DNSSEC Analyzer - righter.ch

Domain Name:

Time: 2020-07-04 22:53:06 UTC, NTP stratum 4

Analyzing DNSSEC problems for righter.ch

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to j.root-servers.net for ./DNSKEY
	Received 1139 bytes from 192.58.128.30
	;; Answer received from 192.58.128.30 (1139 bytes) ;; HEADER SECTION ;; id = 6814 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAc4qsciJ5MdMUIu4n/pSTsSiU9OCyAanPTe5TcMX4v1hxhpFwiTGQUv3BXT6IAO4litrZKTU aj4vitqHW1+RQsHn3k/gSvt7FwyQwpy0mEnShBgr6RQiGtlBODNY67sTl+W8M/b6SLTAaaDri3BO 5u6wrDs149rMELJAdoVBjmXW+zRH3kZzh3lwyTZsYtk7L+3DYbTiiHq+sRB4F9XoBPAz5Psv4q4E iPq07nW3acbW84zTz3CyQUmQkJT9VB1oUKHz6sNoyccqzcMX4q1GHAYpQ7FAXlKMxidoN1Ay5DWA NgTmgJXzKhcI2nIZoq1x3yq4814O1LQd9QP68gI37+0= ) ; Key ID = 48903 . 172800 IN DNSKEY ( 256 3 8 AwEAAdauOGxLhfAKFTTZwGhBXbk793QKdWIQRjiSftWdusCwkPhNyJrIjwtNffCWXGLlZAbpcs41 4RE3oS1qVwV+AdXsO92SBu5haGlxMUk0NqZO7Xlf84/wrzGZVRRouPo5pNX/CKS8Mv9UOi0olKGC u31dNfh8qCszWZcloLDgeLzSnQSkvFoGe69vNCfh7feESKedkBC2qRz0BZv9+oJI0IY/3D7WEnV0 NOlf8gSHozhfJFJ/ZAKtvw/Q3ogrVJFk0LyVaU/NVtVA5FM4pVMIRID7pfrPi78aAzG7b/Wh/Pce 4jPAIpS3dApq25YkvMuPvfB91NMf9FemKwlp78PBVcM= ) ; Key ID = 46594 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20200722000000 20200701000000 20326 . OegGYuMyXFOfyJusWYcPZbbrbjHTk5zkyAFfgGf8vWUH8tHoLHn02+QK8u2D/RUAvacwChEOoh3/ iAW5n5GJk+CLYtilcgtEt5uKYX5uVt/vM9aDKr/hGmnhq1Z75scHpLRwL9e/icHZuiyQdgElGwwL hh1vn+m29fwwyAim3UG28gNY/DaifSuK/9g6dlCFDCjBHnOuSqOxoM53vfaQB/bGsXSTZbbWtReh ixpccKxVGwjl3XDG27Itgji7s/JQM2AhgYJcDULa0JTN06fGQM5dmhvvXTlkAZ7fhqTVzyBQcsu9 kbRbYGc0mhDCUzPv6qEigw+pKpifMmVC3+Q7sw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option:
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAc4qsciJ5MdMUIu4n/pSTsSiU9OCyAanPTe5TcMX4v1hxhpFwiTGQUv3BXT6IAO4litrZKTU aj4vitqHW1+RQsHn3k/gSvt7FwyQwpy0mEnShBgr6RQiGtlBODNY67sTl+W8M/b6SLTAaaDri3BO 5u6wrDs149rMELJAdoVBjmXW+zRH3kZzh3lwyTZsYtk7L+3DYbTiiHq+sRB4F9XoBPAz5Psv4q4E iPq07nW3acbW84zTz3CyQUmQkJT9VB1oUKHz6sNoyccqzcMX4q1GHAYpQ7FAXlKMxidoN1Ay5DWA NgTmgJXzKhcI2nIZoq1x3yq4814O1LQd9QP68gI37+0= ) ; Key ID = 48903`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAdauOGxLhfAKFTTZwGhBXbk793QKdWIQRjiSftWdusCwkPhNyJrIjwtNffCWXGLlZAbpcs41 4RE3oS1qVwV+AdXsO92SBu5haGlxMUk0NqZO7Xlf84/wrzGZVRRouPo5pNX/CKS8Mv9UOi0olKGC u31dNfh8qCszWZcloLDgeLzSnQSkvFoGe69vNCfh7feESKedkBC2qRz0BZv9+oJI0IY/3D7WEnV0 NOlf8gSHozhfJFJ/ZAKtvw/Q3ogrVJFk0LyVaU/NVtVA5FM4pVMIRID7pfrPi78aAzG7b/Wh/Pce 4jPAIpS3dApq25YkvMuPvfB91NMf9FemKwlp78PBVcM= ) ; Key ID = 46594`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20200722000000 20200701000000 20326 . OegGYuMyXFOfyJusWYcPZbbrbjHTk5zkyAFfgGf8vWUH8tHoLHn02+QK8u2D/RUAvacwChEOoh3/ iAW5n5GJk+CLYtilcgtEt5uKYX5uVt/vM9aDKr/hGmnhq1Z75scHpLRwL9e/icHZuiyQdgElGwwL hh1vn+m29fwwyAim3UG28gNY/DaifSuK/9g6dlCFDCjBHnOuSqOxoM53vfaQB/bGsXSTZbbWtReh ixpccKxVGwjl3XDG27Itgji7s/JQM2AhgYJcDULa0JTN06fGQM5dmhvvXTlkAZ7fhqTVzyBQcsu9 kbRbYGc0mhDCUzPv6qEigw+pKpifMmVC3+Q7sw== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=48903 is now in the chain-of-trust
	DNSKEY=46594 is now in the chain-of-trust
	Query to j.root-servers.net for righter.ch/A
	Received 798 bytes from 192.58.128.30
	;; Answer received from 192.58.128.30 (798 bytes) ;; HEADER SECTION ;; id = 17702 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 9 arcount = 15 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) ch. 172800 IN NS a.nic.ch. ch. 172800 IN NS b.nic.ch. ch. 172800 IN NS c.nic.ch. ch. 172800 IN NS e.nic.ch. ch. 172800 IN NS f.nic.ch. ch. 172800 IN NS g.nic.ch. ch. 172800 IN NS h.nic.ch. ch. 86400 IN DS ( 55966 13 2 ceb479416e4efd770800434be1245e1b10d4cf018255c11d8544c448fa032b32 ) ch. 86400 IN RRSIG ( DS 8 1 86400 20200717170000 20200704160000 46594 . MQkL4HyyIp7eiR+jg4tIZJyPHT9BQglp0ubxAa3WFLurCiaGCyt2dwfqXivUuYJLJ40Q7iPUNeUd gupcY5K3DQeTjTrrLwfsKPK0lyZu3BpM4EwUIILmMMTe+mYasLKDJfbHTpVqBX14iMOrqcQtL3Rt 8vjYEzySGH7P9IyjLHKGkOF+eegy46GsBPFYzROhSHv0PbuA1J18WcxRIL8RpV1QqV6wUigU9NUM YOyo25+NZPHkG9w2Uc57DjZGDVKI8P1SF0QASpg1MTHJZ73rz+OtRaF6rrMWRQvJQfRtPl4mvkr+ EcxrxFr/GahxhF1e99/gPybqLHacPvGrSqSMdg== ) ;; ADDITIONAL SECTION (15 records) a.nic.ch. 172800 IN A 130.59.31.41 b.nic.ch. 172800 IN A 130.59.31.43 c.nic.ch. 172800 IN A 74.116.178.40 e.nic.ch. 172800 IN A 194.0.17.1 f.nic.ch. 172800 IN A 194.146.106.10 g.nic.ch. 172800 IN A 194.0.1.40 h.nic.ch. 172800 IN A 85.119.5.230 a.nic.ch. 172800 IN AAAA 2001:620:0:ff::56 b.nic.ch. 172800 IN AAAA 2001:620:0:ff::58 c.nic.ch. 172800 IN AAAA 2620:7d:e000::28 e.nic.ch. 172800 IN AAAA 2001:678:3::1 f.nic.ch. 172800 IN AAAA 2001:67c:1010:2::53 g.nic.ch. 172800 IN AAAA 2001:678:4::28 h.nic.ch. 172800 IN AAAA 2a03:bd80:36::1:203:230 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option:
	Query to b.root-servers.net for ch/DNSKEY
	Received 790 bytes from 199.9.14.201
	;; Answer received from 199.9.14.201 (790 bytes) ;; HEADER SECTION ;; id = 59322 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 9 arcount = 15 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; ch. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) ch. 172800 IN NS c.nic.ch. ch. 172800 IN NS b.nic.ch. ch. 172800 IN NS f.nic.ch. ch. 172800 IN NS h.nic.ch. ch. 172800 IN NS a.nic.ch. ch. 172800 IN NS e.nic.ch. ch. 172800 IN NS g.nic.ch. ch. 86400 IN DS ( 55966 13 2 ceb479416e4efd770800434be1245e1b10d4cf018255c11d8544c448fa032b32 ) ch. 86400 IN RRSIG ( DS 8 1 86400 20200717170000 20200704160000 46594 . MQkL4HyyIp7eiR+jg4tIZJyPHT9BQglp0ubxAa3WFLurCiaGCyt2dwfqXivUuYJLJ40Q7iPUNeUd gupcY5K3DQeTjTrrLwfsKPK0lyZu3BpM4EwUIILmMMTe+mYasLKDJfbHTpVqBX14iMOrqcQtL3Rt 8vjYEzySGH7P9IyjLHKGkOF+eegy46GsBPFYzROhSHv0PbuA1J18WcxRIL8RpV1QqV6wUigU9NUM YOyo25+NZPHkG9w2Uc57DjZGDVKI8P1SF0QASpg1MTHJZ73rz+OtRaF6rrMWRQvJQfRtPl4mvkr+ EcxrxFr/GahxhF1e99/gPybqLHacPvGrSqSMdg== ) ;; ADDITIONAL SECTION (15 records) a.nic.ch. 172800 IN A 130.59.31.41 b.nic.ch. 172800 IN A 130.59.31.43 c.nic.ch. 172800 IN A 74.116.178.40 e.nic.ch. 172800 IN A 194.0.17.1 f.nic.ch. 172800 IN A 194.146.106.10 g.nic.ch. 172800 IN A 194.0.1.40 h.nic.ch. 172800 IN A 85.119.5.230 a.nic.ch. 172800 IN AAAA 2001:620:0:ff::56 b.nic.ch. 172800 IN AAAA 2001:620:0:ff::58 c.nic.ch. 172800 IN AAAA 2620:7d:e000::28 e.nic.ch. 172800 IN AAAA 2001:678:3::1 f.nic.ch. 172800 IN AAAA 2001:67c:1010:2::53 g.nic.ch. 172800 IN AAAA 2001:678:4::28 h.nic.ch. 172800 IN AAAA 2a03:bd80:36::1:203:230 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone ch

	Checking DS between . and ch
	Query to c.root-servers.net for ch/DS
	Received 366 bytes from 192.33.4.12
	;; Answer received from 192.33.4.12 (366 bytes) ;; HEADER SECTION ;; id = 526 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; ch. IN DS ;; ANSWER SECTION (2 records) ch. 86400 IN DS ( 55966 13 2 ceb479416e4efd770800434be1245e1b10d4cf018255c11d8544c448fa032b32 ) ch. 86400 IN RRSIG ( DS 8 1 86400 20200717170000 20200704160000 46594 . MQkL4HyyIp7eiR+jg4tIZJyPHT9BQglp0ubxAa3WFLurCiaGCyt2dwfqXivUuYJLJ40Q7iPUNeUd gupcY5K3DQeTjTrrLwfsKPK0lyZu3BpM4EwUIILmMMTe+mYasLKDJfbHTpVqBX14iMOrqcQtL3Rt 8vjYEzySGH7P9IyjLHKGkOF+eegy46GsBPFYzROhSHv0PbuA1J18WcxRIL8RpV1QqV6wUigU9NUM YOyo25+NZPHkG9w2Uc57DjZGDVKI8P1SF0QASpg1MTHJZ73rz+OtRaF6rrMWRQvJQfRtPl4mvkr+ EcxrxFr/GahxhF1e99/gPybqLHacPvGrSqSMdg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 1 DS records for ch in the . zone
	DS=55966/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`ch. 86400 IN RRSIG ( DS 8 1 86400 20200717170000 20200704160000 46594 . MQkL4HyyIp7eiR+jg4tIZJyPHT9BQglp0ubxAa3WFLurCiaGCyt2dwfqXivUuYJLJ40Q7iPUNeUd gupcY5K3DQeTjTrrLwfsKPK0lyZu3BpM4EwUIILmMMTe+mYasLKDJfbHTpVqBX14iMOrqcQtL3Rt 8vjYEzySGH7P9IyjLHKGkOF+eegy46GsBPFYzROhSHv0PbuA1J18WcxRIL8RpV1QqV6wUigU9NUM YOyo25+NZPHkG9w2Uc57DjZGDVKI8P1SF0QASpg1MTHJZ73rz+OtRaF6rrMWRQvJQfRtPl4mvkr+ EcxrxFr/GahxhF1e99/gPybqLHacPvGrSqSMdg== )`
	RRSIG=46594 and DNSKEY=46594 verifies the DS RRset
	DS=55966/SHA-256 is now in the chain-of-trust
	`ch. 86400 IN DS ( 55966 13 2 ceb479416e4efd770800434be1245e1b10d4cf018255c11d8544c448fa032b32 )`
	Query to a.nic.ch for ch/DNSKEY
	Received 369 bytes from 130.59.31.41
	;; Answer received from 130.59.31.41 (369 bytes) ;; HEADER SECTION ;; id = 32131 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 4 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; ch. IN DNSKEY ;; ANSWER SECTION (4 records) ch. 86400 IN DNSKEY ( 257 3 13 8Tb8/h/ON8XsvUxjxUJyFLykQUUEyY80LACtat0nN+S0TOjoQ8o5e+huum6ZOJx1bVh4PaUfoUvN BUS77VWB0Q== ) ; Key ID = 55966 ch. 86400 IN DNSKEY ( 256 3 13 L5lA+TxgMsidHzgs4YVHoyPODrhlEuVNCU2JHScjA8VALYpLsWfuX4uhsWeiPlw0Ebk5DiqD3WGL e8gKVgEE+g== ) ; Key ID = 50016 ch. 86400 IN DNSKEY ( 256 3 13 cvvim0D/3v996yaXZhOLOGsPp0vwNlQlRkp2OGZeN7oCcqFwCpNHFe5dRYT08TeydzQONQx451xV SWmwb1vO9Q== ) ; Key ID = 36191 ch. 86400 IN RRSIG ( DNSKEY 13 1 86400 20200729100909 20200613090909 55966 ch. biCZP/kBDHyQDwR8WaZtlOUuvDjfBA0Xqdsan4BAR8ZC+QRsRoFHNUOd3yYKpEAXHcJGuUOoiFro +xf26PDlJQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Found 3 DNSKEY records for ch
	`ch. 86400 IN DNSKEY ( 257 3 13 8Tb8/h/ON8XsvUxjxUJyFLykQUUEyY80LACtat0nN+S0TOjoQ8o5e+huum6ZOJx1bVh4PaUfoUvN BUS77VWB0Q== ) ; Key ID = 55966`
	`ch. 86400 IN DNSKEY ( 256 3 13 L5lA+TxgMsidHzgs4YVHoyPODrhlEuVNCU2JHScjA8VALYpLsWfuX4uhsWeiPlw0Ebk5DiqD3WGL e8gKVgEE+g== ) ; Key ID = 50016`
	`ch. 86400 IN DNSKEY ( 256 3 13 cvvim0D/3v996yaXZhOLOGsPp0vwNlQlRkp2OGZeN7oCcqFwCpNHFe5dRYT08TeydzQONQx451xV SWmwb1vO9Q== ) ; Key ID = 36191`
	DNSKEY=55966/SEP is now in the chain-of-trust
	DS=55966/SHA-256 verifies DNSKEY=55966/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`ch. 86400 IN RRSIG ( DNSKEY 13 1 86400 20200729100909 20200613090909 55966 ch. biCZP/kBDHyQDwR8WaZtlOUuvDjfBA0Xqdsan4BAR8ZC+QRsRoFHNUOd3yYKpEAXHcJGuUOoiFro +xf26PDlJQ== )`
	RRSIG=55966 and DNSKEY=55966/SEP verifies the DNSKEY RRset
	DNSKEY=50016 is now in the chain-of-trust
	DNSKEY=36191 is now in the chain-of-trust
	Query to h.nic.ch for righter.ch/A
	Received 283 bytes from 85.119.5.230
	;; Answer received from 85.119.5.230 (283 bytes) ;; HEADER SECTION ;; id = 28080 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 3 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) righter.ch. 3600 IN NS ns2.righter.ch. righter.ch. 3600 IN DS 50387 8 1 4d0537a4d9828c40dbba7beb5abdce151b1ae323 righter.ch. 3600 IN DS ( 50387 8 2 3d4bc0ef0f6061e778961847b80fbdd0fb9a9594c99ab98a3c0e378402e40e6b ) righter.ch. 3600 IN RRSIG ( DS 13 2 3600 20200724222546 20200624220152 50016 ch. KukA9pgiH5yC/kehbcZ6C0t1jHsAcDz6fuCCPphivFUzwc031IkMH38vt1Euer42kbDL2rKPtel0 h4T/0/RlTQ== ) ;; ADDITIONAL SECTION (3 records) ns2.righter.ch. 3600 IN A 2.56.96.16 ns2.righter.ch. 3600 IN AAAA 2a03:4000:3e:70::16 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1232 ;; option:
	Query to g.nic.ch for righter.ch/DNSKEY
	Received 293 bytes from 194.0.1.40
	;; Answer received from 194.0.1.40 (293 bytes) ;; HEADER SECTION ;; id = 11358 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 3 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) righter.ch. 3600 IN NS ns2.righter.ch. righter.ch. 3600 IN DS 50387 8 1 4d0537a4d9828c40dbba7beb5abdce151b1ae323 righter.ch. 3600 IN DS ( 50387 8 2 3d4bc0ef0f6061e778961847b80fbdd0fb9a9594c99ab98a3c0e378402e40e6b ) righter.ch. 3600 IN RRSIG ( DS 13 2 3600 20200724222546 20200624220152 50016 ch. KukA9pgiH5yC/kehbcZ6C0t1jHsAcDz6fuCCPphivFUzwc031IkMH38vt1Euer42kbDL2rKPtel0 h4T/0/RlTQ== ) ;; ADDITIONAL SECTION (3 records) ns2.righter.ch. 3600 IN A 2.56.96.16 ns2.righter.ch. 3600 IN AAAA 2a03:4000:3e:70::16 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone righter.ch

righter.ch

	Checking DS between ch and righter.ch
	Query to e.nic.ch for righter.ch/DS
	Received 221 bytes from 194.0.17.1
	;; Answer received from 194.0.17.1 (221 bytes) ;; HEADER SECTION ;; id = 29296 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN DS ;; ANSWER SECTION (3 records) righter.ch. 3600 IN DS ( 50387 8 2 3d4bc0ef0f6061e778961847b80fbdd0fb9a9594c99ab98a3c0e378402e40e6b ) righter.ch. 3600 IN DS 50387 8 1 4d0537a4d9828c40dbba7beb5abdce151b1ae323 righter.ch. 3600 IN RRSIG ( DS 13 2 3600 20200724222546 20200624220152 50016 ch. KukA9pgiH5yC/kehbcZ6C0t1jHsAcDz6fuCCPphivFUzwc031IkMH38vt1Euer42kbDL2rKPtel0 h4T/0/RlTQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DS records for righter.ch in the ch zone
	DS=50387/SHA-256 has algorithm RSASHA256
	DS=50387/SHA-1 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`righter.ch. 3600 IN RRSIG ( DS 13 2 3600 20200724222546 20200624220152 50016 ch. KukA9pgiH5yC/kehbcZ6C0t1jHsAcDz6fuCCPphivFUzwc031IkMH38vt1Euer42kbDL2rKPtel0 h4T/0/RlTQ== )`
	RRSIG=50016 and DNSKEY=50016 verifies the DS RRset
	DS=50387/SHA-256 is now in the chain-of-trust
	`righter.ch. 3600 IN DS ( 50387 8 2 3d4bc0ef0f6061e778961847b80fbdd0fb9a9594c99ab98a3c0e378402e40e6b )`
	`righter.ch. 3600 IN DS 50387 8 1 4d0537a4d9828c40dbba7beb5abdce151b1ae323`
	Query to ns2.righter.ch for righter.ch/DNSKEY
	Received 761 bytes from 2.56.96.16
	;; Answer received from 2.56.96.16 (761 bytes) ;; HEADER SECTION ;; id = 9337 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN DNSKEY ;; ANSWER SECTION (3 records) righter.ch. 3600 IN DNSKEY ( 256 3 8 AwEAAbrXJ4m8BtFywCfjMiO8o43Bt3lhAAfFmyTDTOjAi7BR3FBj1ZpCly5pTRFEwXZhlkj9LsIV eI6GzfNo1/5eqnDZMDhmBN/93dqY1OIaf9490WHEARHPpGS35rb9fu5XUpJjordi5PqwmJB+Booe bneccoXN/DrWrg7XnG/n3Zkp ) ; Key ID = 57339 righter.ch. 3600 IN RRSIG ( DNSKEY 8 2 3600 20200716000000 20200625000000 50387 righter.ch. afKaLivr8WTqkPib4VKD4gBxtL3APcP4OcL+vmN5uay6ugoLj/WWkl9HK1guhjfZfWUPit+mMdgS q3R+pzqPlmJRn0YwQV8kvEiqRsVO42qktr30voPWRr7kCC6YsUaDkqPI5bM42QvyocMkNwWomyFn o66Ht4TKVXU2YNPHFG85ZtyTE0IwAl0ZBrlnOMNRS1zKwrfvEM5qowdfZqmq2BzyHoOTiHnYszO/ AKaauddP1zcB8Qn8rcTdjCJZc3JD2qo9fiHe1SXeQdwG1f0h/ahnRnXnieB5k28gTCIe+vquVZl/ fcdeQ3P9GsZVI02UJLzRyWDHTadIo2/WqVUYGQ== ) righter.ch. 3600 IN DNSKEY ( 257 3 8 AwEAAdDryTFIV1X1MLQMWQecCSpTijSE46ZxHRB/nSOgHfc6rRY/S3i59zAfph9gC40Bq4u2l4fW T+vWvOxr9LyJpFbyd9UGZDUNKmyEHjzJk3/dxInwLhDewoao83T/O8K2NyJGUXgLLapaX+BCVGRN E++xDkROZH3deA+83SCwrFNG9bDxtvYkG+x9ikTCJOV+YcRS1juZD7aLX3FM/MeKlGsCULAUUtT+ uwspPMFGO+zFCvvoj1SBLgPmW6LJBmLFmLAWDOBOddOjk0JUSJ37V3vGYOq83z86vSJtkWL/jbqL IjBg9BlIIGNI6BaHLDh44oZXMT3mIpG88kpM5jVL9ws= ) ; Key ID = 50387 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option:
	Found 2 DNSKEY records for righter.ch
	`righter.ch. 3600 IN DNSKEY ( 256 3 8 AwEAAbrXJ4m8BtFywCfjMiO8o43Bt3lhAAfFmyTDTOjAi7BR3FBj1ZpCly5pTRFEwXZhlkj9LsIV eI6GzfNo1/5eqnDZMDhmBN/93dqY1OIaf9490WHEARHPpGS35rb9fu5XUpJjordi5PqwmJB+Booe bneccoXN/DrWrg7XnG/n3Zkp ) ; Key ID = 57339`
	`righter.ch. 3600 IN DNSKEY ( 257 3 8 AwEAAdDryTFIV1X1MLQMWQecCSpTijSE46ZxHRB/nSOgHfc6rRY/S3i59zAfph9gC40Bq4u2l4fW T+vWvOxr9LyJpFbyd9UGZDUNKmyEHjzJk3/dxInwLhDewoao83T/O8K2NyJGUXgLLapaX+BCVGRN E++xDkROZH3deA+83SCwrFNG9bDxtvYkG+x9ikTCJOV+YcRS1juZD7aLX3FM/MeKlGsCULAUUtT+ uwspPMFGO+zFCvvoj1SBLgPmW6LJBmLFmLAWDOBOddOjk0JUSJ37V3vGYOq83z86vSJtkWL/jbqL IjBg9BlIIGNI6BaHLDh44oZXMT3mIpG88kpM5jVL9ws= ) ; Key ID = 50387`
	DNSKEY=50387/SEP is now in the chain-of-trust
	DS=50387/SHA-256 verifies DNSKEY=50387/SEP
	DS=50387/SHA-1 verifies DNSKEY=50387/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`righter.ch. 3600 IN RRSIG ( DNSKEY 8 2 3600 20200716000000 20200625000000 50387 righter.ch. afKaLivr8WTqkPib4VKD4gBxtL3APcP4OcL+vmN5uay6ugoLj/WWkl9HK1guhjfZfWUPit+mMdgS q3R+pzqPlmJRn0YwQV8kvEiqRsVO42qktr30voPWRr7kCC6YsUaDkqPI5bM42QvyocMkNwWomyFn o66Ht4TKVXU2YNPHFG85ZtyTE0IwAl0ZBrlnOMNRS1zKwrfvEM5qowdfZqmq2BzyHoOTiHnYszO/ AKaauddP1zcB8Qn8rcTdjCJZc3JD2qo9fiHe1SXeQdwG1f0h/ahnRnXnieB5k28gTCIe+vquVZl/ fcdeQ3P9GsZVI02UJLzRyWDHTadIo2/WqVUYGQ== )`
	RRSIG=50387 and DNSKEY=50387/SEP verifies the DNSKEY RRset
	DNSKEY=57339 is now in the chain-of-trust
	Query to ns2.righter.ch for righter.ch/A
	Received 225 bytes from 2.56.96.16
	;; Answer received from 2.56.96.16 (225 bytes) ;; HEADER SECTION ;; id = 52682 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN A ;; ANSWER SECTION (2 records) righter.ch. 300 IN RRSIG ( A 8 2 300 20200716000000 20200625000000 57339 righter.ch. Is7Csct3ExiV5PzNoTA9XaNB7bbbTEbHTd1NiNfcAEC15rN1CrEyTkeV1uE+PGANnA6zhTpOl78W APa6XQ8glz3KKiz4ybkcbsJuRtvhnn32n/CWhNdKT1O/5OZfciFjlmR5zO6uKuQ1MK/HGEvHbLRt O5sTb+rCe0xLSrJgum4= ) righter.ch. 300 IN A 2.56.96.16 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option:
	righter.ch is authoritative for righter.ch
	Found RRSIG signed by righter.ch zone
	Query to ns2.righter.ch for righter.ch/SOA
	Received 256 bytes from 2.56.96.16
	;; Answer received from 2.56.96.16 (256 bytes) ;; HEADER SECTION ;; id = 17324 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN SOA ;; ANSWER SECTION (2 records) righter.ch. 300 IN RRSIG ( SOA 8 2 300 20200716000000 20200625000000 57339 righter.ch. ZiYdOSl24cgTZg5K9n/5q99Nl/54OhgnjpNdZsoJhLziH2ABfsLHhGpYTqAsOFx1/NY/DdAmPApu DDRlnZDgQXgv0hM6UwtLLv33kOuVrwtWgJ/g76orvOKzHhZz+goAyfzphLiP7EJspmRQMq8Oow8u pq96SIzHeurTF/LNiOE= ) righter.ch. 300 IN SOA ( ns2.righter.ch. server.righter.ch. 2019121802 ;serial 14400 ;refresh 1800 ;retry 1209600 ;expire 3600 ;minimum ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option:
	Query to ns2.righter.ch for righter.ch/A
	Received 225 bytes from 2.56.96.16
	;; Answer received from 2.56.96.16 (225 bytes) ;; HEADER SECTION ;; id = 43689 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN A ;; ANSWER SECTION (2 records) righter.ch. 300 IN RRSIG ( A 8 2 300 20200716000000 20200625000000 57339 righter.ch. Is7Csct3ExiV5PzNoTA9XaNB7bbbTEbHTd1NiNfcAEC15rN1CrEyTkeV1uE+PGANnA6zhTpOl78W APa6XQ8glz3KKiz4ybkcbsJuRtvhnn32n/CWhNdKT1O/5OZfciFjlmR5zO6uKuQ1MK/HGEvHbLRt O5sTb+rCe0xLSrJgum4= ) righter.ch. 300 IN A 2.56.96.16 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option:
	righter.ch A RR has value 2.56.96.16
	Found 1 RRSIGs over A RRset
	`righter.ch. 300 IN RRSIG ( A 8 2 300 20200716000000 20200625000000 57339 righter.ch. Is7Csct3ExiV5PzNoTA9XaNB7bbbTEbHTd1NiNfcAEC15rN1CrEyTkeV1uE+PGANnA6zhTpOl78W APa6XQ8glz3KKiz4ybkcbsJuRtvhnn32n/CWhNdKT1O/5OZfciFjlmR5zO6uKuQ1MK/HGEvHbLRt O5sTb+rCe0xLSrJgum4= )`
	RRSIG=57339 and DNSKEY=57339 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test righter.ch at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: