DNSSEC Analyzer

Domain Name:

Time: 2023-12-08 02:48:43 UTC, NTP stratum 16

Analyzing DNSSEC problems for pie.ma

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to c.root-servers.net for ./DNSKEY
	Received 865 bytes from 192.33.4.12
	;; Response received from 192.33.4.12 (865 octets) ;; HEADER SECTION ;; id = 37848 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN DNSKEY ( 256 3 8 AwEAAddS95RV5uUtkUCN7vyvpb0kDZgmtXwN5Sj/d08+X7ND2sgWBabKnFhftrOsSx9DUhKR3gpM PIxac84Nou8Wzkiu2A/sTzP1F6KpCL8epgemdlZVd1ATHEjpB0KHIQmDjSEO/frGgi8ijQ2vDF3A MSrUwH7qntL1E5ufPHGKRM+agGghcAYfJHJN1dw7Ki3Fo22RDB3VZBxU9yJ3vl/T4hngeL7zK84v gl62tlJJw1rK5S/3U4p/bZarjtMFOHDfh0DEj1ywtRpkpPnge03gmINoa2tz+Kff67kbQb0NhHJY zPRpViaMEWZI9pgGH9ZyuFdNrNRx68XSiO7sya7/i+c= ) ; Key ID = 46780 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20231221000000 20231130000000 20326 . Vq+Z0sYiDdI6V+KCvfoTAYNxmsKiv703Lxyy4OREQPew0qYrrUySU54Jn+NiOlkHLm+o83YW7ZZ0 eyikQKrt42dD2Hdigy7YiOeML1W3wqkZYDg/DoHo5i8zP+B6461Z/yVrjkcTSgM6C8FZuOaDqj5X PMghMfDo0fQy0spEL6rtLzGNXDZ+j5D+hcoQPYtZu9svhm9AHqZoXLu5id7whpsVJhON4BM1pQRF 7JSlTIi0cn7SGhFpfypnj/2E5hUvJ1bRRkr+wItfi7B4+b19lDNgtLZiDs3opRMmStbaF3HEFgTh UZ+HcCRzQASdyuZ4Y8xr1SUX/MpSlct5EBFshg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAddS95RV5uUtkUCN7vyvpb0kDZgmtXwN5Sj/d08+X7ND2sgWBabKnFhftrOsSx9DUhKR3gpM PIxac84Nou8Wzkiu2A/sTzP1F6KpCL8epgemdlZVd1ATHEjpB0KHIQmDjSEO/frGgi8ijQ2vDF3A MSrUwH7qntL1E5ufPHGKRM+agGghcAYfJHJN1dw7Ki3Fo22RDB3VZBxU9yJ3vl/T4hngeL7zK84v gl62tlJJw1rK5S/3U4p/bZarjtMFOHDfh0DEj1ywtRpkpPnge03gmINoa2tz+Kff67kbQb0NhHJY zPRpViaMEWZI9pgGH9ZyuFdNrNRx68XSiO7sya7/i+c= ) ; Key ID = 46780`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20231221000000 20231130000000 20326 . Vq+Z0sYiDdI6V+KCvfoTAYNxmsKiv703Lxyy4OREQPew0qYrrUySU54Jn+NiOlkHLm+o83YW7ZZ0 eyikQKrt42dD2Hdigy7YiOeML1W3wqkZYDg/DoHo5i8zP+B6461Z/yVrjkcTSgM6C8FZuOaDqj5X PMghMfDo0fQy0spEL6rtLzGNXDZ+j5D+hcoQPYtZu9svhm9AHqZoXLu5id7whpsVJhON4BM1pQRF 7JSlTIi0cn7SGhFpfypnj/2E5hUvJ1bRRkr+wItfi7B4+b19lDNgtLZiDs3opRMmStbaF3HEFgTh UZ+HcCRzQASdyuZ4Y8xr1SUX/MpSlct5EBFshg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=46780 is now in the chain-of-trust
	Query to e.root-servers.net for pie.ma/A
	Received 880 bytes from 192.203.230.10
	;; Response received from 192.203.230.10 (880 octets) ;; HEADER SECTION ;; id = 40891 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 10 arcount = 19 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option: ;; QUESTION SECTION (1 record) ;; pie.ma. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (10 records) ma. 172800 IN NS a.tld.ma. ma. 172800 IN NS b.tld.ma. ma. 172800 IN NS c.tld.ma. ma. 172800 IN NS d.tld.ma. ma. 172800 IN NS e.tld.ma. ma. 172800 IN NS f.tld.ma. ma. 172800 IN NS dns.inria.fr. ma. 172800 IN NS ns-ma.nic.fr. ma. 86400 IN DS ( 41102 8 2 ec91608875e8628e96fb65403d828e0782103ee815fd7e0b67ecccab4b44ef56 ) ma. 86400 IN RRSIG ( DS 8 1 86400 20231220220000 20231207210000 46780 . nPwiI3PmO/MQdz0MMcgFPjyxSSy0YjPUDpwAlIeAGU3km5lIinnOW6mNJhgcykFFkzXAojG/oQsl 1M5d0ZgDNRYhRVzvQVJ59PQx0Y6y8zmrLl9+pAg1kKvwPEBtjbhz5yfPtADvqPdrtc39qrTi22VF NML8ehrM5ssT5Nof8FEaPlJE9ojPBXJQ4DrRsu26TElX3V7prgCIYI/VyZ+7y4vvPTVWbUTCXNFZ bMYsguO4RJcoDXlv7nDtSTCVcBkig5Bfap45ZBxD4tmcjgeV5YxUL2r20VAsbMjJxOBRwU25I9oc KnClxK7tHqgUyoqathQS+KF52fTUpa3nUcqaYA== ) ;; ADDITIONAL SECTION (19 records) a.tld.ma. 172800 IN A 81.192.171.83 a.tld.ma. 172800 IN A 81.192.171.131 a.tld.ma. 172800 IN AAAA 2001:4288:1800:186::3 b.tld.ma. 172800 IN A 81.192.171.84 b.tld.ma. 172800 IN A 81.192.171.132 b.tld.ma. 172800 IN AAAA 2001:4288:1800:186::4 c.tld.ma. 172800 IN A 81.192.171.115 c.tld.ma. 172800 IN A 81.192.171.139 c.tld.ma. 172800 IN AAAA 2001:4288:1800:386::3 d.tld.ma. 172800 IN A 81.192.171.116 d.tld.ma. 172800 IN A 81.192.171.140 d.tld.ma. 172800 IN AAAA 2001:4288:1800:386::4 e.tld.ma. 172800 IN A 105.73.80.236 f.tld.ma. 172800 IN A 41.214.240.4 f.tld.ma. 172800 IN AAAA 2c0f:fb20:100:fc::33 dns.inria.fr. 172800 IN A 193.51.208.13 ns-ma.nic.fr. 172800 IN A 194.0.9.1 ns-ma.nic.fr. 172800 IN AAAA 2001:678:c::1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option:
	Query to d.root-servers.net for ma/DNSKEY
	Received 876 bytes from 199.7.91.13
	;; Response received from 199.7.91.13 (876 octets) ;; HEADER SECTION ;; id = 4800 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 10 arcount = 19 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1450 ;; option: ;; QUESTION SECTION (1 record) ;; ma. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (10 records) ma. 172800 IN NS a.tld.ma. ma. 172800 IN NS b.tld.ma. ma. 172800 IN NS c.tld.ma. ma. 172800 IN NS d.tld.ma. ma. 172800 IN NS e.tld.ma. ma. 172800 IN NS f.tld.ma. ma. 172800 IN NS dns.inria.fr. ma. 172800 IN NS ns-ma.nic.fr. ma. 86400 IN DS ( 41102 8 2 ec91608875e8628e96fb65403d828e0782103ee815fd7e0b67ecccab4b44ef56 ) ma. 86400 IN RRSIG ( DS 8 1 86400 20231220220000 20231207210000 46780 . nPwiI3PmO/MQdz0MMcgFPjyxSSy0YjPUDpwAlIeAGU3km5lIinnOW6mNJhgcykFFkzXAojG/oQsl 1M5d0ZgDNRYhRVzvQVJ59PQx0Y6y8zmrLl9+pAg1kKvwPEBtjbhz5yfPtADvqPdrtc39qrTi22VF NML8ehrM5ssT5Nof8FEaPlJE9ojPBXJQ4DrRsu26TElX3V7prgCIYI/VyZ+7y4vvPTVWbUTCXNFZ bMYsguO4RJcoDXlv7nDtSTCVcBkig5Bfap45ZBxD4tmcjgeV5YxUL2r20VAsbMjJxOBRwU25I9oc KnClxK7tHqgUyoqathQS+KF52fTUpa3nUcqaYA== ) ;; ADDITIONAL SECTION (19 records) a.tld.ma. 172800 IN A 81.192.171.83 a.tld.ma. 172800 IN A 81.192.171.131 b.tld.ma. 172800 IN A 81.192.171.84 b.tld.ma. 172800 IN A 81.192.171.132 c.tld.ma. 172800 IN A 81.192.171.115 c.tld.ma. 172800 IN A 81.192.171.139 d.tld.ma. 172800 IN A 81.192.171.116 d.tld.ma. 172800 IN A 81.192.171.140 e.tld.ma. 172800 IN A 105.73.80.236 f.tld.ma. 172800 IN A 41.214.240.4 dns.inria.fr. 172800 IN A 193.51.208.13 ns-ma.nic.fr. 172800 IN A 194.0.9.1 a.tld.ma. 172800 IN AAAA 2001:4288:1800:186::3 b.tld.ma. 172800 IN AAAA 2001:4288:1800:186::4 c.tld.ma. 172800 IN AAAA 2001:4288:1800:386::3 d.tld.ma. 172800 IN AAAA 2001:4288:1800:386::4 f.tld.ma. 172800 IN AAAA 2c0f:fb20:100:fc::33 ns-ma.nic.fr. 172800 IN AAAA 2001:678:c::1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1450 ;; option:
	Found child zone ma

	Checking DS between . and ma
	Query to f.root-servers.net for ma/DS
	Received 366 bytes from 192.5.5.241
	;; Response received from 192.5.5.241 (366 octets) ;; HEADER SECTION ;; id = 12495 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option: ;; QUESTION SECTION (1 record) ;; ma. IN DS ;; ANSWER SECTION (2 records) ma. 86400 IN DS ( 41102 8 2 ec91608875e8628e96fb65403d828e0782103ee815fd7e0b67ecccab4b44ef56 ) ma. 86400 IN RRSIG ( DS 8 1 86400 20231220220000 20231207210000 46780 . nPwiI3PmO/MQdz0MMcgFPjyxSSy0YjPUDpwAlIeAGU3km5lIinnOW6mNJhgcykFFkzXAojG/oQsl 1M5d0ZgDNRYhRVzvQVJ59PQx0Y6y8zmrLl9+pAg1kKvwPEBtjbhz5yfPtADvqPdrtc39qrTi22VF NML8ehrM5ssT5Nof8FEaPlJE9ojPBXJQ4DrRsu26TElX3V7prgCIYI/VyZ+7y4vvPTVWbUTCXNFZ bMYsguO4RJcoDXlv7nDtSTCVcBkig5Bfap45ZBxD4tmcjgeV5YxUL2r20VAsbMjJxOBRwU25I9oc KnClxK7tHqgUyoqathQS+KF52fTUpa3nUcqaYA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option:
	Found 1 DS records for ma in the . zone
	DS=41102/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`ma. 86400 IN RRSIG ( DS 8 1 86400 20231220220000 20231207210000 46780 . nPwiI3PmO/MQdz0MMcgFPjyxSSy0YjPUDpwAlIeAGU3km5lIinnOW6mNJhgcykFFkzXAojG/oQsl 1M5d0ZgDNRYhRVzvQVJ59PQx0Y6y8zmrLl9+pAg1kKvwPEBtjbhz5yfPtADvqPdrtc39qrTi22VF NML8ehrM5ssT5Nof8FEaPlJE9ojPBXJQ4DrRsu26TElX3V7prgCIYI/VyZ+7y4vvPTVWbUTCXNFZ bMYsguO4RJcoDXlv7nDtSTCVcBkig5Bfap45ZBxD4tmcjgeV5YxUL2r20VAsbMjJxOBRwU25I9oc KnClxK7tHqgUyoqathQS+KF52fTUpa3nUcqaYA== )`
	RRSIG=46780 and DNSKEY=46780 verifies the DS RRset
	DS=41102/SHA-256 is now in the chain-of-trust
	`ma. 86400 IN DS ( 41102 8 2 ec91608875e8628e96fb65403d828e0782103ee815fd7e0b67ecccab4b44ef56 )`
	Query to dns.inria.fr for ma/DNSKEY
	Received 1621 bytes from 193.51.208.13
	;; Response received from 193.51.208.13 (1621 octets) ;; HEADER SECTION ;; id = 65467 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 7 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; ma. IN DNSKEY ;; ANSWER SECTION (7 records) ma. 1296000 IN DNSKEY ( 257 3 8 AwEAAe4qoqSfzY5PLjQ+pRlH8i+AybsRckFGFrridTRXu8pUkMwnfpt7xLOKGdcVCOs6YvUfJd5v KWfWoD8mg+qcO07znXZVbwhQYSITwAs5HMiMDi+bb1l5G0P0F040ajJPm5qwyWsjmYQZlaXZVlOm GTNHqi99lk2Q6LMCbCrxCIvMJDBr+3s++tvWC140QLI1kPcDbRO6PphlsqMQjd4Rs0O9mBTCwfWr WQyH5Bo8oOdPgmdeEkOsia8AnH/m1XpnNcbaXO8lthpKiT4PS2kcC9H+z1mS+euzOTf3LVttsWD0 KNpc3NzXLBYLH2sObOscIR49NP0SUMoMTHr1J04Tw20= ) ; Key ID = 41102 ma. 1296000 IN DNSKEY ( 256 3 8 AwEAAcpsyBb6qfkAaFDjcwyfrK6phBupKzo8tORcguGS5ortMCnQpUT7KoHN9dijJ7fn5nPokeYH 56NF+srh9r08JWKMiWiTuDh+3+SScaJJW7uONDHLoJ/nRT0lba88iqPPSCwWh8nSUvNoOX6foZJ+ B+Cr3pdjDAs3mbzj8cSdvH2d ) ; Key ID = 46141 ma. 1296000 IN DNSKEY ( 257 3 8 AwEAAcSVIAQfBj8XFiYFyle3TsvQcrc0DZnmte8SZ3eHW7PBgAbi9ag0B1pzxj+dt9JjfyVoWO7e Z8JfOGnEU7OM4TKMzfq4pjXtCRO4Fi0UpP+ND72x2rDqlAjn6CcRSeUPIdYXNVJ7uUbz+QOCwyCe aOx5W8k6H3KTWl7ZbL9S8qbs3BSE1Mil6Esm3tZKc7Jx72o40OAob5bqGRAqKnGFm3Blir+Q+9PF ksfm0GGcBOh8Bytl3E9a1xXzkIMiXOLS+YGXVf+kc/simX2Qfn9aYvXhbRVd9WmWPWAILAz9nxE+ GznnUeo/VCo9u7oug7Zco7AQOox8Ub6Om9u1rtRyKd8= ) ; Key ID = 44392 ma. 1296000 IN DNSKEY ( 256 3 8 AwEAAcAmUoeV0LTOZPkcod0zd/+Ta3yjReISc/r2oAw2WEQ3nC2XISUhkl9gRZTNSqDLWc7kXn8Q 44yfhjCNQ4FwJ7H1X52Dl3AwKncIjfZAWbP0mKTaXGKLQPZWGtTGul2flXfSi9R3m81p6eDUuJLz kmfWiVD++BUO3YghQmCLP/FV ) ; Key ID = 51148 ma. 1296000 IN RRSIG ( DNSKEY 8 1 1296000 20240103204227 20231204195330 41102 ma. CEfXFto/mnIY3DJaqPb5li/PZTpqpkD7Byb+MZ0h2rlY9aQCJpMH3S+xgbo4TLcyP9u+szLTI4iF uz+U9bp+GkrXmbhzczYXIGOYq6xew9xQtGYb3HM6wKbaaLLV0lM/OFh8Co5cx0OKq5hJw3wko156 NdKygKdoVtuztaNQrsZrDGh1taeyAv3dFWS/fqYls263DrEe5n4XIufiSnKGlp+lRBiW9K22K2GW HlUPIimqhbOL8GhigBAv4rCZ5VxhNsp7V7C7N8bFbbqQL9LioETXvUA92LrWdUuv2X+bMavxT3MQ ofQM6t3xwPJcSBo431Foc8S7ZuIbgMZ6ZeDLjA== ) ma. 1296000 IN RRSIG ( DNSKEY 8 1 1296000 20240103204227 20231204195330 44392 ma. Pe0WGy/TtFV2sEakOBMKnjqfl4VzWHqCo6YvFUZAF8FrpyeO+e0YeixC4LW26mp9O2yBWgyDrNRr GtHhmWOOGupP3lxXpgFF4LelmXfuO3Pvr90vCaLvVMgiqjN6bykrILs1MRsvbd7fquRsHnhHngct das98fp7bqpKOrp53SHk6BxWw+HRQiH9MPVpFU/+vgUhyGsxEX2qKXY3COsvP0lHUYHGMYz4fm+2 3smCYFPNBzKzYIqwIbKY2WKPpY9VGofTiXedE7H8qznqaPZjjz66uU2rPOPlGNyTUOULeQwRhelr qiEktDVEWELKCM4Bscdx2hJYKq2fTsk9A31UFw== ) ma. 1296000 IN RRSIG ( DNSKEY 8 1 1296000 20240103204227 20231204195330 51148 ma. L0OzLFsXOwgcmlXUlAkeBQVCW6CEmhPviPe30KkZeVfVahiVZU70LuUmtcccANS2yBt3Jmnsdr2T viwnNsyw3CJdaVJl4hGE9cxaOYF86UOW7tc8V+2X+wnAOsu1kOCHNp3D8HClYoMfj9EKUz8Q/eyO sqR0v5SIIfMMFCWqI3M= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 4 DNSKEY records for ma
	`ma. 1296000 IN DNSKEY ( 257 3 8 AwEAAe4qoqSfzY5PLjQ+pRlH8i+AybsRckFGFrridTRXu8pUkMwnfpt7xLOKGdcVCOs6YvUfJd5v KWfWoD8mg+qcO07znXZVbwhQYSITwAs5HMiMDi+bb1l5G0P0F040ajJPm5qwyWsjmYQZlaXZVlOm GTNHqi99lk2Q6LMCbCrxCIvMJDBr+3s++tvWC140QLI1kPcDbRO6PphlsqMQjd4Rs0O9mBTCwfWr WQyH5Bo8oOdPgmdeEkOsia8AnH/m1XpnNcbaXO8lthpKiT4PS2kcC9H+z1mS+euzOTf3LVttsWD0 KNpc3NzXLBYLH2sObOscIR49NP0SUMoMTHr1J04Tw20= ) ; Key ID = 41102`
	`ma. 1296000 IN DNSKEY ( 256 3 8 AwEAAcpsyBb6qfkAaFDjcwyfrK6phBupKzo8tORcguGS5ortMCnQpUT7KoHN9dijJ7fn5nPokeYH 56NF+srh9r08JWKMiWiTuDh+3+SScaJJW7uONDHLoJ/nRT0lba88iqPPSCwWh8nSUvNoOX6foZJ+ B+Cr3pdjDAs3mbzj8cSdvH2d ) ; Key ID = 46141`
	`ma. 1296000 IN DNSKEY ( 257 3 8 AwEAAcSVIAQfBj8XFiYFyle3TsvQcrc0DZnmte8SZ3eHW7PBgAbi9ag0B1pzxj+dt9JjfyVoWO7e Z8JfOGnEU7OM4TKMzfq4pjXtCRO4Fi0UpP+ND72x2rDqlAjn6CcRSeUPIdYXNVJ7uUbz+QOCwyCe aOx5W8k6H3KTWl7ZbL9S8qbs3BSE1Mil6Esm3tZKc7Jx72o40OAob5bqGRAqKnGFm3Blir+Q+9PF ksfm0GGcBOh8Bytl3E9a1xXzkIMiXOLS+YGXVf+kc/simX2Qfn9aYvXhbRVd9WmWPWAILAz9nxE+ GznnUeo/VCo9u7oug7Zco7AQOox8Ub6Om9u1rtRyKd8= ) ; Key ID = 44392`
	`ma. 1296000 IN DNSKEY ( 256 3 8 AwEAAcAmUoeV0LTOZPkcod0zd/+Ta3yjReISc/r2oAw2WEQ3nC2XISUhkl9gRZTNSqDLWc7kXn8Q 44yfhjCNQ4FwJ7H1X52Dl3AwKncIjfZAWbP0mKTaXGKLQPZWGtTGul2flXfSi9R3m81p6eDUuJLz kmfWiVD++BUO3YghQmCLP/FV ) ; Key ID = 51148`
	DNSKEY=41102/SEP is now in the chain-of-trust
	DS=41102/SHA-256 verifies DNSKEY=41102/SEP
	Found 3 RRSIGs over DNSKEY RRset
	`ma. 1296000 IN RRSIG ( DNSKEY 8 1 1296000 20240103204227 20231204195330 41102 ma. CEfXFto/mnIY3DJaqPb5li/PZTpqpkD7Byb+MZ0h2rlY9aQCJpMH3S+xgbo4TLcyP9u+szLTI4iF uz+U9bp+GkrXmbhzczYXIGOYq6xew9xQtGYb3HM6wKbaaLLV0lM/OFh8Co5cx0OKq5hJw3wko156 NdKygKdoVtuztaNQrsZrDGh1taeyAv3dFWS/fqYls263DrEe5n4XIufiSnKGlp+lRBiW9K22K2GW HlUPIimqhbOL8GhigBAv4rCZ5VxhNsp7V7C7N8bFbbqQL9LioETXvUA92LrWdUuv2X+bMavxT3MQ ofQM6t3xwPJcSBo431Foc8S7ZuIbgMZ6ZeDLjA== )`
	`ma. 1296000 IN RRSIG ( DNSKEY 8 1 1296000 20240103204227 20231204195330 44392 ma. Pe0WGy/TtFV2sEakOBMKnjqfl4VzWHqCo6YvFUZAF8FrpyeO+e0YeixC4LW26mp9O2yBWgyDrNRr GtHhmWOOGupP3lxXpgFF4LelmXfuO3Pvr90vCaLvVMgiqjN6bykrILs1MRsvbd7fquRsHnhHngct das98fp7bqpKOrp53SHk6BxWw+HRQiH9MPVpFU/+vgUhyGsxEX2qKXY3COsvP0lHUYHGMYz4fm+2 3smCYFPNBzKzYIqwIbKY2WKPpY9VGofTiXedE7H8qznqaPZjjz66uU2rPOPlGNyTUOULeQwRhelr qiEktDVEWELKCM4Bscdx2hJYKq2fTsk9A31UFw== )`
	`ma. 1296000 IN RRSIG ( DNSKEY 8 1 1296000 20240103204227 20231204195330 51148 ma. L0OzLFsXOwgcmlXUlAkeBQVCW6CEmhPviPe30KkZeVfVahiVZU70LuUmtcccANS2yBt3Jmnsdr2T viwnNsyw3CJdaVJl4hGE9cxaOYF86UOW7tc8V+2X+wnAOsu1kOCHNp3D8HClYoMfj9EKUz8Q/eyO sqR0v5SIIfMMFCWqI3M= )`
	RRSIG=41102 and DNSKEY=41102/SEP verifies the DNSKEY RRset
	RRSIG=44392 and DNSKEY=44392/SEP verifies the DNSKEY RRset
	RRSIG=51148 and DNSKEY=51148 verifies the DNSKEY RRset
	DNSKEY=46141 is now in the chain-of-trust
	DNSKEY=44392/SEP is now in the chain-of-trust
	DNSKEY=51148 is now in the chain-of-trust
	Query to f.tld.ma for pie.ma/A
	Received 343 bytes from 41.214.240.4
	;; Response received from 41.214.240.4 (343 octets) ;; HEADER SECTION ;; id = 55820 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; pie.ma. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) pie.ma. 108000 IN NS thomas.ns.cloudflare.com. pie.ma. 108000 IN NS becky.ns.cloudflare.com. PJ8BE0MLOJPVDHSLPNNNFML13HEHOFRV.ma. 1800 IN NSEC3 ( 1 0 10 29a582570bdf7832b47166a23f1b pj996ph81sihoo5iv9enjsh97gjvp4s1 NS ) PJ8BE0MLOJPVDHSLPNNNFML13HEHOFRV.ma. 1800 IN RRSIG ( NSEC3 8 2 1800 20240105174925 20231206165715 51148 ma. reXhA4w43h2D1K+y+U92O78qB8fL63kN62LmFK7SO9qa5LnXPJInzbTPLk692uY57LWIqkBD1bKc 16SsLeu220TqOHm0G98bog3J7Yp31JWAG8KH6jPeecG+sVST0vwW5oo5aNaDxH/2mdQEGLtVmn55 wJ3LnycdYmH8rLFaDU8= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to a.tld.ma for pie.ma/DNSKEY
	Received 343 bytes from 81.192.171.131
	;; Response received from 81.192.171.131 (343 octets) ;; HEADER SECTION ;; id = 46974 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option: ;; QUESTION SECTION (1 record) ;; pie.ma. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) pie.ma. 108000 IN NS becky.ns.cloudflare.com. pie.ma. 108000 IN NS thomas.ns.cloudflare.com. PJ8BE0MLOJPVDHSLPNNNFML13HEHOFRV.ma. 1800 IN NSEC3 ( 1 0 10 29a582570bdf7832b47166a23f1b pj996ph81sihoo5iv9enjsh97gjvp4s1 NS ) PJ8BE0MLOJPVDHSLPNNNFML13HEHOFRV.ma. 1800 IN RRSIG ( NSEC3 8 2 1800 20240105174925 20231206165715 51148 ma. reXhA4w43h2D1K+y+U92O78qB8fL63kN62LmFK7SO9qa5LnXPJInzbTPLk692uY57LWIqkBD1bKc 16SsLeu220TqOHm0G98bog3J7Yp31JWAG8KH6jPeecG+sVST0vwW5oo5aNaDxH/2mdQEGLtVmn55 wJ3LnycdYmH8rLFaDU8= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option:
	Found child zone pie.ma

pie.ma

	Checking DS between ma and pie.ma
	Query to c.tld.ma for pie.ma/DS
	Received 497 bytes from 81.192.171.139
	;; Response received from 81.192.171.139 (497 octets) ;; HEADER SECTION ;; id = 14386 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option: ;; QUESTION SECTION (1 record) ;; pie.ma. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) ma. 1800 IN SOA ( c.tld.ma. ma.anrt.ma. 2036631451 ;serial 900 ;refresh 90 ;retry 604800000 ;expire 1800 ;minimum ) ma. 1800 IN RRSIG ( SOA 8 1 108000 20240107024319 20231208014319 51148 ma. hodYaIHT1x9Y0kDsTm3TY+YBYXiwWg7vuqBve2n5jet5nU/tvzhLkxyOHege/eR+HWJy/0oaghr6 xwhbb6nsZkjIXG+8CH7Zp1WGXYxYV+4fuuFJ+g88r2rOIEArO/OdWxo0ucBmdzyxXAOJycajfa5R thUG88kUG6PYaGqYJSk= ) PJ8BE0MLOJPVDHSLPNNNFML13HEHOFRV.ma. 1800 IN NSEC3 ( 1 0 10 29a582570bdf7832b47166a23f1b pj996ph81sihoo5iv9enjsh97gjvp4s1 NS ) PJ8BE0MLOJPVDHSLPNNNFML13HEHOFRV.ma. 1800 IN RRSIG ( NSEC3 8 2 1800 20240105174925 20231206165715 51148 ma. reXhA4w43h2D1K+y+U92O78qB8fL63kN62LmFK7SO9qa5LnXPJInzbTPLk692uY57LWIqkBD1bKc 16SsLeu220TqOHm0G98bog3J7Yp31JWAG8KH6jPeecG+sVST0vwW5oo5aNaDxH/2mdQEGLtVmn55 wJ3LnycdYmH8rLFaDU8= ) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option:
	No DS records found for pie.ma in the ma zone
	Query to thomas.ns.cloudflare.com for pie.ma/DNSKEY
	Received 297 bytes from 108.162.193.238
	;; Response received from 108.162.193.238 (297 octets) ;; HEADER SECTION ;; id = 52273 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; pie.ma. IN DNSKEY ;; ANSWER SECTION (3 records) pie.ma. 3600 IN DNSKEY ( 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iU zy1L53eKGQ== ) ; Key ID = 2371 pie.ma. 3600 IN DNSKEY ( 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x 8fGAa2XhSA== ) ; Key ID = 34505 pie.ma. 3600 IN RRSIG ( DNSKEY 13 2 3600 20240123154845 20231123154845 2371 pie.ma. uv/aqMde0xcFYyZKKgvApTOFYZDlyupbe2UOeTciZ4orAnfzw9RpX/a3l1e4YQUwSFgTdnkx+tUG fc6GTpIqsQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 2 DNSKEY records for pie.ma
	`pie.ma. 3600 IN DNSKEY ( 257 3 13 mdsswUyr3DPW132mOi8V9xESWE8jTo0dxCjjnopKl+GqJxpVXckHAeF+KkxLbxILfDLUT0rAK9iU zy1L53eKGQ== ) ; Key ID = 2371`
	`pie.ma. 3600 IN DNSKEY ( 256 3 13 oJMRESz5E4gYzS/q6XDrvU1qMPYIjCWzJaOau8XNEZeqCYKD5ar0IRd8KqXXFJkqmVfRvMGPmM1x 8fGAa2XhSA== ) ; Key ID = 34505`
	Found 1 RRSIGs over DNSKEY RRset
	`pie.ma. 3600 IN RRSIG ( DNSKEY 13 2 3600 20240123154845 20231123154845 2371 pie.ma. uv/aqMde0xcFYyZKKgvApTOFYZDlyupbe2UOeTciZ4orAnfzw9RpX/a3l1e4YQUwSFgTdnkx+tUG fc6GTpIqsQ== )`
	RRSIG=2371 and DNSKEY=2371/SEP verifies the DNSKEY RRset
	Query to becky.ns.cloudflare.com for pie.ma/A
	Received 169 bytes from 108.162.192.73
	;; Response received from 108.162.192.73 (169 octets) ;; HEADER SECTION ;; id = 25021 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; pie.ma. IN A ;; ANSWER SECTION (3 records) pie.ma. 300 IN A 104.21.30.174 pie.ma. 300 IN A 172.67.173.122 pie.ma. 300 IN RRSIG ( A 13 2 300 20231209034844 20231207014844 34505 pie.ma. e/D8ytk++ktMlmBlU/WGn1wOQK2a8qOy7F+xf4yqINo2tFrop3uK+icPzAhkSFKlwiOa3JZEPWVZ w0HyfU+Xbg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	becky.ns.cloudflare.com is authoritative for pie.ma
	Found RRSIG signed by pie.ma zone
	Query to thomas.ns.cloudflare.com for pie.ma/SOA
	Received 200 bytes from 173.245.59.238
	;; Response received from 173.245.59.238 (200 octets) ;; HEADER SECTION ;; id = 13096 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; pie.ma. IN SOA ;; ANSWER SECTION (2 records) pie.ma. 1800 IN SOA ( becky.ns.cloudflare.com. dns.cloudflare.com. 2326326625 ;serial 10000 ;refresh 2400 ;retry 604800 ;expire 1800 ;minimum ) pie.ma. 1800 IN RRSIG ( SOA 13 2 1800 20231209034844 20231207014844 34505 pie.ma. RLT8v046VFP7GYEtFpND2uGdQDIGodTZpa44CofIIh1F+w/6QbhZNU5/LH9WvSsJebmbTZ08NtK/ SjVubYB40A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to becky.ns.cloudflare.com for pie.ma/A
	Received 169 bytes from 173.245.58.73
	;; Response received from 173.245.58.73 (169 octets) ;; HEADER SECTION ;; id = 49080 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; pie.ma. IN A ;; ANSWER SECTION (3 records) pie.ma. 300 IN A 172.67.173.122 pie.ma. 300 IN A 104.21.30.174 pie.ma. 300 IN RRSIG ( A 13 2 300 20231209034844 20231207014844 34505 pie.ma. /SsTEPws+twoJBlO1HOVd9aoYCwDm2g+sdIDaI/P4yYJf23Bxf1m3HRbGFne8VEJLRFmYtI7j/t9 APZ2c+y+2A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	pie.ma A RR has value 172.67.173.122
	pie.ma A RR has value 104.21.30.174
	Found 1 RRSIGs over A RRset
	`pie.ma. 300 IN RRSIG ( A 13 2 300 20231209034844 20231207014844 34505 pie.ma. /SsTEPws+twoJBlO1HOVd9aoYCwDm2g+sdIDaI/P4yYJf23Bxf1m3HRbGFne8VEJLRFmYtI7j/t9 APZ2c+y+2A== )`
	RRSIG=34505 and DNSKEY=34505 verifies the A RRset

pie.ma

	Query to thomas.ns.cloudflare.com for pie.ma/A
	Received 169 bytes from 172.64.33.238
	;; Response received from 172.64.33.238 (169 octets) ;; HEADER SECTION ;; id = 20751 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; pie.ma. IN A ;; ANSWER SECTION (3 records) pie.ma. 300 IN A 172.67.173.122 pie.ma. 300 IN A 104.21.30.174 pie.ma. 300 IN RRSIG ( A 13 2 300 20231209034844 20231207014844 34505 pie.ma. EsB+zctwZJNTVSxVlocvbtqkR79WDDdHEo3oZm3WQZbvbYwXGw/pqBlsBMbKQeJ47gJ4yzsdpSE7 0bhyaRHksA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	thomas.ns.cloudflare.com is authoritative for pie.ma
	Found RRSIG signed by pie.ma zone
	Query to thomas.ns.cloudflare.com for pie.ma/A
	Received 169 bytes from 108.162.193.238
	;; Response received from 108.162.193.238 (169 octets) ;; HEADER SECTION ;; id = 23721 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; pie.ma. IN A ;; ANSWER SECTION (3 records) pie.ma. 300 IN A 104.21.30.174 pie.ma. 300 IN A 172.67.173.122 pie.ma. 300 IN RRSIG ( A 13 2 300 20231209034844 20231207014844 34505 pie.ma. v/MqXmyyIV4LR2KVmKQpe/8lzWXQzfWFwfMfWcpBIMLuyLajRxVE0BoJSXoqoHSnXg/g0r/p+C48 o2ZOCstArA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	pie.ma A RR has value 104.21.30.174
	pie.ma A RR has value 172.67.173.122
	Found 1 RRSIGs over A RRset
	`pie.ma. 300 IN RRSIG ( A 13 2 300 20231209034844 20231207014844 34505 pie.ma. v/MqXmyyIV4LR2KVmKQpe/8lzWXQzfWFwfMfWcpBIMLuyLajRxVE0BoJSXoqoHSnXg/g0r/p+C48 o2ZOCstArA== )`
	RRSIG=34505 and DNSKEY=34505 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test pie.ma at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: