. 10800 IN NS ns1.nsf.gov. nsf.gov. 10800 IN NS ns2.nsf.gov. nsf.gov. 10800 IN NS ns3.nsf.gov. nsf.gov. 3600 IN DS ( 15973 5 2 c02f709a230cb7ea0bf5f10e5b7e26df26b44b3d83abe78aa7446c77790c5329 ) nsf.gov. 3600 IN DS ( 29308 5 2 a3e853c43a03d99eb6e2073bb5fb9ef2f1f5f734f1a737f8478cee3ea85195b8 ) nsf.gov. 3600 IN RRSIG ( DS 13 2 3600 20260518192547 20260516172547 35496 gov. wo8IBl9pv0gJ/zkz56o7/U2cM4DtKN9z6/eFCvPGjuwx1vy77HwmA0aWQhIKOLXRM6sVkpfp6sgR 4E/eoTK2VQ== ) ;; ADDITIONAL SECTION (7 records) ns1.nsf.gov. 3600 IN A 128.150.2.55 ns1.nsf.gov. 3600 IN AAAA 2620:10f:6001:2::55 ns2.nsf.gov. 3600 IN A 128.150.2.56 ns2.nsf.gov. 3600 IN AAAA 2620:10f:6001:2::56 ns3.nsf.gov. 3600 IN A 128.150.1.20 ns3.nsf.gov. 3600 IN AAAA 2620:10f:6025:1::20 ;; { "EDNS-VERSION": 0 }
	Query to b.ns.gov for nsf.gov/DNSKEY
	Received 417 bytes from 199.33.231.1
	;; Response received from [199.33.231.1] 417 octets ;; HEADER SECTION ;; id = 21108 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 7 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsf.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) nsf.gov. 10800 IN NS ns1.nsf.gov. nsf.gov. 10800 IN NS ns2.nsf.gov. nsf.gov. 10800 IN NS ns3.nsf.gov. nsf.gov. 3600 IN DS ( 15973 5 2 c02f709a230cb7ea0bf5f10e5b7e26df26b44b3d83abe78aa7446c77790c5329 ) nsf.gov. 3600 IN DS ( 29308 5 2 a3e853c43a03d99eb6e2073bb5fb9ef2f1f5f734f1a737f8478cee3ea85195b8 ) nsf.gov. 3600 IN RRSIG ( DS 13 2 3600 20260518192547 20260516172547 35496 gov. r2pVIucud6SvoL2UuS3n/DpI54ZsroECNDXqe/1JSAEavA289640uAbd9m2A9REgZa6PMZBlMEwq jyTmL7hUIQ== ) ;; ADDITIONAL SECTION (7 records) ns1.nsf.gov. 3600 IN A 128.150.2.55 ns1.nsf.gov. 3600 IN AAAA 2620:10f:6001:2::55 ns2.nsf.gov. 3600 IN A 128.150.2.56 ns2.nsf.gov. 3600 IN AAAA 2620:10f:6001:2::56 ns3.nsf.gov. 3600 IN A 128.150.1.20 ns3.nsf.gov. 3600 IN AAAA 2620:10f:6025:1::20 ;; { "EDNS-VERSION": 0 }
	Found child zone nsf.gov

nsf.gov

	Checking DS between gov and nsf.gov
	Query to d.ns.gov for nsf.gov/DS
	Received 231 bytes from 199.33.233.1
	;; Response received from [199.33.233.1] 231 octets ;; HEADER SECTION ;; id = 52628 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsf.gov. IN DS ;; ANSWER SECTION (3 records) nsf.gov. 3600 IN DS ( 15973 5 2 c02f709a230cb7ea0bf5f10e5b7e26df26b44b3d83abe78aa7446c77790c5329 ) nsf.gov. 3600 IN DS ( 29308 5 2 a3e853c43a03d99eb6e2073bb5fb9ef2f1f5f734f1a737f8478cee3ea85195b8 ) nsf.gov. 3600 IN RRSIG ( DS 13 2 3600 20260518192547 20260516172547 35496 gov. v4P3AtPrzT0RgtQjIIPgYHAyNbz0grpem2X30QkXJcd5d9rZ/gtrekt3/6Kwuf1VUEw6wn/Tx4JG In8dA95E2A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DS records for nsf.gov in the gov zone
	DS=15973/SHA-256 has algorithm RSASHA1
	DS=29308/SHA-256 has algorithm RSASHA1
	Found 1 RRSIGs over DS RRset
	`nsf.gov. 3600 IN RRSIG ( DS 13 2 3600 20260518192547 20260516172547 35496 gov. v4P3AtPrzT0RgtQjIIPgYHAyNbz0grpem2X30QkXJcd5d9rZ/gtrekt3/6Kwuf1VUEw6wn/Tx4JG In8dA95E2A== )`
	RRSIG=35496 and DNSKEY=35496 verifies the DS RRset
	DS=15973/SHA-256 is now in the chain-of-trust
	DS=29308/SHA-256 is now in the chain-of-trust
	`nsf.gov. 3600 IN DS ( 15973 5 2 c02f709a230cb7ea0bf5f10e5b7e26df26b44b3d83abe78aa7446c77790c5329 )`
	`nsf.gov. 3600 IN DS ( 29308 5 2 a3e853c43a03d99eb6e2073bb5fb9ef2f1f5f734f1a737f8478cee3ea85195b8 )`
	Query to ns3.nsf.gov for nsf.gov/DNSKEY
	Received 1237 bytes from 128.150.1.20
	;; Response received from [128.150.1.20] 1237 octets ;; HEADER SECTION ;; id = 30450 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 6 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsf.gov. IN DNSKEY ;; ANSWER SECTION (6 records) nsf.gov. 172800 IN DNSKEY ( 256 3 5 AwEAAcRCmglW5QJlWZh+91zB9sNMLNiQrhcVwIpH+HU9fcTBXa1jtIlaNrI5lCe4f7yUjNJKxRAh 4VbA0JNZzr7IHguuQWmFV1CnJgj/wmI62/GBQmFf9yJ5dT1PigJfTYJ2CBz+ugZfZfPUxk8HT+uY HUj2BA4bnlYu9uDXTurnTB9/ ) ; keytag 52405 nsf.gov. 172800 IN DNSKEY ( 256 3 5 AwEAAbPDfrR0bHevy+61vhWNNvo4Lciv9Xe04ARjnL+/1EvOnRKfihOS9/HgQmQtbAzkuqSAy4WM fPZG3lQq7SRAfOy+V4Kc4FJW6FRPEaIYVb8OyeIsEq9RHthyJaiQQQpUpQggkvavSdAmhXIgdzGj i3yGQmBzu4WKjqnfe10BNDQf ) ; keytag 62800 nsf.gov. 172800 IN DNSKEY ( 257 3 5 AwEAAcgAdLvFYiVcJUiFfb5jZC6nvfPxqXcH/ahUNS5oW0pwTQVg+ZrWfQDCHxzRcjEtA8c2T9XE ZWxRIPeWYDG6bOEFZNuiAPZc1EkLh7DPBzxf7mSUJ+GVfBudqceYCP/ubNxM+kqlYSD79NT/6HUN KGxsjshH6idzC2mpl7BTxLyhllax/MbthTSzOuz/dSuCqr4BW2ZThFNd+lBKeicAym+fZ2hfyGm+ ZjTvSh6t7yEiA5uX1rgK7tOJmkadOTaCDY5sUjrSZnrLCd00siXM3dht6eAuaZ+Tf32MYC279RNy kdI7zzG04U/v2Hh1lXjiF4csnvivHDwhboyrZ3Q69ps= ) ; keytag 29308 nsf.gov. 172800 IN RRSIG ( DNSKEY 5 2 172800 20260521023525 20260517021645 29308 nsf.gov. vu4VCIudRWG/5I/r/+VCOxuCSnjnRU1rR61rz0inJggJc56ggQhdeJ0ERg2Sepzxnd9J7+gm8FZa E59AQ0/VaMISy4vcocqx1RgktYklrxD6ngm8vrT9BK3HHFTzV087GkZlBnv71DewtRQvb/pPErxH MqEaMzmfCLBHgNNAvdhbD6m5x44uM9I+YNLf1+ENaHwuH8XewpE9+6BG2AmQd4SwvTWYsFYJVnC0 5NZfdI+vXZrIv3/Kr2SnA7SvCtWLaxcvQOTdddfE7sYleObKqxNZNtQXP8h4IjhUxHoaezQokZAS 8pe9ObKglycwZ7v/8wanW9xKwpMiDCjoFhTnKg== ) nsf.gov. 172800 IN RRSIG ( DNSKEY 5 2 172800 20260521023525 20260517021645 52405 nsf.gov. OR4fbrWD1m/fE8nUdY2LQzk8jpJ8UQNAxK0xWK/awiHFFxMBNSq6WGtJMHiT+VO71ieudDws5t40 XcgZT5QVZLauhNOmxaR2EMCqVAMA2bZ9KrWskGAnofDgYboCaJN1z+iRtMgNEyN8e7GxJYlMyQvw TFWrheF+toi2PaZXDqA= ) nsf.gov. 172800 IN RRSIG ( DNSKEY 5 2 172800 20260521023525 20260517021645 62800 nsf.gov. Uxa9CcUfxyCWeD6Hg5guwMrf4nL6/cUuR4sGAC6f7TNjvjGLSloqqXqil8I1VUtZgBmMz8KnZZCt xoXKVIi4QVVdeg4xDLp7/BYH5cURxl34DgrF8ME6rWvWjdNUe+wDAqKK1CzS7otDZpjbcVK9yaLq KW11cv9ljM9yQAPfqnc= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for nsf.gov
	`nsf.gov. 172800 IN DNSKEY ( 256 3 5 AwEAAcRCmglW5QJlWZh+91zB9sNMLNiQrhcVwIpH+HU9fcTBXa1jtIlaNrI5lCe4f7yUjNJKxRAh 4VbA0JNZzr7IHguuQWmFV1CnJgj/wmI62/GBQmFf9yJ5dT1PigJfTYJ2CBz+ugZfZfPUxk8HT+uY HUj2BA4bnlYu9uDXTurnTB9/ ) ; keytag 52405`
	`nsf.gov. 172800 IN DNSKEY ( 256 3 5 AwEAAbPDfrR0bHevy+61vhWNNvo4Lciv9Xe04ARjnL+/1EvOnRKfihOS9/HgQmQtbAzkuqSAy4WM fPZG3lQq7SRAfOy+V4Kc4FJW6FRPEaIYVb8OyeIsEq9RHthyJaiQQQpUpQggkvavSdAmhXIgdzGj i3yGQmBzu4WKjqnfe10BNDQf ) ; keytag 62800`
	`nsf.gov. 172800 IN DNSKEY ( 257 3 5 AwEAAcgAdLvFYiVcJUiFfb5jZC6nvfPxqXcH/ahUNS5oW0pwTQVg+ZrWfQDCHxzRcjEtA8c2T9XE ZWxRIPeWYDG6bOEFZNuiAPZc1EkLh7DPBzxf7mSUJ+GVfBudqceYCP/ubNxM+kqlYSD79NT/6HUN KGxsjshH6idzC2mpl7BTxLyhllax/MbthTSzOuz/dSuCqr4BW2ZThFNd+lBKeicAym+fZ2hfyGm+ ZjTvSh6t7yEiA5uX1rgK7tOJmkadOTaCDY5sUjrSZnrLCd00siXM3dht6eAuaZ+Tf32MYC279RNy kdI7zzG04U/v2Hh1lXjiF4csnvivHDwhboyrZ3Q69ps= ) ; keytag 29308`
	DNSKEY=29308/SEP is now in the chain-of-trust
	DS=29308/SHA-256 verifies DNSKEY=29308/SEP
	DS=15973/SHA-256 is published, but a corresponding DNSKEY is not
	Found 3 RRSIGs over DNSKEY RRset
	`nsf.gov. 172800 IN RRSIG ( DNSKEY 5 2 172800 20260521023525 20260517021645 29308 nsf.gov. vu4VCIudRWG/5I/r/+VCOxuCSnjnRU1rR61rz0inJggJc56ggQhdeJ0ERg2Sepzxnd9J7+gm8FZa E59AQ0/VaMISy4vcocqx1RgktYklrxD6ngm8vrT9BK3HHFTzV087GkZlBnv71DewtRQvb/pPErxH MqEaMzmfCLBHgNNAvdhbD6m5x44uM9I+YNLf1+ENaHwuH8XewpE9+6BG2AmQd4SwvTWYsFYJVnC0 5NZfdI+vXZrIv3/Kr2SnA7SvCtWLaxcvQOTdddfE7sYleObKqxNZNtQXP8h4IjhUxHoaezQokZAS 8pe9ObKglycwZ7v/8wanW9xKwpMiDCjoFhTnKg== )`
	`nsf.gov. 172800 IN RRSIG ( DNSKEY 5 2 172800 20260521023525 20260517021645 52405 nsf.gov. OR4fbrWD1m/fE8nUdY2LQzk8jpJ8UQNAxK0xWK/awiHFFxMBNSq6WGtJMHiT+VO71ieudDws5t40 XcgZT5QVZLauhNOmxaR2EMCqVAMA2bZ9KrWskGAnofDgYboCaJN1z+iRtMgNEyN8e7GxJYlMyQvw TFWrheF+toi2PaZXDqA= )`
	`nsf.gov. 172800 IN RRSIG ( DNSKEY 5 2 172800 20260521023525 20260517021645 62800 nsf.gov. Uxa9CcUfxyCWeD6Hg5guwMrf4nL6/cUuR4sGAC6f7TNjvjGLSloqqXqil8I1VUtZgBmMz8KnZZCt xoXKVIi4QVVdeg4xDLp7/BYH5cURxl34DgrF8ME6rWvWjdNUe+wDAqKK1CzS7otDZpjbcVK9yaLq KW11cv9ljM9yQAPfqnc= )`
	RRSIG=29308 and DNSKEY=29308/SEP does not verify the DNSKEY RRset (libcrypto error (SEC.xs line 223)signature verification failed)
	RRSIG=52405 and DNSKEY=52405 does not verify the DNSKEY RRset (libcrypto error (SEC.xs line 223)signature verification failed)
	RRSIG=62800 and DNSKEY=62800 does not verify the DNSKEY RRset (libcrypto error (SEC.xs line 223)signature verification failed)
	None of the 3 RRSIG and 3 DNSKEY records validate the DNSKEY RRset
	The DNSKEY RRset was not signed by any trusted keys
	Query to ns2.nsf.gov for nsf.gov/A
	Received 386 bytes from 128.150.2.56
	;; Response received from [128.150.2.56] 386 octets ;; HEADER SECTION ;; id = 57672 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsf.gov. IN A ;; ANSWER SECTION (3 records) nsf.gov. 10800 IN A 128.150.221.244 nsf.gov. 10800 IN RRSIG ( A 5 2 10800 20260521152730 20260517143413 52405 nsf.gov. I8yjrRO/Pw9ClnGRUb/gR92QmZ4efQPdd7lQWVEGE5mbm6uwDmMuPdd6Oc/girfYumW1nSgHsI6R 8kqvyUOKlakJST2QbPo53yAC57E0HLKncubeXNbBdYsW3iQg3m/dcccANY8X3sXkYxlApxjB0WIk maIdPEFymlc7FWe8ErE= ) nsf.gov. 10800 IN RRSIG ( A 5 2 10800 20260521152730 20260517143413 62800 nsf.gov. XluSxQR8VJB4z83Rvd+PjyGo+J5Yu9uiefht3R9Q/IuXphMTjDLEgqv6mcr04JshruIGPfuuE7hp VfPWbP08vCsQM5FScG0dUYypV2sX0sFzxzLeLZshKgskt8ppXVIF0avSznc65cOCYrG6lWVv70fn Rn/DBH/O7mbokZempOY= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns2.nsf.gov is authoritative for nsf.gov
	Found RRSIG signed by nsf.gov zone
	Query to ns3.nsf.gov for nsf.gov/SOA
	Received 436 bytes from 128.150.1.20
	;; Response received from [128.150.1.20] 436 octets ;; HEADER SECTION ;; id = 19054 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsf.gov. IN SOA ;; ANSWER SECTION (3 records) nsf.gov. 10800 IN SOA ( p-dns-i-gridmstr01.nsf.gov. postmaster.nsf.gov. 397783 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsf.gov. 10800 IN RRSIG ( SOA 5 2 10800 20260521175429 20260517165429 52405 nsf.gov. bUqRMHVToS2w7VW7xBRpInkc8taO02q9nxzAS+T2/elcv8i/9UK+RH/0BICl1yHA5Iuuf0TeCOhe WEeU1SlWp/a0JCsHwl42+pJRitGdU5xe6/z9mcu0PBP2fUX7//jXDmzv2O+6UHxiMqSoRdyb3RQs uMKMv5P7p/6Gv5wXSlM= ) nsf.gov. 10800 IN RRSIG ( SOA 5 2 10800 20260521175429 20260517165429 62800 nsf.gov. pqd3gJFzpBJH4CTDIg+Cm5aCygv1LYpySKIZyMS9Ngnf3YM6DBU4sZ5mU/ElFEtZm4WVJ5ilqhOu e7NtT5Vr2AHPBpMhG7DVzSpPegtkTB6fM+IVc3W6po08mQVXWgMCCMnss7w7psS7sIleYWAuJGmY itTiLPHD+aRVOzEpf44= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns1.nsf.gov for nsf.gov/SOA
	Received 436 bytes from 128.150.2.55
	;; Response received from [128.150.2.55] 436 octets ;; HEADER SECTION ;; id = 37442 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsf.gov. IN SOA ;; ANSWER SECTION (3 records) nsf.gov. 10800 IN SOA ( p-dns-i-gridmstr01.nsf.gov. postmaster.nsf.gov. 397783 ;serial 10800 ;refresh 1080 ;retry 2419200 ;expire 900 ;minimum ) nsf.gov. 10800 IN RRSIG ( SOA 5 2 10800 20260521175429 20260517165429 52405 nsf.gov. bUqRMHVToS2w7VW7xBRpInkc8taO02q9nxzAS+T2/elcv8i/9UK+RH/0BICl1yHA5Iuuf0TeCOhe WEeU1SlWp/a0JCsHwl42+pJRitGdU5xe6/z9mcu0PBP2fUX7//jXDmzv2O+6UHxiMqSoRdyb3RQs uMKMv5P7p/6Gv5wXSlM= ) nsf.gov. 10800 IN RRSIG ( SOA 5 2 10800 20260521175429 20260517165429 62800 nsf.gov. pqd3gJFzpBJH4CTDIg+Cm5aCygv1LYpySKIZyMS9Ngnf3YM6DBU4sZ5mU/ElFEtZm4WVJ5ilqhOu e7NtT5Vr2AHPBpMhG7DVzSpPegtkTB6fM+IVc3W6po08mQVXWgMCCMnss7w7psS7sIleYWAuJGmY itTiLPHD+aRVOzEpf44= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns2.nsf.gov for nsf.gov/A
	nsf.gov A RR has value 128.150.221.244
	Found 2 RRSIGs over A RRset
	`nsf.gov. 10800 IN RRSIG ( A 5 2 10800 20260521152730 20260517143413 52405 nsf.gov. I8yjrRO/Pw9ClnGRUb/gR92QmZ4efQPdd7lQWVEGE5mbm6uwDmMuPdd6Oc/girfYumW1nSgHsI6R 8kqvyUOKlakJST2QbPo53yAC57E0HLKncubeXNbBdYsW3iQg3m/dcccANY8X3sXkYxlApxjB0WIk maIdPEFymlc7FWe8ErE= )`
	`nsf.gov. 10800 IN RRSIG ( A 5 2 10800 20260521152730 20260517143413 62800 nsf.gov. XluSxQR8VJB4z83Rvd+PjyGo+J5Yu9uiefht3R9Q/IuXphMTjDLEgqv6mcr04JshruIGPfuuE7hp VfPWbP08vCsQM5FScG0dUYypV2sX0sFzxzLeLZshKgskt8ppXVIF0avSznc65cOCYrG6lWVv70fn Rn/DBH/O7mbokZempOY= )`
	RRSIG=52405 and DNSKEY=52405 does not verify the A RRset (libcrypto error (SEC.xs line 223)signature verification failed)
	RRSIG=62800 and DNSKEY=62800 does not verify the A RRset (libcrypto error (SEC.xs line 223)signature verification failed)
	None of the 2 RRSIG and 3 DNSKEY records validate the A RRset

nsf.gov

	Query to ns1.nsf.gov for nsf.gov/A
	Received 386 bytes from 128.150.2.55
	;; Response received from [128.150.2.55] 386 octets ;; HEADER SECTION ;; id = 37377 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsf.gov. IN A ;; ANSWER SECTION (3 records) nsf.gov. 10800 IN A 128.150.221.244 nsf.gov. 10800 IN RRSIG ( A 5 2 10800 20260521152730 20260517143413 52405 nsf.gov. I8yjrRO/Pw9ClnGRUb/gR92QmZ4efQPdd7lQWVEGE5mbm6uwDmMuPdd6Oc/girfYumW1nSgHsI6R 8kqvyUOKlakJST2QbPo53yAC57E0HLKncubeXNbBdYsW3iQg3m/dcccANY8X3sXkYxlApxjB0WIk maIdPEFymlc7FWe8ErE= ) nsf.gov. 10800 IN RRSIG ( A 5 2 10800 20260521152730 20260517143413 62800 nsf.gov. XluSxQR8VJB4z83Rvd+PjyGo+J5Yu9uiefht3R9Q/IuXphMTjDLEgqv6mcr04JshruIGPfuuE7hp VfPWbP08vCsQM5FScG0dUYypV2sX0sFzxzLeLZshKgskt8ppXVIF0avSznc65cOCYrG6lWVv70fn Rn/DBH/O7mbokZempOY= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns1.nsf.gov is authoritative for nsf.gov
	Found RRSIG signed by nsf.gov zone
	Query to ns1.nsf.gov for nsf.gov/A
	nsf.gov A RR has value 128.150.221.244
	Found 2 RRSIGs over A RRset
	`nsf.gov. 10800 IN RRSIG ( A 5 2 10800 20260521152730 20260517143413 52405 nsf.gov. I8yjrRO/Pw9ClnGRUb/gR92QmZ4efQPdd7lQWVEGE5mbm6uwDmMuPdd6Oc/girfYumW1nSgHsI6R 8kqvyUOKlakJST2QbPo53yAC57E0HLKncubeXNbBdYsW3iQg3m/dcccANY8X3sXkYxlApxjB0WIk maIdPEFymlc7FWe8ErE= )`
	`nsf.gov. 10800 IN RRSIG ( A 5 2 10800 20260521152730 20260517143413 62800 nsf.gov. XluSxQR8VJB4z83Rvd+PjyGo+J5Yu9uiefht3R9Q/IuXphMTjDLEgqv6mcr04JshruIGPfuuE7hp VfPWbP08vCsQM5FScG0dUYypV2sX0sFzxzLeLZshKgskt8ppXVIF0avSznc65cOCYrG6lWVv70fn Rn/DBH/O7mbokZempOY= )`
	RRSIG=52405 and DNSKEY=52405 does not verify the A RRset (libcrypto error (SEC.xs line 223)signature verification failed)
	RRSIG=62800 and DNSKEY=62800 does not verify the A RRset (libcrypto error (SEC.xs line 223)signature verification failed)
	None of the 2 RRSIG and 3 DNSKEY records validate the A RRset

nsf.gov

	Query to ns3.nsf.gov for nsf.gov/A
	Received 386 bytes from 128.150.1.20
	;; Response received from [128.150.1.20] 386 octets ;; HEADER SECTION ;; id = 54907 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1220, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; nsf.gov. IN A ;; ANSWER SECTION (3 records) nsf.gov. 10800 IN A 128.150.221.244 nsf.gov. 10800 IN RRSIG ( A 5 2 10800 20260521152730 20260517143413 52405 nsf.gov. I8yjrRO/Pw9ClnGRUb/gR92QmZ4efQPdd7lQWVEGE5mbm6uwDmMuPdd6Oc/girfYumW1nSgHsI6R 8kqvyUOKlakJST2QbPo53yAC57E0HLKncubeXNbBdYsW3iQg3m/dcccANY8X3sXkYxlApxjB0WIk maIdPEFymlc7FWe8ErE= ) nsf.gov. 10800 IN RRSIG ( A 5 2 10800 20260521152730 20260517143413 62800 nsf.gov. XluSxQR8VJB4z83Rvd+PjyGo+J5Yu9uiefht3R9Q/IuXphMTjDLEgqv6mcr04JshruIGPfuuE7hp VfPWbP08vCsQM5FScG0dUYypV2sX0sFzxzLeLZshKgskt8ppXVIF0avSznc65cOCYrG6lWVv70fn Rn/DBH/O7mbokZempOY= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns3.nsf.gov is authoritative for nsf.gov
	Found RRSIG signed by nsf.gov zone
	Query to ns3.nsf.gov for nsf.gov/A
	nsf.gov A RR has value 128.150.221.244
	Found 2 RRSIGs over A RRset
	`nsf.gov. 10800 IN RRSIG ( A 5 2 10800 20260521152730 20260517143413 52405 nsf.gov. I8yjrRO/Pw9ClnGRUb/gR92QmZ4efQPdd7lQWVEGE5mbm6uwDmMuPdd6Oc/girfYumW1nSgHsI6R 8kqvyUOKlakJST2QbPo53yAC57E0HLKncubeXNbBdYsW3iQg3m/dcccANY8X3sXkYxlApxjB0WIk maIdPEFymlc7FWe8ErE= )`
	`nsf.gov. 10800 IN RRSIG ( A 5 2 10800 20260521152730 20260517143413 62800 nsf.gov. XluSxQR8VJB4z83Rvd+PjyGo+J5Yu9uiefht3R9Q/IuXphMTjDLEgqv6mcr04JshruIGPfuuE7hp VfPWbP08vCsQM5FScG0dUYypV2sX0sFzxzLeLZshKgskt8ppXVIF0avSznc65cOCYrG6lWVv70fn Rn/DBH/O7mbokZempOY= )`
	RRSIG=52405 and DNSKEY=52405 does not verify the A RRset (libcrypto error (SEC.xs line 223)signature verification failed)
	RRSIG=62800 and DNSKEY=62800 does not verify the A RRset (libcrypto error (SEC.xs line 223)signature verification failed)
	None of the 2 RRSIG and 3 DNSKEY records validate the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test nsf.gov at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: