DNSSEC Analyzer - pnnl.gov

Domain Name:

Time: 2022-08-16 04:56:22 UTC, NTP stratum 16

Analyzing DNSSEC problems for pnnl.gov

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to e.root-servers.net for ./DNSKEY
	Received 864 bytes from 192.203.230.10
	;; Response received from 192.203.230.10 (864 octets) ;; HEADER SECTION ;; id = 59808 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAaQVKIqdmeLCaF4lq+IoKpejId9qqoIbZJ6cjB5MfyJYX3KVFXYyJ9rt4jKOwf4m2BoDOY66 V1upRumF+eu502HXzdOdJlioRLA9YiRyLgvfjzyfUYrExYT4/TDTS4XfQX2UcJDN5C7SQ9UxebZk /VjQfPAUU+hZKOcjOVRFbAHom4tIi+Rin0laGlAi8ZY5WUZypYKR0xvprtG0eXeOBMjbUt1EnhmO 2Bs52zC8B0cMjq6fMiYFUqtziALccsQczGngIDR0dIvvL54ky1JNNp19Ldy9ir27s7eRCYGbYI1W zR05/d4/nCmDSHkQS2BiesYufuWZZwm+FsitupCciwE= ) ; Key ID = 20826 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20220831000000 20220810000000 20326 . FJNYHZUipwrjUsDOPlE6hwUza6fRp2vwI294cL6vn5P9B5V2NT4Uf/wWoJvJlUdKPYhLSu2mfTM+ 2ufpNU9sHB+0Z1YXBj2zK8qQlT9S/BW5v4trLo1sZzK8uvl0hXKOwBsoOiNWdvqqtfqBTpz+mzWO bVSoCnNSUyIJkDyydvbJ9W2zqP+EY448BC87+BOGn+rY0yYy9dp5NYbrAOTQDF0pudHp43LHYedc AfDtjwVREPVEWYkisVpJoT3EZbF31h1Gb/+P7v84UHi6Mykq5hgQ1fV0PIMczp53moxgJxfzr1Y8 TIQnMy3xxmDxIiLXbaeUtkyBU2iMA1JJfWExyg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAaQVKIqdmeLCaF4lq+IoKpejId9qqoIbZJ6cjB5MfyJYX3KVFXYyJ9rt4jKOwf4m2BoDOY66 V1upRumF+eu502HXzdOdJlioRLA9YiRyLgvfjzyfUYrExYT4/TDTS4XfQX2UcJDN5C7SQ9UxebZk /VjQfPAUU+hZKOcjOVRFbAHom4tIi+Rin0laGlAi8ZY5WUZypYKR0xvprtG0eXeOBMjbUt1EnhmO 2Bs52zC8B0cMjq6fMiYFUqtziALccsQczGngIDR0dIvvL54ky1JNNp19Ldy9ir27s7eRCYGbYI1W zR05/d4/nCmDSHkQS2BiesYufuWZZwm+FsitupCciwE= ) ; Key ID = 20826`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20220831000000 20220810000000 20326 . FJNYHZUipwrjUsDOPlE6hwUza6fRp2vwI294cL6vn5P9B5V2NT4Uf/wWoJvJlUdKPYhLSu2mfTM+ 2ufpNU9sHB+0Z1YXBj2zK8qQlT9S/BW5v4trLo1sZzK8uvl0hXKOwBsoOiNWdvqqtfqBTpz+mzWO bVSoCnNSUyIJkDyydvbJ9W2zqP+EY448BC87+BOGn+rY0yYy9dp5NYbrAOTQDF0pudHp43LHYedc AfDtjwVREPVEWYkisVpJoT3EZbF31h1Gb/+P7v84UHi6Mykq5hgQ1fV0PIMczp53moxgJxfzr1Y8 TIQnMy3xxmDxIiLXbaeUtkyBU2iMA1JJfWExyg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=20826 is now in the chain-of-trust
	Query to l.root-servers.net for pnnl.gov/A
	Received 627 bytes from 199.7.83.42
	;; Response received from 199.7.83.42 (627 octets) ;; HEADER SECTION ;; id = 59441 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; pnnl.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.gov-servers.net. gov. 172800 IN NS b.gov-servers.net. gov. 172800 IN NS c.gov-servers.net. gov. 172800 IN NS d.gov-servers.net. gov. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20220828170000 20220815160000 20826 . jOWpAgmoMQaEDIy501972EmC6Y2o50emV1u0OGOfSoqMcLg1emE+wJNSI0p8+tWUjAcYKUPX/hZf 8zLCjMieK0bCR3gAwph8KYGEcPkriaM7+jTH8/xlqd7mV5WaYzr/EnCBuOl+jQNE31Ul7fnEZm6l WJjnMRotz/CJqwUFJnF8SBmaWYrC15zp0VppqtUK3hja/zjG+0sZwKLNwFMHf01zuXYbJCqATE+K AeqpGWbPBHs8gHOHKYumuxTDaVhf8yI+PKiPDJ+dZv6XdT+2ZfO8+YxWwH4iJthcFqM7+OsLXOeP fUQnl0JFK6FRlxPRUHVNr5gKVvAJkXme44bwDw== ) ;; ADDITIONAL SECTION (9 records) a.gov-servers.net. 172800 IN A 69.36.157.30 b.gov-servers.net. 172800 IN A 209.112.123.30 c.gov-servers.net. 172800 IN A 69.36.153.30 d.gov-servers.net. 172800 IN A 81.19.194.30 a.gov-servers.net. 172800 IN AAAA 2001:500:4431::2:30 b.gov-servers.net. 172800 IN AAAA 2620:74:27::2:30 c.gov-servers.net. 172800 IN AAAA 2620:74:28::2:30 d.gov-servers.net. 172800 IN AAAA 2620:74:29::2:30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to c.root-servers.net for gov/DNSKEY
	Received 622 bytes from 192.33.4.12
	;; Response received from 192.33.4.12 (622 octets) ;; HEADER SECTION ;; id = 52255 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 6 arcount = 9 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS b.gov-servers.net. gov. 172800 IN NS d.gov-servers.net. gov. 172800 IN NS a.gov-servers.net. gov. 172800 IN NS c.gov-servers.net. gov. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20220828170000 20220815160000 20826 . jOWpAgmoMQaEDIy501972EmC6Y2o50emV1u0OGOfSoqMcLg1emE+wJNSI0p8+tWUjAcYKUPX/hZf 8zLCjMieK0bCR3gAwph8KYGEcPkriaM7+jTH8/xlqd7mV5WaYzr/EnCBuOl+jQNE31Ul7fnEZm6l WJjnMRotz/CJqwUFJnF8SBmaWYrC15zp0VppqtUK3hja/zjG+0sZwKLNwFMHf01zuXYbJCqATE+K AeqpGWbPBHs8gHOHKYumuxTDaVhf8yI+PKiPDJ+dZv6XdT+2ZfO8+YxWwH4iJthcFqM7+OsLXOeP fUQnl0JFK6FRlxPRUHVNr5gKVvAJkXme44bwDw== ) ;; ADDITIONAL SECTION (9 records) d.gov-servers.net. 172800 IN A 81.19.194.30 c.gov-servers.net. 172800 IN A 69.36.153.30 b.gov-servers.net. 172800 IN A 209.112.123.30 a.gov-servers.net. 172800 IN A 69.36.157.30 d.gov-servers.net. 172800 IN AAAA 2620:74:29::2:30 c.gov-servers.net. 172800 IN AAAA 2620:74:28::2:30 b.gov-servers.net. 172800 IN AAAA 2620:74:27::2:30 a.gov-servers.net. 172800 IN AAAA 2001:500:4431::2:30 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found child zone gov

gov

	Checking DS between . and gov
	Query to a.root-servers.net for gov/DS
	Received 367 bytes from 198.41.0.4
	;; Response received from 198.41.0.4 (367 octets) ;; HEADER SECTION ;; id = 23481 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20220828170000 20220815160000 20826 . jOWpAgmoMQaEDIy501972EmC6Y2o50emV1u0OGOfSoqMcLg1emE+wJNSI0p8+tWUjAcYKUPX/hZf 8zLCjMieK0bCR3gAwph8KYGEcPkriaM7+jTH8/xlqd7mV5WaYzr/EnCBuOl+jQNE31Ul7fnEZm6l WJjnMRotz/CJqwUFJnF8SBmaWYrC15zp0VppqtUK3hja/zjG+0sZwKLNwFMHf01zuXYbJCqATE+K AeqpGWbPBHs8gHOHKYumuxTDaVhf8yI+PKiPDJ+dZv6XdT+2ZfO8+YxWwH4iJthcFqM7+OsLXOeP fUQnl0JFK6FRlxPRUHVNr5gKVvAJkXme44bwDw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 1 DS records for gov in the . zone
	DS=7698/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20220828170000 20220815160000 20826 . jOWpAgmoMQaEDIy501972EmC6Y2o50emV1u0OGOfSoqMcLg1emE+wJNSI0p8+tWUjAcYKUPX/hZf 8zLCjMieK0bCR3gAwph8KYGEcPkriaM7+jTH8/xlqd7mV5WaYzr/EnCBuOl+jQNE31Ul7fnEZm6l WJjnMRotz/CJqwUFJnF8SBmaWYrC15zp0VppqtUK3hja/zjG+0sZwKLNwFMHf01zuXYbJCqATE+K AeqpGWbPBHs8gHOHKYumuxTDaVhf8yI+PKiPDJ+dZv6XdT+2ZfO8+YxWwH4iJthcFqM7+OsLXOeP fUQnl0JFK6FRlxPRUHVNr5gKVvAJkXme44bwDw== )`
	RRSIG=20826 and DNSKEY=20826 verifies the DS RRset
	DS=7698/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 7698 8 2 6bc949e638442ead0bdaf0935763c8d003760384ff15ebbd5ce86bb5559561f0 )`
	Query to a.gov-servers.net for gov/DNSKEY
	Received 777 bytes from 69.36.157.30
	;; Response received from 69.36.157.30 (777 octets) ;; HEADER SECTION ;; id = 5747 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 86400 IN DNSKEY ( 257 3 8 AQO8daaz7B+yshOfL60rytKd9aOSujgponEw3fwBMEC3/+e9XzHw2k+VKnbJTZ+QaVtpfUd1q9HK ZIv/ck83Gl5TjYKE5jtUZ2kpEDZfVNGv6yx0smtWAXv1nCJS9ohnyOTd397eMojGDHqkEC+uojES cZheEkMxzgCZwDAs+/CSU7mSuHtCRZn19xlZUd5Gv7yDQ3mbOUwuy30oSk0z1Q5UUPpoihOugIZH FX6Jk7NLiW2wlqfq9qhV4zj7TiBiJY0mCc4zHN8/aq2VKDHp2Na7mWzvKyTy+SYQkBQ/08LbPwj9 YMc+uCzKL6sU/ObHv17EFhD8aPDftTHZvV9L+OZr ) ; Key ID = 7698 gov. 86400 IN DNSKEY ( 256 3 8 AwEAAbSW4ocEzPbMwUkqAURZNNLAAZ9XoKgSLoPQVtMdnKBkrDoIwWxYO0nk3n/seSHxNb4I+Shq HeLM0bydpkqpMPCesMKazwq2YfQD0t0NdN4kiApakMBOO6foEa9UKHg8YbF5ZeZ2oZzIyFVlDhZB qtVeCM7SIEfxp8VR4/TWRHaoqoOnScTAoVZA9+YknqERZeQoUecTd1xXBHV0dQawxlc= ) ; Key ID = 261 gov. 86400 IN RRSIG ( DNSKEY 8 1 86400 20220822190254 20220807185754 7698 gov. dBSpBgHX0L/G2I5MJ/wkADBF0OthUgrMtPrydX0kqzyxQ9q6NGouP9nsmeBDOGrwE8zw7tL4i8fT SOopdT5cwON+mCIXEufGG3NzJq3NRDUkFe5WV3gY5YKqK6LdBcHiiRp3pUuG7KweBRaz5OoWcu9c SyZ24XyNzRfw5i0QGzAvnHXd8YDn+1pFHGbtT596srFiwAizD9ulBk8n2onBC7ITfykoxu4fEO6H 6Onjeuh0wmJx+w0kfGvuShL7+P+o88iXilvEMAxeOxTq0zWgskqQLLRpd/k/fVJUk+CelsaWz2V6 0ySOAHlvSa9XwlINoCMtuBhR3dwglLxnixqudw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DNSKEY records for gov
	`gov. 86400 IN DNSKEY ( 257 3 8 AQO8daaz7B+yshOfL60rytKd9aOSujgponEw3fwBMEC3/+e9XzHw2k+VKnbJTZ+QaVtpfUd1q9HK ZIv/ck83Gl5TjYKE5jtUZ2kpEDZfVNGv6yx0smtWAXv1nCJS9ohnyOTd397eMojGDHqkEC+uojES cZheEkMxzgCZwDAs+/CSU7mSuHtCRZn19xlZUd5Gv7yDQ3mbOUwuy30oSk0z1Q5UUPpoihOugIZH FX6Jk7NLiW2wlqfq9qhV4zj7TiBiJY0mCc4zHN8/aq2VKDHp2Na7mWzvKyTy+SYQkBQ/08LbPwj9 YMc+uCzKL6sU/ObHv17EFhD8aPDftTHZvV9L+OZr ) ; Key ID = 7698`
	`gov. 86400 IN DNSKEY ( 256 3 8 AwEAAbSW4ocEzPbMwUkqAURZNNLAAZ9XoKgSLoPQVtMdnKBkrDoIwWxYO0nk3n/seSHxNb4I+Shq HeLM0bydpkqpMPCesMKazwq2YfQD0t0NdN4kiApakMBOO6foEa9UKHg8YbF5ZeZ2oZzIyFVlDhZB qtVeCM7SIEfxp8VR4/TWRHaoqoOnScTAoVZA9+YknqERZeQoUecTd1xXBHV0dQawxlc= ) ; Key ID = 261`
	DNSKEY=7698/SEP is now in the chain-of-trust
	DS=7698/SHA-256 verifies DNSKEY=7698/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 86400 IN RRSIG ( DNSKEY 8 1 86400 20220822190254 20220807185754 7698 gov. dBSpBgHX0L/G2I5MJ/wkADBF0OthUgrMtPrydX0kqzyxQ9q6NGouP9nsmeBDOGrwE8zw7tL4i8fT SOopdT5cwON+mCIXEufGG3NzJq3NRDUkFe5WV3gY5YKqK6LdBcHiiRp3pUuG7KweBRaz5OoWcu9c SyZ24XyNzRfw5i0QGzAvnHXd8YDn+1pFHGbtT596srFiwAizD9ulBk8n2onBC7ITfykoxu4fEO6H 6Onjeuh0wmJx+w0kfGvuShL7+P+o88iXilvEMAxeOxTq0zWgskqQLLRpd/k/fVJUk+CelsaWz2V6 0ySOAHlvSa9XwlINoCMtuBhR3dwglLxnixqudw== )`
	RRSIG=7698 and DNSKEY=7698/SEP verifies the DNSKEY RRset
	DNSKEY=261 is now in the chain-of-trust
	Query to c.gov-servers.net for pnnl.gov/A
	Received 420 bytes from 69.36.153.30
	;; Response received from 69.36.153.30 (420 octets) ;; HEADER SECTION ;; id = 20332 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 5 arcount = 5 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; pnnl.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (5 records) pnnl.gov. 86400 IN NS nsy.pnl.gov. pnnl.gov. 86400 IN NS nsx.pnl.gov. pnnl.gov. 3600 IN DS 13866 7 1 f64b6673b7e5f20a8830e40345592af5fdd85d80 pnnl.gov. 3600 IN DS ( 13866 7 2 d327276b25c11ee06764117cf092249ef00e80fd1a7152c0f58b9ccc58327d91 ) pnnl.gov. 3600 IN RRSIG ( DS 8 2 3600 20220822134113 20220815134113 261 gov. XMhVLV8jGQlk8tSTwg0pfBlsinY8YRt2vHwJmjoDb8oR9M2r4eKEOcvGtzy5s+KZwA41SIJvHC/y 9EjNFk1PlmPzjYtf77ZRnebmXyy5GOnj8OAoHskZCTzF7KGGX+WvGGa0So9/XBld8Nb8qJRrFVBu DJMBGNzdH/2SzXLC0JU1r9QppZEe2nrdXJmLwMpTl8ndD6O0Anin8Cu5qj969A== ) ;; ADDITIONAL SECTION (5 records) nsx.pnl.gov. 86400 IN A 192.101.109.80 nsx.pnl.gov. 86400 IN A 192.101.109.47 nsy.pnl.gov. 86400 IN A 192.101.109.47 nsy.pnl.gov. 86400 IN A 192.101.109.80 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to a.gov-servers.net for pnnl.gov/DNSKEY
	Received 420 bytes from 69.36.157.30
	;; Response received from 69.36.157.30 (420 octets) ;; HEADER SECTION ;; id = 34164 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 5 arcount = 5 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; pnnl.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (5 records) pnnl.gov. 86400 IN NS nsy.pnl.gov. pnnl.gov. 86400 IN NS nsx.pnl.gov. pnnl.gov. 3600 IN DS 13866 7 1 f64b6673b7e5f20a8830e40345592af5fdd85d80 pnnl.gov. 3600 IN DS ( 13866 7 2 d327276b25c11ee06764117cf092249ef00e80fd1a7152c0f58b9ccc58327d91 ) pnnl.gov. 3600 IN RRSIG ( DS 8 2 3600 20220822134113 20220815134113 261 gov. XMhVLV8jGQlk8tSTwg0pfBlsinY8YRt2vHwJmjoDb8oR9M2r4eKEOcvGtzy5s+KZwA41SIJvHC/y 9EjNFk1PlmPzjYtf77ZRnebmXyy5GOnj8OAoHskZCTzF7KGGX+WvGGa0So9/XBld8Nb8qJRrFVBu DJMBGNzdH/2SzXLC0JU1r9QppZEe2nrdXJmLwMpTl8ndD6O0Anin8Cu5qj969A== ) ;; ADDITIONAL SECTION (5 records) nsx.pnl.gov. 86400 IN A 192.101.109.80 nsx.pnl.gov. 86400 IN A 192.101.109.47 nsy.pnl.gov. 86400 IN A 192.101.109.47 nsy.pnl.gov. 86400 IN A 192.101.109.80 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone pnnl.gov

pnnl.gov

	Checking DS between gov and pnnl.gov
	Query to b.gov-servers.net for pnnl.gov/DS
	Received 316 bytes from 209.112.123.30
	;; Response received from 209.112.123.30 (316 octets) ;; HEADER SECTION ;; id = 1746 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; pnnl.gov. IN DS ;; ANSWER SECTION (3 records) pnnl.gov. 3600 IN DS 13866 7 1 f64b6673b7e5f20a8830e40345592af5fdd85d80 pnnl.gov. 3600 IN DS ( 13866 7 2 d327276b25c11ee06764117cf092249ef00e80fd1a7152c0f58b9ccc58327d91 ) pnnl.gov. 3600 IN RRSIG ( DS 8 2 3600 20220822134113 20220815134113 261 gov. XMhVLV8jGQlk8tSTwg0pfBlsinY8YRt2vHwJmjoDb8oR9M2r4eKEOcvGtzy5s+KZwA41SIJvHC/y 9EjNFk1PlmPzjYtf77ZRnebmXyy5GOnj8OAoHskZCTzF7KGGX+WvGGa0So9/XBld8Nb8qJRrFVBu DJMBGNzdH/2SzXLC0JU1r9QppZEe2nrdXJmLwMpTl8ndD6O0Anin8Cu5qj969A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DS records for pnnl.gov in the gov zone
	DS=13866/SHA-1 has algorithm RSASHA1-NSEC3-SHA1
	DS=13866/SHA-256 has algorithm RSASHA1-NSEC3-SHA1
	Found 1 RRSIGs over DS RRset
	`pnnl.gov. 3600 IN RRSIG ( DS 8 2 3600 20220822134113 20220815134113 261 gov. XMhVLV8jGQlk8tSTwg0pfBlsinY8YRt2vHwJmjoDb8oR9M2r4eKEOcvGtzy5s+KZwA41SIJvHC/y 9EjNFk1PlmPzjYtf77ZRnebmXyy5GOnj8OAoHskZCTzF7KGGX+WvGGa0So9/XBld8Nb8qJRrFVBu DJMBGNzdH/2SzXLC0JU1r9QppZEe2nrdXJmLwMpTl8ndD6O0Anin8Cu5qj969A== )`
	RRSIG=261 and DNSKEY=261 verifies the DS RRset
	DS=13866/SHA-1 is now in the chain-of-trust
	`pnnl.gov. 3600 IN DS 13866 7 1 f64b6673b7e5f20a8830e40345592af5fdd85d80`
	`pnnl.gov. 3600 IN DS ( 13866 7 2 d327276b25c11ee06764117cf092249ef00e80fd1a7152c0f58b9ccc58327d91 )`
	Query to nsy.pnl.gov for pnnl.gov/DNSKEY
	Received 925 bytes from 192.101.109.47
	;; Response received from 192.101.109.47 (925 octets) ;; HEADER SECTION ;; id = 5339 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option: ;; QUESTION SECTION (1 record) ;; pnnl.gov. IN DNSKEY ;; ANSWER SECTION (4 records) pnnl.gov. 1296000 IN DNSKEY ( 256 3 7 AwEAAceHnLobug1uoxGjRIRj8yQ29IcQP29T6xOJlmsNtgbAgXP5HUUG6AP2BW2STbrMXQT6h+ms j9/x0F68ob2tzBcoRGR3DhOrDviDtHpX03rbr7h3p1e0LDx4dvjliq0K4Wb+ICjnwY7s/otpoO1Q mTqAmEmda5XuoirHnyDSCaA1 ) ; Key ID = 31868 pnnl.gov. 1296000 IN DNSKEY ( 257 3 7 AwEAAc8YOvqm0BpOEwhkgUW55Tql0MwkATEtOgITFbWZZb4AYYz5ENe7RkKt3Owm/tZuoGhtKZ2y oHNEBRKjrBuSjS36YyeHK5osajgux7E8cQxF1wvPST94tOHap3qMoW2Wx5hpaQG+3/7EuYUSzCS+ QZcwzy3EQbsE3p+hVazZ/29hw6aeTxg7d3pw5rc1+kb/dhp08FchWph4H6qzeJh2Lk2fry+zmqg/ 0ULkyy+DI4JQZO9P76VCmSVB/bf5PHYcgc2He8pV1iVlaRAsLM+IVx7Ybh6ooHELXqAcBDAoNEwX /H19WICVVpYQKw6qY7HH/d5MBBT0KX+rWzOGk5McT/U= ) ; Key ID = 13866 pnnl.gov. 1296000 IN RRSIG ( DNSKEY 7 2 1296000 20220913152408 20220814142408 13866 pnnl.gov. CZ3YnzxL5kRiA3FwmQzvOwqkv8hJW//m9nzR5B/+pHMOYrV0zd23w6dEHcgTlz92kECGadmRFWtz Hk+fKMVaQ9+YdkI7E9A0OP9zOQXro/ewNeMeHteNnHOQHwRGuDjwf1P0Wpgldma0FlKEUVGL4RBF 4/kgGxoYc+v5mgoYkNKIWGZ19R9HXOEnhMaB5N6a0EZVfwBDDqjCsmLzNf2NnbqYoDg3Z+37jwNI DrAfjYcR6J7/8nda/hMCc0M2QoHqA+EmwAz4jebrBj0RWOiTH7cXAyX9BVTG6ZinYC0onRrQ8dyI 0FuQuKhsXGi5+rVxlJU3AOTSBUhPUKiNQs7RPg== ) pnnl.gov. 1296000 IN RRSIG ( DNSKEY 7 2 1296000 20220913152408 20220814142408 31868 pnnl.gov. uL3GDctpxVwRt6rWQqLw4domfdZHhN4a4BKwV6EPEUdWP4for9mv3RdN4LIj3AZGhEU6TGC2Bvz8 9NuICLlf34fVN0WfHPqtMHEWy1pMFTyBhEoNbSO5P6+xQAUsbFHrw52G/0k+KCc1Cxj3DBezZnnt SkBP0HxWHsklDuKrg8Y= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option:
	Found 2 DNSKEY records for pnnl.gov
	`pnnl.gov. 1296000 IN DNSKEY ( 256 3 7 AwEAAceHnLobug1uoxGjRIRj8yQ29IcQP29T6xOJlmsNtgbAgXP5HUUG6AP2BW2STbrMXQT6h+ms j9/x0F68ob2tzBcoRGR3DhOrDviDtHpX03rbr7h3p1e0LDx4dvjliq0K4Wb+ICjnwY7s/otpoO1Q mTqAmEmda5XuoirHnyDSCaA1 ) ; Key ID = 31868`
	`pnnl.gov. 1296000 IN DNSKEY ( 257 3 7 AwEAAc8YOvqm0BpOEwhkgUW55Tql0MwkATEtOgITFbWZZb4AYYz5ENe7RkKt3Owm/tZuoGhtKZ2y oHNEBRKjrBuSjS36YyeHK5osajgux7E8cQxF1wvPST94tOHap3qMoW2Wx5hpaQG+3/7EuYUSzCS+ QZcwzy3EQbsE3p+hVazZ/29hw6aeTxg7d3pw5rc1+kb/dhp08FchWph4H6qzeJh2Lk2fry+zmqg/ 0ULkyy+DI4JQZO9P76VCmSVB/bf5PHYcgc2He8pV1iVlaRAsLM+IVx7Ybh6ooHELXqAcBDAoNEwX /H19WICVVpYQKw6qY7HH/d5MBBT0KX+rWzOGk5McT/U= ) ; Key ID = 13866`
	DNSKEY=13866/SEP is now in the chain-of-trust
	DS=13866/SHA-1 verifies DNSKEY=13866/SEP
	DS=13866/SHA-256 verifies DNSKEY=13866/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`pnnl.gov. 1296000 IN RRSIG ( DNSKEY 7 2 1296000 20220913152408 20220814142408 13866 pnnl.gov. CZ3YnzxL5kRiA3FwmQzvOwqkv8hJW//m9nzR5B/+pHMOYrV0zd23w6dEHcgTlz92kECGadmRFWtz Hk+fKMVaQ9+YdkI7E9A0OP9zOQXro/ewNeMeHteNnHOQHwRGuDjwf1P0Wpgldma0FlKEUVGL4RBF 4/kgGxoYc+v5mgoYkNKIWGZ19R9HXOEnhMaB5N6a0EZVfwBDDqjCsmLzNf2NnbqYoDg3Z+37jwNI DrAfjYcR6J7/8nda/hMCc0M2QoHqA+EmwAz4jebrBj0RWOiTH7cXAyX9BVTG6ZinYC0onRrQ8dyI 0FuQuKhsXGi5+rVxlJU3AOTSBUhPUKiNQs7RPg== )`
	`pnnl.gov. 1296000 IN RRSIG ( DNSKEY 7 2 1296000 20220913152408 20220814142408 31868 pnnl.gov. uL3GDctpxVwRt6rWQqLw4domfdZHhN4a4BKwV6EPEUdWP4for9mv3RdN4LIj3AZGhEU6TGC2Bvz8 9NuICLlf34fVN0WfHPqtMHEWy1pMFTyBhEoNbSO5P6+xQAUsbFHrw52G/0k+KCc1Cxj3DBezZnnt SkBP0HxWHsklDuKrg8Y= )`
	RRSIG=13866 and DNSKEY=13866/SEP verifies the DNSKEY RRset
	RRSIG=31868 and DNSKEY=31868 verifies the DNSKEY RRset
	DNSKEY=31868 is now in the chain-of-trust
	Query to nsy.pnl.gov for pnnl.gov/A
	Received 221 bytes from 192.101.109.47
	;; Response received from 192.101.109.47 (221 octets) ;; HEADER SECTION ;; id = 32747 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option: ;; QUESTION SECTION (1 record) ;; pnnl.gov. IN A ;; ANSWER SECTION (2 records) pnnl.gov. 28800 IN A 192.101.105.198 pnnl.gov. 28800 IN RRSIG ( A 7 2 28800 20220912020859 20220813012052 31868 pnnl.gov. h8hb1jxjJGIjRfeBo1ldAMUasvvI2XN90jPQcFNblyxd/03hQNgKaLk4LdTX+grvaB+uzr/LOaca XWFKmGODxgDmzFvDvmoOVjCURI4Ra7SN2KYTEV+WE2Vc6gBIJL+WbSybMCDJ5oPx7ta0vosCt6Fp tIfUQpcfLzfYLJVAIDQ= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option:
	nsy.pnl.gov is authoritative for pnnl.gov
	Found RRSIG signed by pnnl.gov zone
	Query to nsx.pnl.gov for pnnl.gov/SOA
	Received 260 bytes from 192.101.109.80
	;; Response received from 192.101.109.80 (260 octets) ;; HEADER SECTION ;; id = 21000 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option: ;; QUESTION SECTION (1 record) ;; pnnl.gov. IN SOA ;; ANSWER SECTION (2 records) pnnl.gov. 28800 IN SOA ( nsz.pnl.gov. hostmaster.pnl.gov. 140215 ;serial 10800 ;refresh 1080 ;retry 2592000 ;expire 900 ;minimum ) pnnl.gov. 28800 IN RRSIG ( SOA 7 2 28800 20220915045153 20220816035153 31868 pnnl.gov. LAOSG6njfjh+PqMX0ZMD7iseJgm4HsPe9vlgm+8cvd7UZI9NhtcGEDrcH/YfVewAkwuBG+Zsg9Ye epKgh0N23AjoiPNwb0qDZhArM6oBYaMsuacdKZBfsrwsd8Q1Ismpu/xLjaauu8+08Gg4W682zBtd QR/uCcGPLjVK2LzUIG8= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option:
	Query to nsy.pnl.gov for pnnl.gov/A
	Received 221 bytes from 192.101.109.47
	;; Response received from 192.101.109.47 (221 octets) ;; HEADER SECTION ;; id = 52034 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option: ;; QUESTION SECTION (1 record) ;; pnnl.gov. IN A ;; ANSWER SECTION (2 records) pnnl.gov. 28800 IN A 192.101.105.198 pnnl.gov. 28800 IN RRSIG ( A 7 2 28800 20220912020859 20220813012052 31868 pnnl.gov. h8hb1jxjJGIjRfeBo1ldAMUasvvI2XN90jPQcFNblyxd/03hQNgKaLk4LdTX+grvaB+uzr/LOaca XWFKmGODxgDmzFvDvmoOVjCURI4Ra7SN2KYTEV+WE2Vc6gBIJL+WbSybMCDJ5oPx7ta0vosCt6Fp tIfUQpcfLzfYLJVAIDQ= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option:
	pnnl.gov A RR has value 192.101.105.198
	Found 1 RRSIGs over A RRset
	`pnnl.gov. 28800 IN RRSIG ( A 7 2 28800 20220912020859 20220813012052 31868 pnnl.gov. h8hb1jxjJGIjRfeBo1ldAMUasvvI2XN90jPQcFNblyxd/03hQNgKaLk4LdTX+grvaB+uzr/LOaca XWFKmGODxgDmzFvDvmoOVjCURI4Ra7SN2KYTEV+WE2Vc6gBIJL+WbSybMCDJ5oPx7ta0vosCt6Fp tIfUQpcfLzfYLJVAIDQ= )`
	RRSIG=31868 and DNSKEY=31868 verifies the A RRset

pnnl.gov

	Query to nsx.pnl.gov for pnnl.gov/A
	Received 221 bytes from 192.101.109.80
	;; Response received from 192.101.109.80 (221 octets) ;; HEADER SECTION ;; id = 44590 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option: ;; QUESTION SECTION (1 record) ;; pnnl.gov. IN A ;; ANSWER SECTION (2 records) pnnl.gov. 28800 IN A 192.101.105.198 pnnl.gov. 28800 IN RRSIG ( A 7 2 28800 20220912020859 20220813012052 31868 pnnl.gov. h8hb1jxjJGIjRfeBo1ldAMUasvvI2XN90jPQcFNblyxd/03hQNgKaLk4LdTX+grvaB+uzr/LOaca XWFKmGODxgDmzFvDvmoOVjCURI4Ra7SN2KYTEV+WE2Vc6gBIJL+WbSybMCDJ5oPx7ta0vosCt6Fp tIfUQpcfLzfYLJVAIDQ= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option:
	nsx.pnl.gov is authoritative for pnnl.gov
	Found RRSIG signed by pnnl.gov zone
	Query to nsx.pnl.gov for pnnl.gov/A
	Received 221 bytes from 192.101.109.80
	;; Response received from 192.101.109.80 (221 octets) ;; HEADER SECTION ;; id = 6884 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option: ;; QUESTION SECTION (1 record) ;; pnnl.gov. IN A ;; ANSWER SECTION (2 records) pnnl.gov. 28800 IN A 192.101.105.198 pnnl.gov. 28800 IN RRSIG ( A 7 2 28800 20220912020859 20220813012052 31868 pnnl.gov. h8hb1jxjJGIjRfeBo1ldAMUasvvI2XN90jPQcFNblyxd/03hQNgKaLk4LdTX+grvaB+uzr/LOaca XWFKmGODxgDmzFvDvmoOVjCURI4Ra7SN2KYTEV+WE2Vc6gBIJL+WbSybMCDJ5oPx7ta0vosCt6Fp tIfUQpcfLzfYLJVAIDQ= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1220 ;; option:
	pnnl.gov A RR has value 192.101.105.198
	Found 1 RRSIGs over A RRset
	`pnnl.gov. 28800 IN RRSIG ( A 7 2 28800 20220912020859 20220813012052 31868 pnnl.gov. h8hb1jxjJGIjRfeBo1ldAMUasvvI2XN90jPQcFNblyxd/03hQNgKaLk4LdTX+grvaB+uzr/LOaca XWFKmGODxgDmzFvDvmoOVjCURI4Ra7SN2KYTEV+WE2Vc6gBIJL+WbSybMCDJ5oPx7ta0vosCt6Fp tIfUQpcfLzfYLJVAIDQ= )`
	RRSIG=31868 and DNSKEY=31868 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test pnnl.gov at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: