DNSSEC Analyzer - righter.ch

Domain Name:

Time: 2019-12-12 18:51:34 UTC, NTP stratum 4

Analyzing DNSSEC problems for righter.ch

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to l.root-servers.net for ./DNSKEY
	Error querying l.root-servers.net/2001:500:9f:0:0:0:0:42 for ./DNSKEY: 'IPv6 transport disabled'
	Received 864 bytes from 199.7.83.42
	;; Answer received from 199.7.83.42 (864 bytes) ;; HEADER SECTION ;; id = 36337 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (3 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAbPwrxwtOMENWvblQbUFwBllR7ZtXsu9rg/LdyklKs9gU2GQTeOc59XjhuAPZ4WrT09z6YPL +vzIIJqnG3Hiru7hFUQ4pH0qsLNxrsuZrZYmXAKoVa9SXL1Ap0LygwrIugEk1G4v7Rk/Alt1jLUI E+ZymGtSEhIuGQdXrEmj3ffzXY13H42X4Ja3vJTn/WIQOXY7vwHXGDypSh9j0Tt0hknF1yVJCrIp fkhFWihMKNdMzMprD4bV+PDLRA5YSn3OPIeUnRn9qBUCN11LXQKb+W3Jg+m/5xQRQJzJ/qXgDh1+ aN+Mc9AstP29Y/ZLFmF6cKtL2zoUMN5I5QymeSkJJzc= ) ; Key ID = 22545 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20191231000000 20191210000000 20326 . M6PHO6VOOLVi9f31412BD96l/dWG8WOE+R6Q+KYMr4aJpS/hTZjjs6EDa249B2cjO7QzSD+qxWNT s7enqC1DsEAjeVm0epe3h6TFVBjX76R0MIqYC3+LjgGjyQnpish6mPApIx0ZC8mxewn0GCvC9Gqk 9S7s7IDD8FQWosXQRChqF9M7qkG1NuKvgPvqgpAk3naii0Eajx8N3XiPo8EwVS3yWOct4wcY8B1s fZjvL7mLDAiggGouyxt5PGm9TdnG7eioZPM1LyX1YgDV4/qUKmp7BHhsVKh/nQaR46yxbcpiRz6R nADB991g/+3bgY8dSACfUI0aBFsRT0DHHnMfpg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbPwrxwtOMENWvblQbUFwBllR7ZtXsu9rg/LdyklKs9gU2GQTeOc59XjhuAPZ4WrT09z6YPL +vzIIJqnG3Hiru7hFUQ4pH0qsLNxrsuZrZYmXAKoVa9SXL1Ap0LygwrIugEk1G4v7Rk/Alt1jLUI E+ZymGtSEhIuGQdXrEmj3ffzXY13H42X4Ja3vJTn/WIQOXY7vwHXGDypSh9j0Tt0hknF1yVJCrIp fkhFWihMKNdMzMprD4bV+PDLRA5YSn3OPIeUnRn9qBUCN11LXQKb+W3Jg+m/5xQRQJzJ/qXgDh1+ aN+Mc9AstP29Y/ZLFmF6cKtL2zoUMN5I5QymeSkJJzc= ) ; Key ID = 22545`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; Key ID = 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20191231000000 20191210000000 20326 . M6PHO6VOOLVi9f31412BD96l/dWG8WOE+R6Q+KYMr4aJpS/hTZjjs6EDa249B2cjO7QzSD+qxWNT s7enqC1DsEAjeVm0epe3h6TFVBjX76R0MIqYC3+LjgGjyQnpish6mPApIx0ZC8mxewn0GCvC9Gqk 9S7s7IDD8FQWosXQRChqF9M7qkG1NuKvgPvqgpAk3naii0Eajx8N3XiPo8EwVS3yWOct4wcY8B1s fZjvL7mLDAiggGouyxt5PGm9TdnG7eioZPM1LyX1YgDV4/qUKmp7BHhsVKh/nQaR46yxbcpiRz6R nADB991g/+3bgY8dSACfUI0aBFsRT0DHHnMfpg== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=22545 is now in the chain-of-trust
	Query to j.root-servers.net for righter.ch/A
	Received 858 bytes from 192.58.128.30
	;; Answer received from 192.58.128.30 (858 bytes) ;; HEADER SECTION ;; id = 9014 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 10 arcount = 17 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (10 records) ch. 172800 IN NS b.nic.ch. ch. 172800 IN NS c.nic.ch. ch. 172800 IN NS g.nic.ch. ch. 172800 IN NS f.nic.ch. ch. 172800 IN NS h.nic.ch. ch. 172800 IN NS e.nic.ch. ch. 172800 IN NS d.nic.ch. ch. 172800 IN NS a.nic.ch. ch. 86400 IN DS ( 55966 13 2 ceb479416e4efd770800434be1245e1b10d4cf018255c11d8544c448fa032b32 ) ch. 86400 IN RRSIG ( DS 8 1 86400 20191225170000 20191212160000 22545 . fdJp60kwPUMXT5QKuhhJhZsbKjr5oIv+9tYU4+7O6l+FMu4P4f8hEtIfljpo2Pc/BlMf6JcqiruJ /sG7IXJc0jkCxDdZeuVr2KlQMvhIjq6DU95ZuxoJOVAB4gpW1iyO0FMO7XRfpE1CQKK8iq/e+V0b Ahh2rrJTI1G0UqtsHijFeUa7rkZdbWy41pCSJER3kdz3dhueGXmrsNlor92rY1EhYHV13BWSR1+H zWYSae2dJtJmaDBxm58oNRidL+AYAyJPXCkxDVi1zL1vuB5CV2SvYQbUYK7qYwK3xodNtvcqL0Xv 6Gj/G+yE0HQxhDDVXdjkHsebHUgB+ap4SQefOg== ) ;; ADDITIONAL SECTION (17 records) b.nic.ch. 172800 IN A 130.59.31.43 b.nic.ch. 172800 IN AAAA 2001:620:0:ff::58 c.nic.ch. 172800 IN A 147.28.0.39 c.nic.ch. 172800 IN AAAA 2001:418:1::39 g.nic.ch. 172800 IN A 194.0.1.40 g.nic.ch. 172800 IN AAAA 2001:678:4::28 f.nic.ch. 172800 IN A 194.146.106.10 f.nic.ch. 172800 IN AAAA 2001:67c:1010:2::53 h.nic.ch. 172800 IN A 85.119.5.230 h.nic.ch. 172800 IN AAAA 2a03:bd80:36::1:203:230 e.nic.ch. 172800 IN A 194.0.17.1 e.nic.ch. 172800 IN AAAA 2001:678:3::1 d.nic.ch. 172800 IN A 200.160.0.5 d.nic.ch. 172800 IN AAAA 2001:12ff:0:a20::5 a.nic.ch. 172800 IN A 130.59.31.41 a.nic.ch. 172800 IN AAAA 2001:620:0:ff::56 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to a.root-servers.net for ch/DNSKEY
	Error querying a.root-servers.net/2001:503:ba3e:0:0:0:2:30 for ch/DNSKEY: 'IPv6 transport disabled'
	Received 850 bytes from 198.41.0.4
	;; Answer received from 198.41.0.4 (850 bytes) ;; HEADER SECTION ;; id = 6861 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 10 arcount = 17 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option: ;; QUESTION SECTION (1 record) ;; ch. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (10 records) ch. 172800 IN NS a.nic.ch. ch. 172800 IN NS b.nic.ch. ch. 172800 IN NS c.nic.ch. ch. 172800 IN NS d.nic.ch. ch. 172800 IN NS e.nic.ch. ch. 172800 IN NS f.nic.ch. ch. 172800 IN NS g.nic.ch. ch. 172800 IN NS h.nic.ch. ch. 86400 IN DS ( 55966 13 2 ceb479416e4efd770800434be1245e1b10d4cf018255c11d8544c448fa032b32 ) ch. 86400 IN RRSIG ( DS 8 1 86400 20191225170000 20191212160000 22545 . fdJp60kwPUMXT5QKuhhJhZsbKjr5oIv+9tYU4+7O6l+FMu4P4f8hEtIfljpo2Pc/BlMf6JcqiruJ /sG7IXJc0jkCxDdZeuVr2KlQMvhIjq6DU95ZuxoJOVAB4gpW1iyO0FMO7XRfpE1CQKK8iq/e+V0b Ahh2rrJTI1G0UqtsHijFeUa7rkZdbWy41pCSJER3kdz3dhueGXmrsNlor92rY1EhYHV13BWSR1+H zWYSae2dJtJmaDBxm58oNRidL+AYAyJPXCkxDVi1zL1vuB5CV2SvYQbUYK7qYwK3xodNtvcqL0Xv 6Gj/G+yE0HQxhDDVXdjkHsebHUgB+ap4SQefOg== ) ;; ADDITIONAL SECTION (17 records) a.nic.ch. 172800 IN A 130.59.31.41 b.nic.ch. 172800 IN A 130.59.31.43 c.nic.ch. 172800 IN A 147.28.0.39 d.nic.ch. 172800 IN A 200.160.0.5 e.nic.ch. 172800 IN A 194.0.17.1 f.nic.ch. 172800 IN A 194.146.106.10 g.nic.ch. 172800 IN A 194.0.1.40 h.nic.ch. 172800 IN A 85.119.5.230 a.nic.ch. 172800 IN AAAA 2001:620:0:ff::56 b.nic.ch. 172800 IN AAAA 2001:620:0:ff::58 c.nic.ch. 172800 IN AAAA 2001:418:1::39 d.nic.ch. 172800 IN AAAA 2001:12ff:0:a20::5 e.nic.ch. 172800 IN AAAA 2001:678:3::1 f.nic.ch. 172800 IN AAAA 2001:67c:1010:2::53 g.nic.ch. 172800 IN AAAA 2001:678:4::28 h.nic.ch. 172800 IN AAAA 2a03:bd80:36::1:203:230 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option:
	Found child zone ch

	Checking DS between . and ch
	Query to j.root-servers.net for ch/DS
	Received 366 bytes from 192.58.128.30
	;; Answer received from 192.58.128.30 (366 bytes) ;; HEADER SECTION ;; id = 10923 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option: ;; QUESTION SECTION (1 record) ;; ch. IN DS ;; ANSWER SECTION (2 records) ch. 86400 IN DS ( 55966 13 2 ceb479416e4efd770800434be1245e1b10d4cf018255c11d8544c448fa032b32 ) ch. 86400 IN RRSIG ( DS 8 1 86400 20191225170000 20191212160000 22545 . fdJp60kwPUMXT5QKuhhJhZsbKjr5oIv+9tYU4+7O6l+FMu4P4f8hEtIfljpo2Pc/BlMf6JcqiruJ /sG7IXJc0jkCxDdZeuVr2KlQMvhIjq6DU95ZuxoJOVAB4gpW1iyO0FMO7XRfpE1CQKK8iq/e+V0b Ahh2rrJTI1G0UqtsHijFeUa7rkZdbWy41pCSJER3kdz3dhueGXmrsNlor92rY1EhYHV13BWSR1+H zWYSae2dJtJmaDBxm58oNRidL+AYAyJPXCkxDVi1zL1vuB5CV2SvYQbUYK7qYwK3xodNtvcqL0Xv 6Gj/G+yE0HQxhDDVXdjkHsebHUgB+ap4SQefOg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1472 ;; option:
	Found 1 DS records for ch in the . zone
	DS=55966/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`ch. 86400 IN RRSIG ( DS 8 1 86400 20191225170000 20191212160000 22545 . fdJp60kwPUMXT5QKuhhJhZsbKjr5oIv+9tYU4+7O6l+FMu4P4f8hEtIfljpo2Pc/BlMf6JcqiruJ /sG7IXJc0jkCxDdZeuVr2KlQMvhIjq6DU95ZuxoJOVAB4gpW1iyO0FMO7XRfpE1CQKK8iq/e+V0b Ahh2rrJTI1G0UqtsHijFeUa7rkZdbWy41pCSJER3kdz3dhueGXmrsNlor92rY1EhYHV13BWSR1+H zWYSae2dJtJmaDBxm58oNRidL+AYAyJPXCkxDVi1zL1vuB5CV2SvYQbUYK7qYwK3xodNtvcqL0Xv 6Gj/G+yE0HQxhDDVXdjkHsebHUgB+ap4SQefOg== )`
	RRSIG=22545 and DNSKEY=22545 verifies the DS RRset
	DS=55966/SHA-256 is now in the chain-of-trust
	`ch. 86400 IN DS ( 55966 13 2 ceb479416e4efd770800434be1245e1b10d4cf018255c11d8544c448fa032b32 )`
	Query to d.nic.ch for ch/DNSKEY
	Received 547 bytes from 200.160.0.5
	;; Answer received from 200.160.0.5 (547 bytes) ;; HEADER SECTION ;; id = 27759 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 6 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; ch. IN DNSKEY ;; ANSWER SECTION (6 records) ch. 86400 IN DNSKEY ( 257 3 13 8Tb8/h/ON8XsvUxjxUJyFLykQUUEyY80LACtat0nN+S0TOjoQ8o5e+huum6ZOJx1bVh4PaUfoUvN BUS77VWB0Q== ) ; Key ID = 55966 ch. 86400 IN DNSKEY ( 256 3 13 ut1Bi/CoLO/IFFUzReeEELTnwEMaGvH/+fJqIpaMpqAfdBsL48nnMxCdR59kteBZ2IU72mx6pwUi +1OFaxIx5w== ) ; Key ID = 1529 ch. 86400 IN DNSKEY ( 257 3 13 Cm86XmSSO2FbG/3i9I++7HrRGNa1hNBZ1P7Y38Rg8uUz4YsKWSahAifoyaNMFWUu32VFj5xJQOEj qkrwD3Decw== ) ; Key ID = 11896 ch. 86400 IN DNSKEY ( 256 3 13 4vwHb2clWzgLVYflNH5JM41zmE0BnyYH6LNgKKPcONyGtm8jVdl1WwtXl7fphbSzrTZ02XMiKYF8 PYzQN4VtAg== ) ; Key ID = 41823 ch. 86400 IN RRSIG ( DNSKEY 13 1 86400 20200101100909 20191116090909 11896 ch. pETeV7FxptgkDPu1/xoVC0midhaK06JG9Tox3lmL8uCk1Ko1OCEQA4Iy+3GgQ4nSBRkQgE2v4VyL +E/AP/mhiw== ) ch. 86400 IN RRSIG ( DNSKEY 13 1 86400 20200101100909 20191116090909 55966 ch. ilTsYiflU+3G9UpbWU+v09zKYCj5j8FRhnXoH8Mi26mU3JKys3PnEumBP9VW/yfcM29mDUFDM0Rr 0kIxO/pXSg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 4 DNSKEY records for ch
	`ch. 86400 IN DNSKEY ( 257 3 13 8Tb8/h/ON8XsvUxjxUJyFLykQUUEyY80LACtat0nN+S0TOjoQ8o5e+huum6ZOJx1bVh4PaUfoUvN BUS77VWB0Q== ) ; Key ID = 55966`
	`ch. 86400 IN DNSKEY ( 256 3 13 ut1Bi/CoLO/IFFUzReeEELTnwEMaGvH/+fJqIpaMpqAfdBsL48nnMxCdR59kteBZ2IU72mx6pwUi +1OFaxIx5w== ) ; Key ID = 1529`
	`ch. 86400 IN DNSKEY ( 257 3 13 Cm86XmSSO2FbG/3i9I++7HrRGNa1hNBZ1P7Y38Rg8uUz4YsKWSahAifoyaNMFWUu32VFj5xJQOEj qkrwD3Decw== ) ; Key ID = 11896`
	`ch. 86400 IN DNSKEY ( 256 3 13 4vwHb2clWzgLVYflNH5JM41zmE0BnyYH6LNgKKPcONyGtm8jVdl1WwtXl7fphbSzrTZ02XMiKYF8 PYzQN4VtAg== ) ; Key ID = 41823`
	DNSKEY=55966/SEP is now in the chain-of-trust
	DS=55966/SHA-256 verifies DNSKEY=55966/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`ch. 86400 IN RRSIG ( DNSKEY 13 1 86400 20200101100909 20191116090909 11896 ch. pETeV7FxptgkDPu1/xoVC0midhaK06JG9Tox3lmL8uCk1Ko1OCEQA4Iy+3GgQ4nSBRkQgE2v4VyL +E/AP/mhiw== )`
	`ch. 86400 IN RRSIG ( DNSKEY 13 1 86400 20200101100909 20191116090909 55966 ch. ilTsYiflU+3G9UpbWU+v09zKYCj5j8FRhnXoH8Mi26mU3JKys3PnEumBP9VW/yfcM29mDUFDM0Rr 0kIxO/pXSg== )`
	RRSIG=11896 and DNSKEY=11896/SEP verifies the DNSKEY RRset
	RRSIG=55966 and DNSKEY=55966/SEP verifies the DNSKEY RRset
	DNSKEY=1529 is now in the chain-of-trust
	DNSKEY=11896/SEP is now in the chain-of-trust
	DNSKEY=41823 is now in the chain-of-trust
	Query to f.nic.ch for righter.ch/A
	Received 311 bytes from 194.146.106.10
	;; Answer received from 194.146.106.10 (311 bytes) ;; HEADER SECTION ;; id = 63462 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 3 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) righter.ch. 3600 IN NS ns2.righter.ch. righter.ch. 3600 IN DS ( 50387 8 2 3d4bc0ef0f6061e778961847b80fbdd0fb9a9594c99ab98a3c0e378402e40e6b ) righter.ch. 3600 IN DS ( 50387 8 4 fa43d9f7090b82190073de720c15834fc95637b0a6a916ab64d71b868d657a09 5632267f61626f8d64c64b32c99fae9a ) righter.ch. 3600 IN RRSIG ( DS 13 2 3600 20191229103905 20191210123001 1529 ch. FJ6LCNCCxyXEDIz/NJFUuxZRbM+PQp5tlzzsiYwQJzzgJ+57MI47i3bOfaMq7xUT7rY317xO9Pju ELmz95uRpQ== ) ;; ADDITIONAL SECTION (3 records) ns2.righter.ch. 3600 IN A 2.56.96.16 ns2.righter.ch. 3600 IN AAAA 2a03:4000:3e:70::16 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Query to d.nic.ch for righter.ch/DNSKEY
	Received 311 bytes from 200.160.0.5
	;; Answer received from 200.160.0.5 (311 bytes) ;; HEADER SECTION ;; id = 48818 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 4 arcount = 3 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) righter.ch. 3600 IN NS ns2.righter.ch. righter.ch. 3600 IN DS ( 50387 8 4 fa43d9f7090b82190073de720c15834fc95637b0a6a916ab64d71b868d657a09 5632267f61626f8d64c64b32c99fae9a ) righter.ch. 3600 IN DS ( 50387 8 2 3d4bc0ef0f6061e778961847b80fbdd0fb9a9594c99ab98a3c0e378402e40e6b ) righter.ch. 3600 IN RRSIG ( DS 13 2 3600 20191229103905 20191210123001 1529 ch. FJ6LCNCCxyXEDIz/NJFUuxZRbM+PQp5tlzzsiYwQJzzgJ+57MI47i3bOfaMq7xUT7rY317xO9Pju ELmz95uRpQ== ) ;; ADDITIONAL SECTION (3 records) ns2.righter.ch. 3600 IN A 2.56.96.16 ns2.righter.ch. 3600 IN AAAA 2a03:4000:3e:70::16 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found child zone righter.ch

righter.ch

	Checking DS between ch and righter.ch
	Query to c.nic.ch for righter.ch/DS
	Error querying c.nic.ch/2001:418:1:0:0:0:0:39 for righter.ch/DS: 'IPv6 transport disabled'
	Received 249 bytes from 147.28.0.39
	;; Answer received from 147.28.0.39 (249 bytes) ;; HEADER SECTION ;; id = 27525 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN DS ;; ANSWER SECTION (3 records) righter.ch. 3600 IN DS ( 50387 8 2 3d4bc0ef0f6061e778961847b80fbdd0fb9a9594c99ab98a3c0e378402e40e6b ) righter.ch. 3600 IN DS ( 50387 8 4 fa43d9f7090b82190073de720c15834fc95637b0a6a916ab64d71b868d657a09 5632267f61626f8d64c64b32c99fae9a ) righter.ch. 3600 IN RRSIG ( DS 13 2 3600 20191229103905 20191210123001 1529 ch. FJ6LCNCCxyXEDIz/NJFUuxZRbM+PQp5tlzzsiYwQJzzgJ+57MI47i3bOfaMq7xUT7rY317xO9Pju ELmz95uRpQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 4096 ;; option:
	Found 2 DS records for righter.ch in the ch zone
	DS=50387/SHA-256 has algorithm RSASHA256
	DS=50387/SHA-384 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`righter.ch. 3600 IN RRSIG ( DS 13 2 3600 20191229103905 20191210123001 1529 ch. FJ6LCNCCxyXEDIz/NJFUuxZRbM+PQp5tlzzsiYwQJzzgJ+57MI47i3bOfaMq7xUT7rY317xO9Pju ELmz95uRpQ== )`
	RRSIG=1529 and DNSKEY=1529 verifies the DS RRset
	DS=50387/SHA-256 is now in the chain-of-trust
	`righter.ch. 3600 IN DS ( 50387 8 2 3d4bc0ef0f6061e778961847b80fbdd0fb9a9594c99ab98a3c0e378402e40e6b )`
	`righter.ch. 3600 IN DS ( 50387 8 4 fa43d9f7090b82190073de720c15834fc95637b0a6a916ab64d71b868d657a09 5632267f61626f8d64c64b32c99fae9a )`
	Query to ns2.righter.ch for righter.ch/DNSKEY
	Error querying ns2.righter.ch/2a03:4000:3e:70:0:0:0:16 for righter.ch/DNSKEY: 'IPv6 transport disabled'
	Received 761 bytes from 2.56.96.16
	;; Answer received from 2.56.96.16 (761 bytes) ;; HEADER SECTION ;; id = 33853 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 3 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN DNSKEY ;; ANSWER SECTION (3 records) righter.ch. 3600 IN DNSKEY ( 256 3 8 AwEAAbrXJ4m8BtFywCfjMiO8o43Bt3lhAAfFmyTDTOjAi7BR3FBj1ZpCly5pTRFEwXZhlkj9LsIV eI6GzfNo1/5eqnDZMDhmBN/93dqY1OIaf9490WHEARHPpGS35rb9fu5XUpJjordi5PqwmJB+Booe bneccoXN/DrWrg7XnG/n3Zkp ) ; Key ID = 57339 righter.ch. 3600 IN DNSKEY ( 257 3 8 AwEAAdDryTFIV1X1MLQMWQecCSpTijSE46ZxHRB/nSOgHfc6rRY/S3i59zAfph9gC40Bq4u2l4fW T+vWvOxr9LyJpFbyd9UGZDUNKmyEHjzJk3/dxInwLhDewoao83T/O8K2NyJGUXgLLapaX+BCVGRN E++xDkROZH3deA+83SCwrFNG9bDxtvYkG+x9ikTCJOV+YcRS1juZD7aLX3FM/MeKlGsCULAUUtT+ uwspPMFGO+zFCvvoj1SBLgPmW6LJBmLFmLAWDOBOddOjk0JUSJ37V3vGYOq83z86vSJtkWL/jbqL IjBg9BlIIGNI6BaHLDh44oZXMT3mIpG88kpM5jVL9ws= ) ; Key ID = 50387 righter.ch. 3600 IN RRSIG ( DNSKEY 8 2 3600 20191226000000 20191205000000 50387 righter.ch. l16jdRqDaN4w9zcpJkxyf0osJdCwYDcNSxJEqV2L/+vVEXQ6YZZGGlOsitYrZi4SFYgc1m+/Snz2 Opad8+Jem+wvp4EF1UQKa7AH1TC8E1z+B1Kp/OpKKl4BgA1Br1CDFojQ0eeZZlfML/hciW0tcXNY s1scUX9g+ZbhbN6enil38w70woRSDZ0q735EegSKqCbm5L1Nv3L+VlUZxIlgOKoGkBCrgND7x8Mb awy6rttDOQQzWOPDmEGtxHpPh2mJDcZiuJum4v6FoX+SchSY6mGIIxzVYW3eiJjsLpn36rSCmV4n lXfF+3kRT+XeDs/32dm0nj9LgMzq91v7BidAow== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option:
	Found 2 DNSKEY records for righter.ch
	`righter.ch. 3600 IN DNSKEY ( 256 3 8 AwEAAbrXJ4m8BtFywCfjMiO8o43Bt3lhAAfFmyTDTOjAi7BR3FBj1ZpCly5pTRFEwXZhlkj9LsIV eI6GzfNo1/5eqnDZMDhmBN/93dqY1OIaf9490WHEARHPpGS35rb9fu5XUpJjordi5PqwmJB+Booe bneccoXN/DrWrg7XnG/n3Zkp ) ; Key ID = 57339`
	`righter.ch. 3600 IN DNSKEY ( 257 3 8 AwEAAdDryTFIV1X1MLQMWQecCSpTijSE46ZxHRB/nSOgHfc6rRY/S3i59zAfph9gC40Bq4u2l4fW T+vWvOxr9LyJpFbyd9UGZDUNKmyEHjzJk3/dxInwLhDewoao83T/O8K2NyJGUXgLLapaX+BCVGRN E++xDkROZH3deA+83SCwrFNG9bDxtvYkG+x9ikTCJOV+YcRS1juZD7aLX3FM/MeKlGsCULAUUtT+ uwspPMFGO+zFCvvoj1SBLgPmW6LJBmLFmLAWDOBOddOjk0JUSJ37V3vGYOq83z86vSJtkWL/jbqL IjBg9BlIIGNI6BaHLDh44oZXMT3mIpG88kpM5jVL9ws= ) ; Key ID = 50387`
	DNSKEY=50387/SEP is now in the chain-of-trust
	DS=50387/SHA-256 verifies DNSKEY=50387/SEP
	DS=50387/SHA-384 verifies DNSKEY=50387/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`righter.ch. 3600 IN RRSIG ( DNSKEY 8 2 3600 20191226000000 20191205000000 50387 righter.ch. l16jdRqDaN4w9zcpJkxyf0osJdCwYDcNSxJEqV2L/+vVEXQ6YZZGGlOsitYrZi4SFYgc1m+/Snz2 Opad8+Jem+wvp4EF1UQKa7AH1TC8E1z+B1Kp/OpKKl4BgA1Br1CDFojQ0eeZZlfML/hciW0tcXNY s1scUX9g+ZbhbN6enil38w70woRSDZ0q735EegSKqCbm5L1Nv3L+VlUZxIlgOKoGkBCrgND7x8Mb awy6rttDOQQzWOPDmEGtxHpPh2mJDcZiuJum4v6FoX+SchSY6mGIIxzVYW3eiJjsLpn36rSCmV4n lXfF+3kRT+XeDs/32dm0nj9LgMzq91v7BidAow== )`
	RRSIG=50387 and DNSKEY=50387/SEP verifies the DNSKEY RRset
	DNSKEY=57339 is now in the chain-of-trust
	Query to ns2.righter.ch for righter.ch/A
	Error querying ns2.righter.ch/2a03:4000:3e:70:0:0:0:16 for righter.ch/A: 'IPv6 transport disabled'
	Received 225 bytes from 2.56.96.16
	;; Answer received from 2.56.96.16 (225 bytes) ;; HEADER SECTION ;; id = 51195 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN A ;; ANSWER SECTION (2 records) righter.ch. 300 IN RRSIG ( A 8 2 300 20191226000000 20191205000000 57339 righter.ch. PslOuZp9EIPWpCk69nZHKaoOUSjnsfnyLZBQVXq+rBoQkw8TOdvh/KAHp3XXaI1FRi8jkb6mE5JB 0uzuHK/XRB2VqVPp3zbxRTNOqh0D2hmGeiRG3+IlKwfqu9G++SuJ3SWFm5cnsawpwq0tMcbPSeJs Je6aiql3blW8fc25f08= ) righter.ch. 300 IN A 2.56.96.16 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option:
	righter.ch is authoritative for righter.ch
	Found RRSIG signed by righter.ch zone
	Query to ns2.righter.ch for righter.ch/SOA
	Received 256 bytes from 2.56.96.16
	;; Answer received from 2.56.96.16 (256 bytes) ;; HEADER SECTION ;; id = 42888 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN SOA ;; ANSWER SECTION (2 records) righter.ch. 300 IN RRSIG ( SOA 8 2 300 20191226000000 20191205000000 57339 righter.ch. A3cLQ6xh5e//RZVtJZ9fClK4z62e435RLNsFIzSg4cHwAVoWoyG2HJ9wsHM5NnLYB6VfR2qWO/yk 4JVApzvePNwk92WwGFjJ9xUAk6yHvdLzh/k9cB7DLbe/smU0UbSVPc6QsNsI5q066J2xz5u01ACE kOa0nmGOOU5w66i3m9w= ) righter.ch. 300 IN SOA ( ns2.righter.ch. server.righter.ch. 2019121001 ;serial 14400 ;refresh 1800 ;retry 1209600 ;expire 3600 ;minimum ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option:
	Query to ns2.righter.ch for righter.ch/A
	Error querying ns2.righter.ch/2a03:4000:3e:70:0:0:0:16 for righter.ch/A: 'IPv6 transport disabled'
	Received 225 bytes from 2.56.96.16
	;; Answer received from 2.56.96.16 (225 bytes) ;; HEADER SECTION ;; id = 15568 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 2 nscount = 0 arcount = 1 ;; do = 1 ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option: ;; QUESTION SECTION (1 record) ;; righter.ch. IN A ;; ANSWER SECTION (2 records) righter.ch. 300 IN RRSIG ( A 8 2 300 20191226000000 20191205000000 57339 righter.ch. PslOuZp9EIPWpCk69nZHKaoOUSjnsfnyLZBQVXq+rBoQkw8TOdvh/KAHp3XXaI1FRi8jkb6mE5JB 0uzuHK/XRB2VqVPp3zbxRTNOqh0D2hmGeiRG3+IlKwfqu9G++SuJ3SWFm5cnsawpwq0tMcbPSeJs Je6aiql3blW8fc25f08= ) righter.ch. 300 IN A 2.56.96.16 ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; EDNS version 0 ;; flags: 8000 ;; rcode: NOERROR ;; size: 1680 ;; option:
	righter.ch A RR has value 2.56.96.16
	Found 1 RRSIGs over A RRset
	`righter.ch. 300 IN RRSIG ( A 8 2 300 20191226000000 20191205000000 57339 righter.ch. PslOuZp9EIPWpCk69nZHKaoOUSjnsfnyLZBQVXq+rBoQkw8TOdvh/KAHp3XXaI1FRi8jkb6mE5JB 0uzuHK/XRB2VqVPp3zbxRTNOqh0D2hmGeiRG3+IlKwfqu9G++SuJ3SWFm5cnsawpwq0tMcbPSeJs Je6aiql3blW8fc25f08= )`
	RRSIG=57339 and DNSKEY=57339 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test righter.ch at dnsviz.net.

DNSSEC Analyzer

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: