DNSSEC Debugger - sigfail.verteiltesysteme.net

Domain Name:

Time: 2026-03-12 13:45:31 UTC

Analyzing DNSSEC problems for sigfail.verteiltesysteme.net

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to i.root-servers.net for ./DNSKEY
	Received 1139 bytes from 192.36.148.17
	;; Response received from [192.36.148.17] 1139 octets ;; HEADER SECTION ;; id = 60339 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAbNTVC2+pry4pc37pZI9Oj6b8FHxT3VGrvSPKLE1Tjyfe2kUZUtVX5xrv6AV4BVO+ygrYjGZ MNgEnbLU4zknnlnhI2e0g6iTza1aZh0dRZXGH16C1NUNq1CxBkUhIYQhQDeIOtLacx+RmFTc+hSH JJ2MJ79IS00kA7eKi6mofQ7SPJmdJVjI+JAx791y0f5QaB+iHGANU53FwiYXNUQjfAzCrtOaSevG sx8SO8BTaXLAjFq5eewOtwScVwfVDhEXlvpE6e+mIncwhNKaMRD9IPuHENqCNPI5MjxfAMVS6cEY 8eEozIkv/vHc+0Auu3n+Fcx6F2Js4KPXaHEShAXugfU= ) ; keytag 21831 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20260402000000 20260312000000 20326 . hcmCK2q88XH00Hynv8IgIMVTKrwyb8Lh/uvRpqBPMALNQunyrS+VKrlKb6rBQTFnGHeVR/jj3Eay Uuxv4fy2evliMYKLrfTHtdqD3oUvJMnwmxEMmhS84Ttw+bbTcHeYxb52NFiYVHKb37Y0OWN4lr0p V+3fwFtWumb1NlWZDMNsaHFv6UIdxgUGNBVEyUaTAK6E2jseQcoqv6A0rNxCG+xtz2zSpRV2JM1g dC8zVAcc068OamqrwZlzKqsqAgXP78NOERrFkzffoRaSEmOORcAQpUdCK265DL1Y7Xeq0QaNEKd2 fXglm/IxS+4sMPT+83Q/XasxUu5C3d0qEz76fw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbNTVC2+pry4pc37pZI9Oj6b8FHxT3VGrvSPKLE1Tjyfe2kUZUtVX5xrv6AV4BVO+ygrYjGZ MNgEnbLU4zknnlnhI2e0g6iTza1aZh0dRZXGH16C1NUNq1CxBkUhIYQhQDeIOtLacx+RmFTc+hSH JJ2MJ79IS00kA7eKi6mofQ7SPJmdJVjI+JAx791y0f5QaB+iHGANU53FwiYXNUQjfAzCrtOaSevG sx8SO8BTaXLAjFq5eewOtwScVwfVDhEXlvpE6e+mIncwhNKaMRD9IPuHENqCNPI5MjxfAMVS6cEY 8eEozIkv/vHc+0Auu3n+Fcx6F2Js4KPXaHEShAXugfU= ) ; keytag 21831`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20260402000000 20260312000000 20326 . hcmCK2q88XH00Hynv8IgIMVTKrwyb8Lh/uvRpqBPMALNQunyrS+VKrlKb6rBQTFnGHeVR/jj3Eay Uuxv4fy2evliMYKLrfTHtdqD3oUvJMnwmxEMmhS84Ttw+bbTcHeYxb52NFiYVHKb37Y0OWN4lr0p V+3fwFtWumb1NlWZDMNsaHFv6UIdxgUGNBVEyUaTAK6E2jseQcoqv6A0rNxCG+xtz2zSpRV2JM1g dC8zVAcc068OamqrwZlzKqsqAgXP78NOERrFkzffoRaSEmOORcAQpUdCK265DL1Y7Xeq0QaNEKd2 fXglm/IxS+4sMPT+83Q/XasxUu5C3d0qEz76fw== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=21831 is now in the chain-of-trust
	DNSKEY=38696/SEP is now in the chain-of-trust
	Query to b.root-servers.net for sigfail.verteiltesysteme.net/A
	Received 1185 bytes from 170.247.170.2
	;; Response received from [170.247.170.2] 1185 octets ;; HEADER SECTION ;; id = 24288 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 15 arcount = 27 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; sigfail.verteiltesysteme.net. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) net. 172800 IN NS a.gtld-servers.net. net. 172800 IN NS b.gtld-servers.net. net. 172800 IN NS c.gtld-servers.net. net. 172800 IN NS d.gtld-servers.net. net. 172800 IN NS e.gtld-servers.net. net. 172800 IN NS f.gtld-servers.net. net. 172800 IN NS g.gtld-servers.net. net. 172800 IN NS h.gtld-servers.net. net. 172800 IN NS i.gtld-servers.net. net. 172800 IN NS j.gtld-servers.net. net. 172800 IN NS k.gtld-servers.net. net. 172800 IN NS l.gtld-servers.net. net. 172800 IN NS m.gtld-servers.net. net. 86400 IN DS ( 37331 13 2 2f0bec2d6f79dfbd1d08fd21a3af92d0e39a4b9ef1e3f4111fff282490da453b ) net. 86400 IN RRSIG ( DS 8 1 86400 20260325050000 20260312040000 21831 . YFB8YANnhzW+7asYPmCfjRUDXgNE9b79VZy7yld+6eskJuqzWFdiAMKrgj65roQwAXbCuEju4nV1 6vh4ts+pLC7mHjC487SQuRNwu+uSDVGPP6D+3kRrMYHtD9Ja0mQfpmly8LWQrcq08j5D+ECcZH+l EgjWu3iXCBWwJSbkfcISxFQza+TDZf32egZtRIn5XyInYI38v0rMKxgiCi6eQt7JXBH6SZ2XAr75 uYvBkPgP9hljq8/ZnoOO1ReayeTQ/YMGOKjrtOMYC4NVquunIfkNnzGRypk0ub+bArxPqqzQzrj8 I5Tb65U7NIEeDIlJvLDFm0cWuYWMbCl5Rh75Bg== ) ;; ADDITIONAL SECTION (27 records) a.gtld-servers.net. 172800 IN A 192.5.6.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 b.gtld-servers.net. 172800 IN A 192.33.14.30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 c.gtld-servers.net. 172800 IN A 192.26.92.30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 d.gtld-servers.net. 172800 IN A 192.31.80.30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 e.gtld-servers.net. 172800 IN A 192.12.94.30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 f.gtld-servers.net. 172800 IN A 192.35.51.30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 g.gtld-servers.net. 172800 IN A 192.42.93.30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 h.gtld-servers.net. 172800 IN A 192.54.112.30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 i.gtld-servers.net. 172800 IN A 192.43.172.30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 j.gtld-servers.net. 172800 IN A 192.48.79.30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 k.gtld-servers.net. 172800 IN A 192.52.178.30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 l.gtld-servers.net. 172800 IN A 192.41.162.30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 m.gtld-servers.net. 172800 IN A 192.55.83.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 ;; { "EDNS-VERSION": 0 }
	Query to j.root-servers.net for net/DNSKEY
	Received 1160 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 1160 octets ;; HEADER SECTION ;; id = 13696 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 15 arcount = 27 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) net. 172800 IN NS a.gtld-servers.net. net. 172800 IN NS b.gtld-servers.net. net. 172800 IN NS c.gtld-servers.net. net. 172800 IN NS d.gtld-servers.net. net. 172800 IN NS e.gtld-servers.net. net. 172800 IN NS f.gtld-servers.net. net. 172800 IN NS g.gtld-servers.net. net. 172800 IN NS h.gtld-servers.net. net. 172800 IN NS i.gtld-servers.net. net. 172800 IN NS j.gtld-servers.net. net. 172800 IN NS k.gtld-servers.net. net. 172800 IN NS l.gtld-servers.net. net. 172800 IN NS m.gtld-servers.net. net. 86400 IN DS ( 37331 13 2 2f0bec2d6f79dfbd1d08fd21a3af92d0e39a4b9ef1e3f4111fff282490da453b ) net. 86400 IN RRSIG ( DS 8 1 86400 20260325050000 20260312040000 21831 . YFB8YANnhzW+7asYPmCfjRUDXgNE9b79VZy7yld+6eskJuqzWFdiAMKrgj65roQwAXbCuEju4nV1 6vh4ts+pLC7mHjC487SQuRNwu+uSDVGPP6D+3kRrMYHtD9Ja0mQfpmly8LWQrcq08j5D+ECcZH+l EgjWu3iXCBWwJSbkfcISxFQza+TDZf32egZtRIn5XyInYI38v0rMKxgiCi6eQt7JXBH6SZ2XAr75 uYvBkPgP9hljq8/ZnoOO1ReayeTQ/YMGOKjrtOMYC4NVquunIfkNnzGRypk0ub+bArxPqqzQzrj8 I5Tb65U7NIEeDIlJvLDFm0cWuYWMbCl5Rh75Bg== ) ;; ADDITIONAL SECTION (27 records) a.gtld-servers.net. 172800 IN A 192.5.6.30 b.gtld-servers.net. 172800 IN A 192.33.14.30 c.gtld-servers.net. 172800 IN A 192.26.92.30 d.gtld-servers.net. 172800 IN A 192.31.80.30 e.gtld-servers.net. 172800 IN A 192.12.94.30 f.gtld-servers.net. 172800 IN A 192.35.51.30 g.gtld-servers.net. 172800 IN A 192.42.93.30 h.gtld-servers.net. 172800 IN A 192.54.112.30 i.gtld-servers.net. 172800 IN A 192.43.172.30 j.gtld-servers.net. 172800 IN A 192.48.79.30 k.gtld-servers.net. 172800 IN A 192.52.178.30 l.gtld-servers.net. 172800 IN A 192.41.162.30 m.gtld-servers.net. 172800 IN A 192.55.83.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 ;; { "EDNS-VERSION": 0 }
	Found child zone net

net

	Checking DS between . and net
	Query to g.root-servers.net for net/DS
	Received 367 bytes from 192.112.36.4
	;; Response received from [192.112.36.4] 367 octets ;; HEADER SECTION ;; id = 57012 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; net. IN DS ;; ANSWER SECTION (2 records) net. 86400 IN DS ( 37331 13 2 2f0bec2d6f79dfbd1d08fd21a3af92d0e39a4b9ef1e3f4111fff282490da453b ) net. 86400 IN RRSIG ( DS 8 1 86400 20260325050000 20260312040000 21831 . YFB8YANnhzW+7asYPmCfjRUDXgNE9b79VZy7yld+6eskJuqzWFdiAMKrgj65roQwAXbCuEju4nV1 6vh4ts+pLC7mHjC487SQuRNwu+uSDVGPP6D+3kRrMYHtD9Ja0mQfpmly8LWQrcq08j5D+ECcZH+l EgjWu3iXCBWwJSbkfcISxFQza+TDZf32egZtRIn5XyInYI38v0rMKxgiCi6eQt7JXBH6SZ2XAr75 uYvBkPgP9hljq8/ZnoOO1ReayeTQ/YMGOKjrtOMYC4NVquunIfkNnzGRypk0ub+bArxPqqzQzrj8 I5Tb65U7NIEeDIlJvLDFm0cWuYWMbCl5Rh75Bg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for net in the . zone
	DS=37331/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`net. 86400 IN RRSIG ( DS 8 1 86400 20260325050000 20260312040000 21831 . YFB8YANnhzW+7asYPmCfjRUDXgNE9b79VZy7yld+6eskJuqzWFdiAMKrgj65roQwAXbCuEju4nV1 6vh4ts+pLC7mHjC487SQuRNwu+uSDVGPP6D+3kRrMYHtD9Ja0mQfpmly8LWQrcq08j5D+ECcZH+l EgjWu3iXCBWwJSbkfcISxFQza+TDZf32egZtRIn5XyInYI38v0rMKxgiCi6eQt7JXBH6SZ2XAr75 uYvBkPgP9hljq8/ZnoOO1ReayeTQ/YMGOKjrtOMYC4NVquunIfkNnzGRypk0ub+bArxPqqzQzrj8 I5Tb65U7NIEeDIlJvLDFm0cWuYWMbCl5Rh75Bg== )`
	RRSIG=21831 and DNSKEY=21831 verifies the DS RRset
	DS=37331/SHA-256 is now in the chain-of-trust
	`net. 86400 IN DS ( 37331 13 2 2f0bec2d6f79dfbd1d08fd21a3af92d0e39a4b9ef1e3f4111fff282490da453b )`
	Query to c.gtld-servers.net for net/DNSKEY
	Received 291 bytes from 192.26.92.30
	;; Response received from [192.26.92.30] 291 octets ;; HEADER SECTION ;; id = 15145 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; net. IN DNSKEY ;; ANSWER SECTION (3 records) net. 86400 IN DNSKEY ( 257 3 13 HiBoGpzDRAgrDmUXXTSnl7jCX6Hx5bzkU2jSxMbVI01yS+13EyOghnCidBXU0bH2gi2w9GhYGacp U6CrtwoFNg== ) ; keytag 37331 net. 86400 IN DNSKEY ( 256 3 13 BN7nE5EGXvYfX/r9qihm5MU9BR6KTHLb/TcRXIXZcCwDj24ftYx+nRW6ca9/wHZ3NnOZ5uSG/GRE drzpVVepUg== ) ; keytag 44109 net. 86400 IN RRSIG ( DNSKEY 13 1 86400 20260323141035 20260308140535 37331 net. 4z4EhgVGiU4VyMTg1rGc4D6U3BAqZt5qT4leERO75fRUFBKiKqUJbWutMVUmHcnRWWMLuuW6lCxk 5p1/dBxE2g== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for net
	`net. 86400 IN DNSKEY ( 257 3 13 HiBoGpzDRAgrDmUXXTSnl7jCX6Hx5bzkU2jSxMbVI01yS+13EyOghnCidBXU0bH2gi2w9GhYGacp U6CrtwoFNg== ) ; keytag 37331`
	`net. 86400 IN DNSKEY ( 256 3 13 BN7nE5EGXvYfX/r9qihm5MU9BR6KTHLb/TcRXIXZcCwDj24ftYx+nRW6ca9/wHZ3NnOZ5uSG/GRE drzpVVepUg== ) ; keytag 44109`
	DNSKEY=37331/SEP is now in the chain-of-trust
	DS=37331/SHA-256 verifies DNSKEY=37331/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`net. 86400 IN RRSIG ( DNSKEY 13 1 86400 20260323141035 20260308140535 37331 net. 4z4EhgVGiU4VyMTg1rGc4D6U3BAqZt5qT4leERO75fRUFBKiKqUJbWutMVUmHcnRWWMLuuW6lCxk 5p1/dBxE2g== )`
	RRSIG=37331 and DNSKEY=37331/SEP verifies the DNSKEY RRset
	DNSKEY=44109 is now in the chain-of-trust
	Query to b.gtld-servers.net for sigfail.verteiltesysteme.net/A
	Received 251 bytes from 192.33.14.30
	;; Response received from [192.33.14.30] 251 octets ;; HEADER SECTION ;; id = 35586 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; sigfail.verteiltesysteme.net. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) verteiltesysteme.net. 172800 IN NS dns1.registrar-servers.com. verteiltesysteme.net. 172800 IN NS dns2.registrar-servers.com. verteiltesysteme.net. 86400 IN DS ( 29912 13 1 90fc415258ac1d58861d64cd8087aa1af09690c8 ) verteiltesysteme.net. 86400 IN RRSIG ( DS 13 2 86400 20260316032640 20260309021640 44109 net. mXIuSBAOzwfprw3SIS1v0B5AmWkz2fkLRJ+DteFAn16wZLH/iznpgkZ5iCdMuwyjgwoo5/H2M23C PZ9A2uZq7Q== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to e.gtld-servers.net for verteiltesysteme.net/DNSKEY
	Received 243 bytes from 192.12.94.30
	;; Response received from [192.12.94.30] 243 octets ;; HEADER SECTION ;; id = 64788 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; verteiltesysteme.net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) verteiltesysteme.net. 172800 IN NS dns1.registrar-servers.com. verteiltesysteme.net. 172800 IN NS dns2.registrar-servers.com. verteiltesysteme.net. 86400 IN DS ( 29912 13 1 90fc415258ac1d58861d64cd8087aa1af09690c8 ) verteiltesysteme.net. 86400 IN RRSIG ( DS 13 2 86400 20260316032640 20260309021640 44109 net. mXIuSBAOzwfprw3SIS1v0B5AmWkz2fkLRJ+DteFAn16wZLH/iznpgkZ5iCdMuwyjgwoo5/H2M23C PZ9A2uZq7Q== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone verteiltesysteme.net

verteiltesysteme.net

	Checking DS between net and verteiltesysteme.net
	Query to a.gtld-servers.net for verteiltesysteme.net/DS
	Received 1076 bytes from 192.5.6.30
	;; Response received from [192.5.6.30] 1076 octets ;; HEADER SECTION ;; id = 21681 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 14 arcount = 27 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; verteiltesysteme.net. IN DS ;; ANSWER SECTION (2 records) verteiltesysteme.net. 86400 IN DS ( 29912 13 1 90fc415258ac1d58861d64cd8087aa1af09690c8 ) verteiltesysteme.net. 86400 IN RRSIG ( DS 13 2 86400 20260316032640 20260309021640 44109 net. mXIuSBAOzwfprw3SIS1v0B5AmWkz2fkLRJ+DteFAn16wZLH/iznpgkZ5iCdMuwyjgwoo5/H2M23C PZ9A2uZq7Q== ) ;; AUTHORITY SECTION (14 records) net. 172800 IN NS f.gtld-servers.net. net. 172800 IN NS a.gtld-servers.net. net. 172800 IN NS g.gtld-servers.net. net. 172800 IN NS b.gtld-servers.net. net. 172800 IN NS d.gtld-servers.net. net. 172800 IN NS i.gtld-servers.net. net. 172800 IN NS h.gtld-servers.net. net. 172800 IN NS l.gtld-servers.net. net. 172800 IN NS j.gtld-servers.net. net. 172800 IN NS c.gtld-servers.net. net. 172800 IN NS e.gtld-servers.net. net. 172800 IN NS m.gtld-servers.net. net. 172800 IN NS k.gtld-servers.net. net. 172800 IN RRSIG ( NS 13 1 172800 20260317032217 20260310021217 44109 net. zcjMu++zIkd0hXndXFQOmLOydHVYk7Vq5JsHD97b7n+DdLXXHDgScgdS1O02DpJvVAOSvcb/IXGX NGZgKhTfjw== ) ;; ADDITIONAL SECTION (27 records) f.gtld-servers.net. 172800 IN A 192.35.51.30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 a.gtld-servers.net. 172800 IN A 192.5.6.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 g.gtld-servers.net. 172800 IN A 192.42.93.30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 b.gtld-servers.net. 172800 IN A 192.33.14.30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 d.gtld-servers.net. 172800 IN A 192.31.80.30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 i.gtld-servers.net. 172800 IN A 192.43.172.30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 h.gtld-servers.net. 172800 IN A 192.54.112.30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 l.gtld-servers.net. 172800 IN A 192.41.162.30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 j.gtld-servers.net. 172800 IN A 192.48.79.30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 c.gtld-servers.net. 172800 IN A 192.26.92.30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 e.gtld-servers.net. 172800 IN A 192.12.94.30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 m.gtld-servers.net. 172800 IN A 192.55.83.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 k.gtld-servers.net. 172800 IN A 192.52.178.30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for verteiltesysteme.net in the net zone
	DS=29912/SHA-1 uses a deprecated digest algorithm
	DS=29912/SHA-1 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`verteiltesysteme.net. 86400 IN RRSIG ( DS 13 2 86400 20260316032640 20260309021640 44109 net. mXIuSBAOzwfprw3SIS1v0B5AmWkz2fkLRJ+DteFAn16wZLH/iznpgkZ5iCdMuwyjgwoo5/H2M23C PZ9A2uZq7Q== )`
	RRSIG=44109 and DNSKEY=44109 verifies the DS RRset
	DS=29912/SHA-1 is now in the chain-of-trust
	`verteiltesysteme.net. 86400 IN DS ( 29912 13 1 90fc415258ac1d58861d64cd8087aa1af09690c8 )`
	Query to dns2.registrar-servers.com for verteiltesysteme.net/DNSKEY
	Received 325 bytes from 156.154.133.200
	;; Response received from [156.154.133.200] 325 octets ;; HEADER SECTION ;; id = 45049 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; verteiltesysteme.net. IN DNSKEY ;; ANSWER SECTION (3 records) verteiltesysteme.net. 3601 IN DNSKEY ( 256 3 13 wsIQPqZ/0mHXLbNw1l/SYENOtqwmeqG6LiDw1VQa1eBjXixt1dSuZ1KdiFMhKL1t02NgCkifRRBx z7yAkHLcdA== ) ; keytag 47187 verteiltesysteme.net. 3601 IN DNSKEY ( 257 3 13 5MHd68dIEp3txhWN7M05DsdvRU5cUHIHsf7C4Zs44DrrAS+oBvPmoXOjAnPqBXUe9Vajt7UnI/y8 4kTEn+/uWQ== ) ; keytag 29912 verteiltesysteme.net. 3601 IN RRSIG ( DNSKEY 13 2 3601 20260319000000 20260226000000 29912 verteiltesysteme.net. 9wCS+PA58sfH+iwaBwbt5+zam/AYfA7YBX8e6k1jgg+lj4umMu4dZOxPO7dzS7vLmrwZHNUIrb9j LLW0Df6qoQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for verteiltesysteme.net
	`verteiltesysteme.net. 3601 IN DNSKEY ( 256 3 13 wsIQPqZ/0mHXLbNw1l/SYENOtqwmeqG6LiDw1VQa1eBjXixt1dSuZ1KdiFMhKL1t02NgCkifRRBx z7yAkHLcdA== ) ; keytag 47187`
	`verteiltesysteme.net. 3601 IN DNSKEY ( 257 3 13 5MHd68dIEp3txhWN7M05DsdvRU5cUHIHsf7C4Zs44DrrAS+oBvPmoXOjAnPqBXUe9Vajt7UnI/y8 4kTEn+/uWQ== ) ; keytag 29912`
	DNSKEY=29912/SEP is now in the chain-of-trust
	DS=29912/SHA-1 verifies DNSKEY=29912/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`verteiltesysteme.net. 3601 IN RRSIG ( DNSKEY 13 2 3601 20260319000000 20260226000000 29912 verteiltesysteme.net. 9wCS+PA58sfH+iwaBwbt5+zam/AYfA7YBX8e6k1jgg+lj4umMu4dZOxPO7dzS7vLmrwZHNUIrb9j LLW0Df6qoQ== )`
	RRSIG=29912 and DNSKEY=29912/SEP verifies the DNSKEY RRset
	DNSKEY=47187 is now in the chain-of-trust
	Query to dns1.registrar-servers.com for sigfail.verteiltesysteme.net/A
	Received 225 bytes from 156.154.132.200
	;; Response received from [156.154.132.200] 225 octets ;; HEADER SECTION ;; id = 52382 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; sigfail.verteiltesysteme.net. IN A ;; ANSWER SECTION (2 records) sigfail.verteiltesysteme.net. 1799 IN CNAME ( sigfail.rsa2048-sha256.ippacket.stream. ) sigfail.verteiltesysteme.net. 1799 IN RRSIG ( CNAME 13 3 1799 20260319000000 20260226000000 47187 verteiltesysteme.net. iQS6K3FI6dWXA7xEtw+X9Vz+aYIxHdGr1mwuY4JwNGp4QEFDT4fWsyjoNzYcPhdHl9jzg1RRx81G uh6C6whGgA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	dns1.registrar-servers.com is authoritative for sigfail.verteiltesysteme.net
	Query to dns2.registrar-servers.com for sigfail.verteiltesysteme.net/DNSKEY
	Received 225 bytes from 156.154.133.200
	;; Response received from [156.154.133.200] 225 octets ;; HEADER SECTION ;; id = 43338 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; sigfail.verteiltesysteme.net. IN DNSKEY ;; ANSWER SECTION (2 records) sigfail.verteiltesysteme.net. 1799 IN CNAME ( sigfail.rsa2048-sha256.ippacket.stream. ) sigfail.verteiltesysteme.net. 1799 IN RRSIG ( CNAME 13 3 1799 20260319000000 20260226000000 47187 verteiltesysteme.net. iQS6K3FI6dWXA7xEtw+X9Vz+aYIxHdGr1mwuY4JwNGp4QEFDT4fWsyjoNzYcPhdHl9jzg1RRx81G uh6C6whGgA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found RRSIG signed by verteiltesysteme.net zone
	sigfail.verteiltesysteme.net is a CNAME to sigfail.rsa2048-sha256.ippacket.stream
	Found 1 RRSIGs over CNAME RRset
	`sigfail.verteiltesysteme.net. 1799 IN RRSIG ( CNAME 13 3 1799 20260319000000 20260226000000 47187 verteiltesysteme.net. iQS6K3FI6dWXA7xEtw+X9Vz+aYIxHdGr1mwuY4JwNGp4QEFDT4fWsyjoNzYcPhdHl9jzg1RRx81G uh6C6whGgA== )`
	RRSIG=47187 and DNSKEY=47187 verifies the CNAME RRset

	Query to a.root-servers.net for sigfail.rsa2048-sha256.ippacket.stream/A
	Received 776 bytes from 198.41.0.4
	;; Response received from [198.41.0.4] 776 octets ;; HEADER SECTION ;; id = 55336 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; sigfail.rsa2048-sha256.ippacket.stream. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) stream. 172800 IN NS a.nic.stream. stream. 172800 IN NS ns2.dns.nic.stream. stream. 172800 IN NS c.nic.stream. stream. 172800 IN NS ns3.dns.nic.stream. stream. 172800 IN NS ns1.dns.nic.stream. stream. 172800 IN NS b.nic.stream. stream. 86400 IN DS ( 31735 8 2 b6a0ac51c5711a40b336884ea349544e664814376c82cf270336799225a7fd99 ) stream. 86400 IN RRSIG ( DS 8 1 86400 20260325050000 20260312040000 21831 . eAChM3KcT6O4qqH8deMYFPdIPYA8zfmCnGF3gVODp5TYNqFr1jyjeuR3XKiDnZUrfNAAbSuS8JVB Zgi6PFWoIrCgxRFQDsLtTwQAJudfB2+8KrYpSy89U42N0Ln4eB4EIYAaP/wtnJ2Igv4TywAx4Tqp uUfkamJ+I4ciF0URzG4KDGXQDVvwk/S9NvlOonnWGHU9STdareOwaNi5WqHBdAVxe3ciW09Gkdf+ nlKNkRy5kvJIeq1aelfHuN+7QYRsF3A20RXOyjYUq3iEQiJ1TZBo8PYM9Bwz0gfCKx+TqeXkA+g+ AqViMm32zG+njIZ5PolbH9wN5003hwbDxO0xtg== ) ;; ADDITIONAL SECTION (13 records) a.nic.stream. 172800 IN A 37.209.192.10 a.nic.stream. 172800 IN AAAA 2001:dcd:1::10 ns2.dns.nic.stream. 172800 IN A 156.154.170.50 ns2.dns.nic.stream. 172800 IN AAAA 2610:a1:1072::1:32 c.nic.stream. 172800 IN A 37.209.196.10 c.nic.stream. 172800 IN AAAA 2001:dcd:3::10 ns3.dns.nic.stream. 172800 IN A 156.154.171.50 ns3.dns.nic.stream. 172800 IN AAAA 2610:a1:1073::1:32 ns1.dns.nic.stream. 172800 IN A 156.154.169.50 ns1.dns.nic.stream. 172800 IN AAAA 2610:a1:1071::1:32 b.nic.stream. 172800 IN A 37.209.194.10 b.nic.stream. 172800 IN AAAA 2001:dcd:2::10 ;; { "EDNS-VERSION": 0 }
	Query to e.root-servers.net for stream/DNSKEY
	Received 744 bytes from 192.203.230.10
	;; Response received from [192.203.230.10] 744 octets ;; HEADER SECTION ;; id = 29729 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; stream. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) stream. 172800 IN NS a.nic.stream. stream. 172800 IN NS b.nic.stream. stream. 172800 IN NS c.nic.stream. stream. 172800 IN NS ns1.dns.nic.stream. stream. 172800 IN NS ns2.dns.nic.stream. stream. 172800 IN NS ns3.dns.nic.stream. stream. 86400 IN DS ( 31735 8 2 b6a0ac51c5711a40b336884ea349544e664814376c82cf270336799225a7fd99 ) stream. 86400 IN RRSIG ( DS 8 1 86400 20260325050000 20260312040000 21831 . eAChM3KcT6O4qqH8deMYFPdIPYA8zfmCnGF3gVODp5TYNqFr1jyjeuR3XKiDnZUrfNAAbSuS8JVB Zgi6PFWoIrCgxRFQDsLtTwQAJudfB2+8KrYpSy89U42N0Ln4eB4EIYAaP/wtnJ2Igv4TywAx4Tqp uUfkamJ+I4ciF0URzG4KDGXQDVvwk/S9NvlOonnWGHU9STdareOwaNi5WqHBdAVxe3ciW09Gkdf+ nlKNkRy5kvJIeq1aelfHuN+7QYRsF3A20RXOyjYUq3iEQiJ1TZBo8PYM9Bwz0gfCKx+TqeXkA+g+ AqViMm32zG+njIZ5PolbH9wN5003hwbDxO0xtg== ) ;; ADDITIONAL SECTION (13 records) a.nic.stream. 172800 IN A 37.209.192.10 a.nic.stream. 172800 IN AAAA 2001:dcd:1::10 b.nic.stream. 172800 IN A 37.209.194.10 b.nic.stream. 172800 IN AAAA 2001:dcd:2::10 c.nic.stream. 172800 IN A 37.209.196.10 c.nic.stream. 172800 IN AAAA 2001:dcd:3::10 ns1.dns.nic.stream. 172800 IN A 156.154.169.50 ns1.dns.nic.stream. 172800 IN AAAA 2610:a1:1071::1:32 ns2.dns.nic.stream. 172800 IN A 156.154.170.50 ns2.dns.nic.stream. 172800 IN AAAA 2610:a1:1072::1:32 ns3.dns.nic.stream. 172800 IN A 156.154.171.50 ns3.dns.nic.stream. 172800 IN AAAA 2610:a1:1073::1:32 ;; { "EDNS-VERSION": 0 }
	Found child zone stream

stream

	Checking DS between . and stream
	Query to g.root-servers.net for stream/DS
	Received 370 bytes from 192.112.36.4
	;; Response received from [192.112.36.4] 370 octets ;; HEADER SECTION ;; id = 17301 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; stream. IN DS ;; ANSWER SECTION (2 records) stream. 86400 IN DS ( 31735 8 2 b6a0ac51c5711a40b336884ea349544e664814376c82cf270336799225a7fd99 ) stream. 86400 IN RRSIG ( DS 8 1 86400 20260325050000 20260312040000 21831 . eAChM3KcT6O4qqH8deMYFPdIPYA8zfmCnGF3gVODp5TYNqFr1jyjeuR3XKiDnZUrfNAAbSuS8JVB Zgi6PFWoIrCgxRFQDsLtTwQAJudfB2+8KrYpSy89U42N0Ln4eB4EIYAaP/wtnJ2Igv4TywAx4Tqp uUfkamJ+I4ciF0URzG4KDGXQDVvwk/S9NvlOonnWGHU9STdareOwaNi5WqHBdAVxe3ciW09Gkdf+ nlKNkRy5kvJIeq1aelfHuN+7QYRsF3A20RXOyjYUq3iEQiJ1TZBo8PYM9Bwz0gfCKx+TqeXkA+g+ AqViMm32zG+njIZ5PolbH9wN5003hwbDxO0xtg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for stream in the . zone
	DS=31735/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`stream. 86400 IN RRSIG ( DS 8 1 86400 20260325050000 20260312040000 21831 . eAChM3KcT6O4qqH8deMYFPdIPYA8zfmCnGF3gVODp5TYNqFr1jyjeuR3XKiDnZUrfNAAbSuS8JVB Zgi6PFWoIrCgxRFQDsLtTwQAJudfB2+8KrYpSy89U42N0Ln4eB4EIYAaP/wtnJ2Igv4TywAx4Tqp uUfkamJ+I4ciF0URzG4KDGXQDVvwk/S9NvlOonnWGHU9STdareOwaNi5WqHBdAVxe3ciW09Gkdf+ nlKNkRy5kvJIeq1aelfHuN+7QYRsF3A20RXOyjYUq3iEQiJ1TZBo8PYM9Bwz0gfCKx+TqeXkA+g+ AqViMm32zG+njIZ5PolbH9wN5003hwbDxO0xtg== )`
	RRSIG=21831 and DNSKEY=21831 verifies the DS RRset
	DS=31735/SHA-256 is now in the chain-of-trust
	`stream. 86400 IN DS ( 31735 8 2 b6a0ac51c5711a40b336884ea349544e664814376c82cf270336799225a7fd99 )`
	Query to ns3.dns.nic.stream for stream/DNSKEY
	Received 785 bytes from 156.154.171.50
	;; Response received from [156.154.171.50] 785 octets ;; HEADER SECTION ;; id = 16645 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; stream. IN DNSKEY ;; ANSWER SECTION (3 records) stream. 3600 IN DNSKEY ( 256 3 8 AwEAAd5gSCm4Pv7RFjviwb6SgxtBmXJ0rFZhPS+3eZU+uN2Os8gsd8ty0alWo0dDxr0xWmX4Iqj1 Shr0cWQxGsuVZ5/WgfNehJo5a5+t/GOfOStgb1FndsmjaTL55iaJv9l+rEn8IL7/iCFKy6acM2y5 rD6FdJ5OeWhHgwgR+3zn2vXkj/ilyRXBbA7VVRo/RvNjPvNsn529hUT9RHAthFt9dXc= ) ; keytag 31686 stream. 3600 IN DNSKEY ( 257 3 8 AwEAAbwsJ4j1GTprOt60ps+A+sRFSe3l87KdxP8BPny4LMLue9vWRGhwyM0OUI10l4qHaHQ3zQbA aVBR7k7ZCQc4o4BF6r/joBZHKwzWrzQGfZKWBb6BGVTU12o1D1uJOnNHV38Nl+FawsjnHu2RUFNi cp9QAKuU4j+llzoLaRDhsJkb84fSw7G0BekLAABAOPeViQBl+7FSRwoX2pe7ob5d6RLCh/qSTUIE PXTL4BNTIwMWHsdt/tH9K98skhIwVAF2RILKYuBdUAQhTHIZGNssisRGf5JwKCeBuyHzPhfmknp4 1Bm1RxJlihmVRPMpLy7Y5fFfU+7hD/zx9pYCnrwPrhE= ) ; keytag 31735 stream. 3600 IN RRSIG ( DNSKEY 8 1 3600 20260323035220 20260309025602 31735 stream. CLHFGCWnjq3qyJs5xutov+bZPSxWQCiqgYhwlC+Z7i6emTYyoRQVW/dvg9335xbKLhJqlSiSwabF jqF3JUEivD/p0LXqfoFpV9HFV7VEU4YcPJBZiyt8V0FWTWApJQdfQED12wWzP6r/dZeJjGg75ush dC7TFqVdid7Zq3akvQUDp9Rxi+df6+YKTfEC7WImP40+o5w14KZyOdqIhtS7VcXO4+ow+ZB0UGOu CPFbCi2udTJ9pStXtkZXtqZeUMpp7KNmdx+ZSDPfA9gmeXJ3K/NNMvvSv1AnZecT9NM964jvRRPD rfGtxEcencvju6pTSOIv2ABqegcRvHYaUfyVoQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for stream
	`stream. 3600 IN DNSKEY ( 256 3 8 AwEAAd5gSCm4Pv7RFjviwb6SgxtBmXJ0rFZhPS+3eZU+uN2Os8gsd8ty0alWo0dDxr0xWmX4Iqj1 Shr0cWQxGsuVZ5/WgfNehJo5a5+t/GOfOStgb1FndsmjaTL55iaJv9l+rEn8IL7/iCFKy6acM2y5 rD6FdJ5OeWhHgwgR+3zn2vXkj/ilyRXBbA7VVRo/RvNjPvNsn529hUT9RHAthFt9dXc= ) ; keytag 31686`
	`stream. 3600 IN DNSKEY ( 257 3 8 AwEAAbwsJ4j1GTprOt60ps+A+sRFSe3l87KdxP8BPny4LMLue9vWRGhwyM0OUI10l4qHaHQ3zQbA aVBR7k7ZCQc4o4BF6r/joBZHKwzWrzQGfZKWBb6BGVTU12o1D1uJOnNHV38Nl+FawsjnHu2RUFNi cp9QAKuU4j+llzoLaRDhsJkb84fSw7G0BekLAABAOPeViQBl+7FSRwoX2pe7ob5d6RLCh/qSTUIE PXTL4BNTIwMWHsdt/tH9K98skhIwVAF2RILKYuBdUAQhTHIZGNssisRGf5JwKCeBuyHzPhfmknp4 1Bm1RxJlihmVRPMpLy7Y5fFfU+7hD/zx9pYCnrwPrhE= ) ; keytag 31735`
	DNSKEY=31735/SEP is now in the chain-of-trust
	DS=31735/SHA-256 verifies DNSKEY=31735/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`stream. 3600 IN RRSIG ( DNSKEY 8 1 3600 20260323035220 20260309025602 31735 stream. CLHFGCWnjq3qyJs5xutov+bZPSxWQCiqgYhwlC+Z7i6emTYyoRQVW/dvg9335xbKLhJqlSiSwabF jqF3JUEivD/p0LXqfoFpV9HFV7VEU4YcPJBZiyt8V0FWTWApJQdfQED12wWzP6r/dZeJjGg75ush dC7TFqVdid7Zq3akvQUDp9Rxi+df6+YKTfEC7WImP40+o5w14KZyOdqIhtS7VcXO4+ow+ZB0UGOu CPFbCi2udTJ9pStXtkZXtqZeUMpp7KNmdx+ZSDPfA9gmeXJ3K/NNMvvSv1AnZecT9NM964jvRRPD rfGtxEcencvju6pTSOIv2ABqegcRvHYaUfyVoQ== )`
	RRSIG=31735 and DNSKEY=31735/SEP verifies the DNSKEY RRset
	DNSKEY=31686 is now in the chain-of-trust
	Query to ns1.dns.nic.stream for sigfail.rsa2048-sha256.ippacket.stream/A
	Received 381 bytes from 156.154.169.50
	;; Response received from [156.154.169.50] 381 octets ;; HEADER SECTION ;; id = 18873 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 3 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; sigfail.rsa2048-sha256.ippacket.stream. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) ippacket.stream. 3600 IN NS ns1.ippacket.stream. ippacket.stream. 3600 IN NS ns2.ippacket.stream. ippacket.stream. 3600 IN DS ( 65045 8 2 840cc28171e145d97180b43f9c415897c9cddff6b9e9acc7e6ab9b096b0b474e ) ippacket.stream. 3600 IN RRSIG ( DS 8 2 3600 20260325113904 20260311104127 31686 stream. jE2NWi4clzXkwMcfPGKmPIr5mbGZ5jty2AwacbZuklAdFHQfoshg1UXXhUAAI2WlaS9R0vRF3NLz sLG4Sy9GcRYR/Hjg6Jnc5ddOqy8KLoq8LINJA2SVu09U7HOSxqgQUPplEJ0IDc0qpcy8WCjc+R5L UtSkOeqSwlhtRW3X43EZzpJLhfSNmyfuoj73DOzJMsVVeIl+/orRxxjnNicaSA== ) ;; ADDITIONAL SECTION (3 records) ;; { "EDNS-VERSION": 0 } ns1.ippacket.stream. 3600 IN A 195.201.14.36 ns2.ippacket.stream. 3600 IN A 195.181.240.97
	Query to ns2.dns.nic.stream for ippacket.stream/DNSKEY
	Received 358 bytes from 156.154.170.50
	;; Response received from [156.154.170.50] 358 octets ;; HEADER SECTION ;; id = 5701 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 3 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ippacket.stream. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) ippacket.stream. 3600 IN NS ns1.ippacket.stream. ippacket.stream. 3600 IN NS ns2.ippacket.stream. ippacket.stream. 3600 IN DS ( 65045 8 2 840cc28171e145d97180b43f9c415897c9cddff6b9e9acc7e6ab9b096b0b474e ) ippacket.stream. 3600 IN RRSIG ( DS 8 2 3600 20260325113904 20260311104127 31686 stream. jE2NWi4clzXkwMcfPGKmPIr5mbGZ5jty2AwacbZuklAdFHQfoshg1UXXhUAAI2WlaS9R0vRF3NLz sLG4Sy9GcRYR/Hjg6Jnc5ddOqy8KLoq8LINJA2SVu09U7HOSxqgQUPplEJ0IDc0qpcy8WCjc+R5L UtSkOeqSwlhtRW3X43EZzpJLhfSNmyfuoj73DOzJMsVVeIl+/orRxxjnNicaSA== ) ;; ADDITIONAL SECTION (3 records) ;; { "EDNS-VERSION": 0 } ns1.ippacket.stream. 3600 IN A 195.201.14.36 ns2.ippacket.stream. 3600 IN A 195.181.240.97
	Found child zone ippacket.stream

ippacket.stream

	Checking DS between stream and ippacket.stream
	Query to b.nic.stream for ippacket.stream/DS
	Received 290 bytes from 37.209.194.10
	;; Response received from [37.209.194.10] 290 octets ;; HEADER SECTION ;; id = 5074 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ippacket.stream. IN DS ;; ANSWER SECTION (2 records) ippacket.stream. 3600 IN DS ( 65045 8 2 840cc28171e145d97180b43f9c415897c9cddff6b9e9acc7e6ab9b096b0b474e ) ippacket.stream. 3600 IN RRSIG ( DS 8 2 3600 20260325113904 20260311104127 31686 stream. jE2NWi4clzXkwMcfPGKmPIr5mbGZ5jty2AwacbZuklAdFHQfoshg1UXXhUAAI2WlaS9R0vRF3NLz sLG4Sy9GcRYR/Hjg6Jnc5ddOqy8KLoq8LINJA2SVu09U7HOSxqgQUPplEJ0IDc0qpcy8WCjc+R5L UtSkOeqSwlhtRW3X43EZzpJLhfSNmyfuoj73DOzJMsVVeIl+/orRxxjnNicaSA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for ippacket.stream in the stream zone
	DS=65045/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`ippacket.stream. 3600 IN RRSIG ( DS 8 2 3600 20260325113904 20260311104127 31686 stream. jE2NWi4clzXkwMcfPGKmPIr5mbGZ5jty2AwacbZuklAdFHQfoshg1UXXhUAAI2WlaS9R0vRF3NLz sLG4Sy9GcRYR/Hjg6Jnc5ddOqy8KLoq8LINJA2SVu09U7HOSxqgQUPplEJ0IDc0qpcy8WCjc+R5L UtSkOeqSwlhtRW3X43EZzpJLhfSNmyfuoj73DOzJMsVVeIl+/orRxxjnNicaSA== )`
	RRSIG=31686 and DNSKEY=31686 verifies the DS RRset
	DS=65045/SHA-256 is now in the chain-of-trust
	`ippacket.stream. 3600 IN DS ( 65045 8 2 840cc28171e145d97180b43f9c415897c9cddff6b9e9acc7e6ab9b096b0b474e )`
	Query to ns2.ippacket.stream for ippacket.stream/DNSKEY
	Timeout querying ns2.ippacket.stream/195.181.240.97 for ippacket.stream/DNSKEY
	All Queries to ns2.ippacket.stream for ippacket.stream/DNSKEY timed out or failed
	Query to ns1.ippacket.stream for ippacket.stream/DNSKEY
	Received 623 bytes from 195.201.14.36
	;; Response received from [195.201.14.36] 623 octets ;; HEADER SECTION ;; id = 24309 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ippacket.stream. IN DNSKEY ;; ANSWER SECTION (2 records) ippacket.stream. 3600 IN DNSKEY ( 257 3 8 AwEAAeWqZHk0Ia6+jrIdosxoyiF+vPidsMTf7epkOcWok4WpxFwNHe/5nlGuBV3UbMzGEaAQDzUD JSkt5OraRUyv8BlMetjsgmd7lgoZ3Q/j099+jR/i9qr2a6UrXrBe0M4RpFUd/ETek0MN4A5Eejfe yHQcUJlinO1OsCBQwJh75+Pw75Q+eu89zGgTfJFBCVXGOb7NbAS2Q9mUoh3FFfFpR5NpJNRgrJIg ln38gbS0WJPoZXFyqSclCasOM2IRFc2P2AuDqXWHKmVIP1wUMX8p+pQoVaqofhYH712lX8H4vKcE KJpoWqVVrqX3Y5r95puuET9VPRy0i2YgeNnkwys1rsk= ) ; keytag 65045 ippacket.stream. 3600 IN RRSIG ( DNSKEY 8 2 3600 20260416160947 20260307153013 65045 ippacket.stream. fN8fdGLaQIUn8j94KvGG436kJWGGEXfokcz8ExxDVO+/IRdkXhYPhiNA7nayJwp87/5qtNUuI5yg noWtRt0T+Oe/dOYaGUuiJPfFhXKABW0+2APA3YYF2ySxZDjYTZ2zfojRTGu2gcYXQS+TBAySgnPn zgdou5YhHi53K2dZglndY0IabFevtORtfZBoJH8OiAWHgSL8lVPW7qxvOWsocguVH6l1hA64Qk+G jVdmCkgXHSyQ6hWLRa23fn1U3Ynb4Ow82fEHKJk48v6L3wO91jhf6WB6/MbYzID2Wr3ZaeerwcvI oCW+BFGGqxajZGiW2iegayXxDl0hN1omgQzUsQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DNSKEY records for ippacket.stream
	`ippacket.stream. 3600 IN DNSKEY ( 257 3 8 AwEAAeWqZHk0Ia6+jrIdosxoyiF+vPidsMTf7epkOcWok4WpxFwNHe/5nlGuBV3UbMzGEaAQDzUD JSkt5OraRUyv8BlMetjsgmd7lgoZ3Q/j099+jR/i9qr2a6UrXrBe0M4RpFUd/ETek0MN4A5Eejfe yHQcUJlinO1OsCBQwJh75+Pw75Q+eu89zGgTfJFBCVXGOb7NbAS2Q9mUoh3FFfFpR5NpJNRgrJIg ln38gbS0WJPoZXFyqSclCasOM2IRFc2P2AuDqXWHKmVIP1wUMX8p+pQoVaqofhYH712lX8H4vKcE KJpoWqVVrqX3Y5r95puuET9VPRy0i2YgeNnkwys1rsk= ) ; keytag 65045`
	DNSKEY=65045/SEP is now in the chain-of-trust
	DS=65045/SHA-256 verifies DNSKEY=65045/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`ippacket.stream. 3600 IN RRSIG ( DNSKEY 8 2 3600 20260416160947 20260307153013 65045 ippacket.stream. fN8fdGLaQIUn8j94KvGG436kJWGGEXfokcz8ExxDVO+/IRdkXhYPhiNA7nayJwp87/5qtNUuI5yg noWtRt0T+Oe/dOYaGUuiJPfFhXKABW0+2APA3YYF2ySxZDjYTZ2zfojRTGu2gcYXQS+TBAySgnPn zgdou5YhHi53K2dZglndY0IabFevtORtfZBoJH8OiAWHgSL8lVPW7qxvOWsocguVH6l1hA64Qk+G jVdmCkgXHSyQ6hWLRa23fn1U3Ynb4Ow82fEHKJk48v6L3wO91jhf6WB6/MbYzID2Wr3ZaeerwcvI oCW+BFGGqxajZGiW2iegayXxDl0hN1omgQzUsQ== )`
	RRSIG=65045 and DNSKEY=65045/SEP verifies the DNSKEY RRset
	Query to ns1.ippacket.stream for sigfail.rsa2048-sha256.ippacket.stream/A
	Received 401 bytes from 195.201.14.36
	;; Response received from [195.201.14.36] 401 octets ;; HEADER SECTION ;; id = 20667 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; sigfail.rsa2048-sha256.ippacket.stream. IN A ;; ANSWER SECTION (2 records) sigfail.rsa2048-sha256.ippacket.stream. 60 IN A 195.201.14.36 sigfail.rsa2048-sha256.ippacket.stream. 60 IN RRSIG ( A 8 4 60 20260410040002 20260228040002 46436 rsa2048-sha256.ippacket.stream. //This+RRSIG+is+deliberately+broken///For+more+information+please+go+to/http s+//wander+science/projects/dns/dnssecresolvertest////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// /////////////////////////////////////w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns1.ippacket.stream is authoritative for sigfail.rsa2048-sha256.ippacket.stream
	Query to ns1.ippacket.stream for rsa2048-sha256.ippacket.stream/DNSKEY
	Received 653 bytes from 195.201.14.36
	;; Response received from [195.201.14.36] 653 octets ;; HEADER SECTION ;; id = 1404 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; rsa2048-sha256.ippacket.stream. IN DNSKEY ;; ANSWER SECTION (2 records) rsa2048-sha256.ippacket.stream. 60 IN DNSKEY ( 257 3 8 AwEAAbZkTB4JrsdrUE30DjiZpMPvYMZxuOTwXD05GU7JZtUB7UcYeXqnH5U+GneuJ437OGg8VEmm 3SzGI9jv1/RsMOnOofZdljsCtCYPuAbD4BkYhu2XCDrCJbtovibolUJH/r3cAZBBpnmy82mStoxf rsYP9Y4DbqxnJUyM10HnNiuzyofRmoXPFxM41ejA9Ef+4062+cu4kTynzkpWmR8zW8ERnhBdGpuk 7RBywdBGbaPHCjXPnQqzqCrTLx4c1hPCZ+XuvOXA6YNnwr3f9QDXHunnUlqVPB9sz4Y9y6pO4Hr9 xevSdKK7KDP4V2QhBWPeKn76F5QjqMn6ApMcxQNsXgk= ) ; keytag 46436 rsa2048-sha256.ippacket.stream. 60 IN RRSIG ( DNSKEY 8 3 60 20260410040002 20260228040002 46436 rsa2048-sha256.ippacket.stream. n5twbSKbs70YyBoOPYrAUsVC7SLoflk649DxAAtptyMUDq2q7WfBx3AI2o7ZDU+R9gAT7tEvgDRA KmQlzKpeK7fTE6rA6LJFYkwkfoMB3LYfHd0sYLC3BTWIi7fiiTPb+a4+wUQhw9z+CbPITBl8gEds 1iTIt0HtiBPddWde0bNaG4pHMj3kMzBunCoPfCHPHaJ7OPGA6hnjRceHx1BsU1+XGzC8/I+7gExR DpUVHewss8OGH4N5DueJ15Ik+05UEVFOd8owAK0GrdGGXGSLbOLLOLoo+18TKN6s030dG25FJ2+1 WLWnb1GuGRM/mjId74whjG/TuQJLLrgfKhIlFw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone rsa2048-sha256.ippacket.stream
	Attempting to learn nameservers for rsa2048-sha256.ippacket.stream
	Query to ns1.ippacket.stream for rsa2048-sha256.ippacket.stream/NS
	Received 401 bytes from 195.201.14.36
	;; Response received from [195.201.14.36] 401 octets ;; HEADER SECTION ;; id = 7771 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ;; {"EXTENDED-ERROR": {"ERROR": "Prohibited", "EXTRA-TEXT": "", "INFO-CODE": 18}} ] ;; } ;; QUESTION SECTION (1 record) ;; rsa2048-sha256.ippacket.stream. IN NS ;; ANSWER SECTION (2 records) rsa2048-sha256.ippacket.stream. 60 IN NS ns1.ippacket.stream. rsa2048-sha256.ippacket.stream. 60 IN RRSIG ( NS 8 3 60 20260410040002 20260228040002 46436 rsa2048-sha256.ippacket.stream. ktrr+mI/rWlZsfOrNnCA1WOP7+oyx5jcniP5Tz39RbQui8dppjjY57kpnBKk66lPMcIX7p8XrwFM 2gop9SRmAPQ2TV5LMMRfuMFfnJg4ZkXysM/yIekplRXqISB9oO1wP1r50MtPqdihDG77rjc4xe+Z U0UFeEWDvSSncp/47GkuwmiTFPz0eEA483IGYnoAHaxwMSirItDxnyVGzlWN5j54sYcdD/RcuQ/k 5+uEStqILFB3OCvaA4coBfsEeUiXc+3RIMMTDDF4lr2KY+7QwpPF5ckwh2PRTQRpV1vD1ORWAw2r QRwD60FzzwYgGu0OxjO/XtCrIhhAWqfQdbdNng== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found rsa2048-sha256.ippacket.stream nameservers: ns1.ippacket.stream

rsa2048-sha256.ippacket.stream

	Checking DS between ippacket.stream and rsa2048-sha256.ippacket.stream
	Query to ns1.ippacket.stream for rsa2048-sha256.ippacket.stream/DS
	Received 410 bytes from 195.201.14.36
	;; Response received from [195.201.14.36] 410 octets ;; HEADER SECTION ;; id = 1624 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; rsa2048-sha256.ippacket.stream. IN DS ;; ANSWER SECTION (2 records) rsa2048-sha256.ippacket.stream. 3600 IN DS ( 46436 8 2 0d1fe6641408ca76f58ec02fd2647b7e4f8045ea792924e4df448b8630b3e5ad ) rsa2048-sha256.ippacket.stream. 3600 IN RRSIG ( DS 8 3 3600 20260413142214 20260304141258 65045 ippacket.stream. oC5cm8HayK/U1uLWXLv4P1oxoN7VRQ2cdhFbGHnC3uCt943mRsZ4RRhP5j3/blhIk2LZeYnVZcyT t4s2HsEcuP9YHOALjvyIoCSaqNyEkaq+EXT+Gfc2zbz7muUR9OaIZmCnUaYIDE1LSI4cnv9g3I05 geEazNrXdjIUjqml1ppprYHiETEBMX1bRn3fzSc6PpHGUIH9AN7fAqyfAFHxYqeqvJ0wIslRp30A jyoNiw4Pgr5/tDQS2uLFVWi/sLP+dmXb6lNI6Zp6cCdZI1GarJdw05+Pz5yR/G3NySvMTwdhIopn 0q+HBg0TNbPUIqAV/Wfdar0L74Zn99vI+ffYiA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for rsa2048-sha256.ippacket.stream in the ippacket.stream zone
	DS=46436/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`rsa2048-sha256.ippacket.stream. 3600 IN RRSIG ( DS 8 3 3600 20260413142214 20260304141258 65045 ippacket.stream. oC5cm8HayK/U1uLWXLv4P1oxoN7VRQ2cdhFbGHnC3uCt943mRsZ4RRhP5j3/blhIk2LZeYnVZcyT t4s2HsEcuP9YHOALjvyIoCSaqNyEkaq+EXT+Gfc2zbz7muUR9OaIZmCnUaYIDE1LSI4cnv9g3I05 geEazNrXdjIUjqml1ppprYHiETEBMX1bRn3fzSc6PpHGUIH9AN7fAqyfAFHxYqeqvJ0wIslRp30A jyoNiw4Pgr5/tDQS2uLFVWi/sLP+dmXb6lNI6Zp6cCdZI1GarJdw05+Pz5yR/G3NySvMTwdhIopn 0q+HBg0TNbPUIqAV/Wfdar0L74Zn99vI+ffYiA== )`
	RRSIG=65045 and DNSKEY=65045/SEP verifies the DS RRset
	DS=46436/SHA-256 is now in the chain-of-trust
	`rsa2048-sha256.ippacket.stream. 3600 IN DS ( 46436 8 2 0d1fe6641408ca76f58ec02fd2647b7e4f8045ea792924e4df448b8630b3e5ad )`
	Query to ns1.ippacket.stream for rsa2048-sha256.ippacket.stream/DNSKEY
	Received 653 bytes from 195.201.14.36
	;; Response received from [195.201.14.36] 653 octets ;; HEADER SECTION ;; id = 14520 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; rsa2048-sha256.ippacket.stream. IN DNSKEY ;; ANSWER SECTION (2 records) rsa2048-sha256.ippacket.stream. 60 IN DNSKEY ( 257 3 8 AwEAAbZkTB4JrsdrUE30DjiZpMPvYMZxuOTwXD05GU7JZtUB7UcYeXqnH5U+GneuJ437OGg8VEmm 3SzGI9jv1/RsMOnOofZdljsCtCYPuAbD4BkYhu2XCDrCJbtovibolUJH/r3cAZBBpnmy82mStoxf rsYP9Y4DbqxnJUyM10HnNiuzyofRmoXPFxM41ejA9Ef+4062+cu4kTynzkpWmR8zW8ERnhBdGpuk 7RBywdBGbaPHCjXPnQqzqCrTLx4c1hPCZ+XuvOXA6YNnwr3f9QDXHunnUlqVPB9sz4Y9y6pO4Hr9 xevSdKK7KDP4V2QhBWPeKn76F5QjqMn6ApMcxQNsXgk= ) ; keytag 46436 rsa2048-sha256.ippacket.stream. 60 IN RRSIG ( DNSKEY 8 3 60 20260410040002 20260228040002 46436 rsa2048-sha256.ippacket.stream. n5twbSKbs70YyBoOPYrAUsVC7SLoflk649DxAAtptyMUDq2q7WfBx3AI2o7ZDU+R9gAT7tEvgDRA KmQlzKpeK7fTE6rA6LJFYkwkfoMB3LYfHd0sYLC3BTWIi7fiiTPb+a4+wUQhw9z+CbPITBl8gEds 1iTIt0HtiBPddWde0bNaG4pHMj3kMzBunCoPfCHPHaJ7OPGA6hnjRceHx1BsU1+XGzC8/I+7gExR DpUVHewss8OGH4N5DueJ15Ik+05UEVFOd8owAK0GrdGGXGSLbOLLOLoo+18TKN6s030dG25FJ2+1 WLWnb1GuGRM/mjId74whjG/TuQJLLrgfKhIlFw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DNSKEY records for rsa2048-sha256.ippacket.stream
	`rsa2048-sha256.ippacket.stream. 60 IN DNSKEY ( 257 3 8 AwEAAbZkTB4JrsdrUE30DjiZpMPvYMZxuOTwXD05GU7JZtUB7UcYeXqnH5U+GneuJ437OGg8VEmm 3SzGI9jv1/RsMOnOofZdljsCtCYPuAbD4BkYhu2XCDrCJbtovibolUJH/r3cAZBBpnmy82mStoxf rsYP9Y4DbqxnJUyM10HnNiuzyofRmoXPFxM41ejA9Ef+4062+cu4kTynzkpWmR8zW8ERnhBdGpuk 7RBywdBGbaPHCjXPnQqzqCrTLx4c1hPCZ+XuvOXA6YNnwr3f9QDXHunnUlqVPB9sz4Y9y6pO4Hr9 xevSdKK7KDP4V2QhBWPeKn76F5QjqMn6ApMcxQNsXgk= ) ; keytag 46436`
	DNSKEY=46436/SEP is now in the chain-of-trust
	DS=46436/SHA-256 verifies DNSKEY=46436/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`rsa2048-sha256.ippacket.stream. 60 IN RRSIG ( DNSKEY 8 3 60 20260410040002 20260228040002 46436 rsa2048-sha256.ippacket.stream. n5twbSKbs70YyBoOPYrAUsVC7SLoflk649DxAAtptyMUDq2q7WfBx3AI2o7ZDU+R9gAT7tEvgDRA KmQlzKpeK7fTE6rA6LJFYkwkfoMB3LYfHd0sYLC3BTWIi7fiiTPb+a4+wUQhw9z+CbPITBl8gEds 1iTIt0HtiBPddWde0bNaG4pHMj3kMzBunCoPfCHPHaJ7OPGA6hnjRceHx1BsU1+XGzC8/I+7gExR DpUVHewss8OGH4N5DueJ15Ik+05UEVFOd8owAK0GrdGGXGSLbOLLOLoo+18TKN6s030dG25FJ2+1 WLWnb1GuGRM/mjId74whjG/TuQJLLrgfKhIlFw== )`
	RRSIG=46436 and DNSKEY=46436/SEP verifies the DNSKEY RRset
	Query to ns1.ippacket.stream for sigfail.rsa2048-sha256.ippacket.stream/A
	Received 401 bytes from 195.201.14.36
	;; Response received from [195.201.14.36] 401 octets ;; HEADER SECTION ;; id = 54 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; sigfail.rsa2048-sha256.ippacket.stream. IN A ;; ANSWER SECTION (2 records) sigfail.rsa2048-sha256.ippacket.stream. 60 IN A 195.201.14.36 sigfail.rsa2048-sha256.ippacket.stream. 60 IN RRSIG ( A 8 4 60 20260410040002 20260228040002 46436 rsa2048-sha256.ippacket.stream. //This+RRSIG+is+deliberately+broken///For+more+information+please+go+to/http s+//wander+science/projects/dns/dnssecresolvertest////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// /////////////////////////////////////w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns1.ippacket.stream is authoritative for sigfail.rsa2048-sha256.ippacket.stream
	Query to ns1.ippacket.stream for sigfail.rsa2048-sha256.ippacket.stream/DNSKEY
	Received 830 bytes from 195.201.14.36
	;; Response received from [195.201.14.36] 830 octets ;; HEADER SECTION ;; id = 53511 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; sigfail.rsa2048-sha256.ippacket.stream. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) rsa2048-sha256.ippacket.stream. 60 IN SOA ( ns1.ippacket.stream. root.swznet.de. 44 ;serial 86400 ;refresh 7200 ;retry 2419200 ;expire 600 ;minimum ) rsa2048-sha256.ippacket.stream. 60 IN RRSIG ( SOA 8 3 60 20260410040002 20260228040002 46436 rsa2048-sha256.ippacket.stream. f1z0S3kYz/ml7S4jtKuLRkmLVKOzMo7ke53VSpmJkRz6ktHGr8T7S0bfUxUSeQQnQSQF21wB3vRD fSxgAw1DXexpfqvH0hrH9rp1X4c0ubOCortJEScFeUiOB92Yl5woR5+WhmK4w6YYvbwQtao83Tca Agu0TX1bLafEYrT0NGRrIZ5iAnK3Ql4NLPVtOpUnmuh4o8jd8wVIoljqKnh4/jOmw6GkUOkNE8Vt 9HrOyGxv+Ox9+SwzIm7bejnsDVwISUDc8gwpVqdTduOOtYbxrQFdd/QzfzSjVoizkkvwAWUEV3iQ bqNATSTmRuB3q3dNeoF2xszpRAIJ9oliiw539w== ) sigfail.rsa2048-sha256.ippacket.stream. 60 IN NSEC ( sigok.rsa2048-sha256.ippacket.stream. A AAAA RRSIG NSEC ) sigfail.rsa2048-sha256.ippacket.stream. 60 IN RRSIG ( NSEC 8 4 60 20260410040002 20260228040002 46436 rsa2048-sha256.ippacket.stream. INIFn7clrLkTa879HatiV3DbV8U/pMVVQyofucFnMZWp15cmDLn1Pfe1kuZ8G7BpI+R/U8HuU/Xy 9IUDLGqbIaeeCCgaNszHwVd2Rnp3AcYnLszDdy+gTdaqq9+0zOP8UbIS4wSE3cqCa7ZcHlPuOSnF LSesxg9HUHITCx3kprRFxGPaxqifIyi2tlbA2OGBikHZhDwaUIiXdKr3QmBnwWsKSD3R4EG0xQdN 14pkwVzw9f5g/vbQmkHeyl3z2KG5WZuGGDRjSMfhG32f+n3K8aPwg1t1lJOHriZgOvZiQO+XsdG6 vKs01JKb1JBJ7W4w/Bc7OwJTNxVDp2X5UN2cDA== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found RRSIG signed by rsa2048-sha256.ippacket.stream zone
	Query to ns1.ippacket.stream for sigfail.rsa2048-sha256.ippacket.stream/A
	Received 401 bytes from 195.201.14.36
	;; Response received from [195.201.14.36] 401 octets ;; HEADER SECTION ;; id = 64946 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; sigfail.rsa2048-sha256.ippacket.stream. IN A ;; ANSWER SECTION (2 records) sigfail.rsa2048-sha256.ippacket.stream. 60 IN A 195.201.14.36 sigfail.rsa2048-sha256.ippacket.stream. 60 IN RRSIG ( A 8 4 60 20260410040002 20260228040002 46436 rsa2048-sha256.ippacket.stream. //This+RRSIG+is+deliberately+broken///For+more+information+please+go+to/http s+//wander+science/projects/dns/dnssecresolvertest////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// /////////////////////////////////////w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	sigfail.rsa2048-sha256.ippacket.stream A RR has value 195.201.14.36
	Found 1 RRSIGs over A RRset
	`sigfail.rsa2048-sha256.ippacket.stream. 60 IN RRSIG ( A 8 4 60 20260410040002 20260228040002 46436 rsa2048-sha256.ippacket.stream. //This+RRSIG+is+deliberately+broken///For+more+information+please+go+to/http s+//wander+science/projects/dns/dnssecresolvertest////////////////////////// //////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////// /////////////////////////////////////w== )`
	RRSIG=46436 and DNSKEY=46436/SEP does not verify the A RRset (signature verification failed)
	None of the 1 RRSIG and 1 DNSKEY records validate the A RRset
	The A RRset was not signed by any trusted keys

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test sigfail.verteiltesysteme.net at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: