DNSSEC Debugger - try.direct

Back to Verisign Labs Tools

Domain Name:

Detail: more(+) / less(-)

Time: 2026-06-26 21:14:10 UTC

Analyzing DNSSEC problems for try.direct

DS=20326/SHA-256 is now in the chain-of-trust

DS=38696/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	`. IN DS ( 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 )`
	Query to h.root-servers.net for ./DNSKEY
	Received 1414 bytes from 198.97.190.53
	;; Response received from [198.97.190.53] 1414 octets ;; HEADER SECTION ;; id = 1288 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 5 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (5 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAb5dDYffpgAJ8VUGLwQtWXPlQWsjIFJtCM00/XaKU+8ln+ofah3q2KxEIjvzQg+nqdxRj+8e mtPne1mtYcbFWP4Q9E+DniOJLK09R05FuzvGbrG7DDdRDUX/cedFdV7O8pFEAYpJqYNR9BCTIAV9 73DO2biauKSA31b7I2lK/woxoR1tf5cqJ4SMbJUviuHicAEoUi2ATswloZNWd5T5thmEFZnxFx7D 5UgKCY7oflS7+GU7dNJwEtmFnWYVETHN0kHXVz6aguouaAZp706YXNIoR/iTgQhmsR7XX+wL0Z8Q M2LxQIyU6vRZ06IyuJMGRMiwkSuGElbumyBt12JZbrU= ) ; keytag 54393 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN DNSKEY ( 256 3 8 AwEAAeCYD6Z7WWKVLeuWgowKP+3g+Gs1cnLKq7a3CaQxQpv8bfuFVI0WnG33qaSH/Mw9IBgifrdz f4XY/DQLnyBJ9MfaOyAWuEaEmYJ+GQPiwVVfstGwSA1McfFJUttTgq2Huu74KARhtA8wPo/N3Xcy YQtNhz+qCM5NBb3ecx/naw6sYab9LxS6f2cU0q03++BP5Ks0Uef8WJCa/1izCYE+vMkwoltV+tEN a3hpXiZ7jle/xdgaZrPi5ZGmyLVI34g1XVYrNlsCCTmNvFQIfzW5STFQFsQpizczyFn9r3LzSxxP CNwdlCG84bER0BmdwqbF6Tanv+FxMOavrahkj4wIy5k= ) ; keytag 57780 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20260711000000 20260620000000 20326 . UU/g/jQ3AjhIGIxSxGVoYAg1X117oL9XvEKrRR3YUZVoVsaHrb9Cd1lMqqmCJXbnReOQeetx9ms+ jAzt+Jvi79GIBABl7r0VTkHdJle67pwRtOOeCjMxvSsQIikZg3DIpl0bBvr4o3+0rlN3xjdCsQEC OOseGCjggcrqkimc+tOdD/l1r67R3rBjrhu3VDInUSmtnF0h7j9JxEMJcfRxFDjFvFOxSAn+X2x8 alBURCi50ksk7K3kaC73ccmUt5+Mb3za+4dEOtXuIPEwpmx1qKRdaIv2N9tvE0zo2CClfwLCrK+c 2YVCcqujrKL8TTV3rWICBxDO5Bc2tkdOZm79Cw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 4 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAb5dDYffpgAJ8VUGLwQtWXPlQWsjIFJtCM00/XaKU+8ln+ofah3q2KxEIjvzQg+nqdxRj+8e mtPne1mtYcbFWP4Q9E+DniOJLK09R05FuzvGbrG7DDdRDUX/cedFdV7O8pFEAYpJqYNR9BCTIAV9 73DO2biauKSA31b7I2lK/woxoR1tf5cqJ4SMbJUviuHicAEoUi2ATswloZNWd5T5thmEFZnxFx7D 5UgKCY7oflS7+GU7dNJwEtmFnWYVETHN0kHXVz6aguouaAZp706YXNIoR/iTgQhmsR7XX+wL0Z8Q M2LxQIyU6vRZ06IyuJMGRMiwkSuGElbumyBt12JZbrU= ) ; keytag 54393`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAeCYD6Z7WWKVLeuWgowKP+3g+Gs1cnLKq7a3CaQxQpv8bfuFVI0WnG33qaSH/Mw9IBgifrdz f4XY/DQLnyBJ9MfaOyAWuEaEmYJ+GQPiwVVfstGwSA1McfFJUttTgq2Huu74KARhtA8wPo/N3Xcy YQtNhz+qCM5NBb3ecx/naw6sYab9LxS6f2cU0q03++BP5Ks0Uef8WJCa/1izCYE+vMkwoltV+tEN a3hpXiZ7jle/xdgaZrPi5ZGmyLVI34g1XVYrNlsCCTmNvFQIfzW5STFQFsQpizczyFn9r3LzSxxP CNwdlCG84bER0BmdwqbF6Tanv+FxMOavrahkj4wIy5k= ) ; keytag 57780`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	DNSKEY=38696/SEP is now in the chain-of-trust
	DS=38696/SHA-256 verifies DNSKEY=38696/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20260711000000 20260620000000 20326 . UU/g/jQ3AjhIGIxSxGVoYAg1X117oL9XvEKrRR3YUZVoVsaHrb9Cd1lMqqmCJXbnReOQeetx9ms+ jAzt+Jvi79GIBABl7r0VTkHdJle67pwRtOOeCjMxvSsQIikZg3DIpl0bBvr4o3+0rlN3xjdCsQEC OOseGCjggcrqkimc+tOdD/l1r67R3rBjrhu3VDInUSmtnF0h7j9JxEMJcfRxFDjFvFOxSAn+X2x8 alBURCi50ksk7K3kaC73ccmUt5+Mb3za+4dEOtXuIPEwpmx1qKRdaIv2N9tvE0zo2CClfwLCrK+c 2YVCcqujrKL8TTV3rWICBxDO5Bc2tkdOZm79Cw== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=54393 is now in the chain-of-trust
	DNSKEY=57780 is now in the chain-of-trust
	Query to l.root-servers.net for try.direct/A
	Received 756 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 756 octets ;; HEADER SECTION ;; id = 17252 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; try.direct. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) direct. 172800 IN NS v0n0.nic.direct. direct. 172800 IN NS v0n1.nic.direct. direct. 172800 IN NS v0n2.nic.direct. direct. 172800 IN NS v0n3.nic.direct. direct. 172800 IN NS v2n0.nic.direct. direct. 172800 IN NS v2n1.nic.direct. direct. 86400 IN DS ( 29044 8 2 dd72f7eec3b8ce0e6a278a6d560abacabcdff4a4a9062eb8dbd96eddc910b140 ) direct. 86400 IN RRSIG ( DS 8 1 86400 20260709200000 20260626190000 54393 . juNdhB/VNWXB9PgzeLFGdeyQVMEKDRKY/XomBSJUsP+DDtK5W5JTs92yODX51iEOe1NzRZ6dT3co s/0nmdyjKEs5iQ/FgxzDKIUmKAA+cJvij/vYMGePCILsMwBzIMKiAz8kKrsIabSmn4WB1wk4i55u gpS8DBvH2ZriZJQ6C71KrBwqQbaYSn1Amlj2Dm7ZNdt9IaQ+tX8CaAlL2TCRA57XqR/Dz3z+zep0 anZuGSR0A6yVFSkexspCUyHUMmVyJ4ts8w74pHlJiIUqR7BSgvFJj1AIKPw9izwdT8n80eNxpdsO xX7XfYFVdGVGwmTh5GxM4+7K0YHr+e2l/H2xqQ== ) ;; ADDITIONAL SECTION (13 records) v0n0.nic.direct. 172800 IN A 65.22.24.46 v0n1.nic.direct. 172800 IN A 65.22.25.46 v0n2.nic.direct. 172800 IN A 65.22.26.46 v0n3.nic.direct. 172800 IN A 161.232.12.46 v2n0.nic.direct. 172800 IN A 65.22.27.46 v2n1.nic.direct. 172800 IN A 161.232.13.46 v0n0.nic.direct. 172800 IN AAAA 2a01:8840:1a::46 v0n1.nic.direct. 172800 IN AAAA 2a01:8840:1b::46 v0n2.nic.direct. 172800 IN AAAA 2a01:8840:1c::46 v0n3.nic.direct. 172800 IN AAAA 2a01:8840:f6::46 v2n0.nic.direct. 172800 IN AAAA 2a01:8840:1d::46 v2n1.nic.direct. 172800 IN AAAA 2a01:8840:f7::46 ;; { "EDNS-VERSION": 0 }
	Query to j.root-servers.net for direct/DNSKEY
	Received 752 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 752 octets ;; HEADER SECTION ;; id = 36111 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; direct. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) direct. 172800 IN NS v0n0.nic.direct. direct. 172800 IN NS v0n1.nic.direct. direct. 172800 IN NS v0n2.nic.direct. direct. 172800 IN NS v0n3.nic.direct. direct. 172800 IN NS v2n0.nic.direct. direct. 172800 IN NS v2n1.nic.direct. direct. 86400 IN DS ( 29044 8 2 dd72f7eec3b8ce0e6a278a6d560abacabcdff4a4a9062eb8dbd96eddc910b140 ) direct. 86400 IN RRSIG ( DS 8 1 86400 20260709200000 20260626190000 54393 . juNdhB/VNWXB9PgzeLFGdeyQVMEKDRKY/XomBSJUsP+DDtK5W5JTs92yODX51iEOe1NzRZ6dT3co s/0nmdyjKEs5iQ/FgxzDKIUmKAA+cJvij/vYMGePCILsMwBzIMKiAz8kKrsIabSmn4WB1wk4i55u gpS8DBvH2ZriZJQ6C71KrBwqQbaYSn1Amlj2Dm7ZNdt9IaQ+tX8CaAlL2TCRA57XqR/Dz3z+zep0 anZuGSR0A6yVFSkexspCUyHUMmVyJ4ts8w74pHlJiIUqR7BSgvFJj1AIKPw9izwdT8n80eNxpdsO xX7XfYFVdGVGwmTh5GxM4+7K0YHr+e2l/H2xqQ== ) ;; ADDITIONAL SECTION (13 records) v0n0.nic.direct. 172800 IN A 65.22.24.46 v0n0.nic.direct. 172800 IN AAAA 2a01:8840:1a::46 v0n1.nic.direct. 172800 IN A 65.22.25.46 v0n1.nic.direct. 172800 IN AAAA 2a01:8840:1b::46 v0n2.nic.direct. 172800 IN A 65.22.26.46 v0n2.nic.direct. 172800 IN AAAA 2a01:8840:1c::46 v0n3.nic.direct. 172800 IN A 161.232.12.46 v0n3.nic.direct. 172800 IN AAAA 2a01:8840:f6::46 v2n0.nic.direct. 172800 IN A 65.22.27.46 v2n0.nic.direct. 172800 IN AAAA 2a01:8840:1d::46 v2n1.nic.direct. 172800 IN A 161.232.13.46 v2n1.nic.direct. 172800 IN AAAA 2a01:8840:f7::46 ;; { "EDNS-VERSION": 0 }
	Found child zone direct

direct

	Checking DS between . and direct
	Query to a.root-servers.net for direct/DS
	Received 370 bytes from 198.41.0.4
	;; Response received from [198.41.0.4] 370 octets ;; HEADER SECTION ;; id = 25075 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; direct. IN DS ;; ANSWER SECTION (2 records) direct. 86400 IN DS ( 29044 8 2 dd72f7eec3b8ce0e6a278a6d560abacabcdff4a4a9062eb8dbd96eddc910b140 ) direct. 86400 IN RRSIG ( DS 8 1 86400 20260709200000 20260626190000 54393 . juNdhB/VNWXB9PgzeLFGdeyQVMEKDRKY/XomBSJUsP+DDtK5W5JTs92yODX51iEOe1NzRZ6dT3co s/0nmdyjKEs5iQ/FgxzDKIUmKAA+cJvij/vYMGePCILsMwBzIMKiAz8kKrsIabSmn4WB1wk4i55u gpS8DBvH2ZriZJQ6C71KrBwqQbaYSn1Amlj2Dm7ZNdt9IaQ+tX8CaAlL2TCRA57XqR/Dz3z+zep0 anZuGSR0A6yVFSkexspCUyHUMmVyJ4ts8w74pHlJiIUqR7BSgvFJj1AIKPw9izwdT8n80eNxpdsO xX7XfYFVdGVGwmTh5GxM4+7K0YHr+e2l/H2xqQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for direct in the . zone
	DS=29044/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`direct. 86400 IN RRSIG ( DS 8 1 86400 20260709200000 20260626190000 54393 . juNdhB/VNWXB9PgzeLFGdeyQVMEKDRKY/XomBSJUsP+DDtK5W5JTs92yODX51iEOe1NzRZ6dT3co s/0nmdyjKEs5iQ/FgxzDKIUmKAA+cJvij/vYMGePCILsMwBzIMKiAz8kKrsIabSmn4WB1wk4i55u gpS8DBvH2ZriZJQ6C71KrBwqQbaYSn1Amlj2Dm7ZNdt9IaQ+tX8CaAlL2TCRA57XqR/Dz3z+zep0 anZuGSR0A6yVFSkexspCUyHUMmVyJ4ts8w74pHlJiIUqR7BSgvFJj1AIKPw9izwdT8n80eNxpdsO xX7XfYFVdGVGwmTh5GxM4+7K0YHr+e2l/H2xqQ== )`
	RRSIG=54393 and DNSKEY=54393 verifies the DS RRset
	DS=29044/SHA-256 is now in the chain-of-trust
	`direct. 86400 IN DS ( 29044 8 2 dd72f7eec3b8ce0e6a278a6d560abacabcdff4a4a9062eb8dbd96eddc910b140 )`
	Query to v2n0.nic.direct for direct/DNSKEY
	Received 901 bytes from 65.22.27.46
	;; Response received from [65.22.27.46] 901 octets ;; HEADER SECTION ;; id = 61150 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; direct. IN DNSKEY ;; ANSWER SECTION (4 records) direct. 3600 IN DNSKEY ( 256 3 8 AwEAAdeV2NBafZBJCuYbxe//Ch65lGbGEvCuafDBfMHmrKB2Aec5Z93mWTOJ5xnsgyDrJIbCuW72 i9gr+Or8A31QUzbKA13EoYTZBzfVDAAY5RjUGs+aA42RI0v4mCYueUpl99tcsXnEaUupu+8K7jp/ 4/TnhqXdnvO2Xym7PpSNp+fd ) ; keytag 45216 direct. 3600 IN DNSKEY ( 257 3 8 AwEAAbWg93B3r4ZbiOdJ7MpJq9NLprGgKcPQQUEAm7H/sfjP7vUbFef1ahNsSoQpUBLy8qysSzMq LMi0kkX8XfCwk6FhVW4X4kRPIr2J3WGblR3IAchp0I8TzST9fjWLY6NEJleyxAQdbEx6213QFf6P kva7Xb7ojlykUXBTlLfsZkBqXflMgnxyD6yQHXr8czkuD20wE6ICU6L8iqn/P6tTtAm7uUR89PdR x+Ohb1sahJBebqq9QSi0J6+s0pcpxK0cVG7KSLm6BuZzKOAkqLCwzCSth1QGg2fVQjIVQv58VB94 1wUIhcxYkDc8C02ptcKj0rxlgHAqv0jnwTur3WD8f3c= ) ; keytag 29044 direct. 3600 IN DNSKEY ( 256 3 8 AwEAAaZBkFQ+6zP8B5/Ko1BzeT8k5UXtldNG5a/oJJlB+hC9YQnTOAM4X8NOHjCK1cthT3rkk3zP I3AEpbUmD8MKORYzZpezROYdG4xK87M6F1HPctSzn74baF62unVzSNxkwQflPcuOU8MGH5J4hOFn mwMxuXMyhSCnZ6emgEoPlDjl ) ; keytag 27351 direct. 3600 IN RRSIG ( DNSKEY 8 1 3600 20260716153856 20260625143856 29044 direct. UKkr7oBfXok8jY4QGL4jB82N43+ppZfRfulBwCCzdZtrmZN7hHnPfRsOXqzWjOhsPTYM/LilMjzy eqWhs6UNqC5BNdvz88Wghq7jlS3DNulgu2yB3tZO12jhLoni1LShMO9bje1FqzQX1KQQEwKlsydO ImRmQDuXa+xmi3OALmw9R/8rUTlz81qSoMtOyiAl4y0zfAmpkicvh3IjdPUbZJcxlNWQiBt4UAiH MUGJg9Ta9WxJCvXDyhk8JW/LMcIRDBxVN5I2xVq2RTdN+fUsQsHbKBMTCuPf93sg3cEonxYtYCrg u3M8w1KatQrccz75qjiFCiCfp7RVRfFZ8jtK3w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for direct
	`direct. 3600 IN DNSKEY ( 256 3 8 AwEAAdeV2NBafZBJCuYbxe//Ch65lGbGEvCuafDBfMHmrKB2Aec5Z93mWTOJ5xnsgyDrJIbCuW72 i9gr+Or8A31QUzbKA13EoYTZBzfVDAAY5RjUGs+aA42RI0v4mCYueUpl99tcsXnEaUupu+8K7jp/ 4/TnhqXdnvO2Xym7PpSNp+fd ) ; keytag 45216`
	`direct. 3600 IN DNSKEY ( 257 3 8 AwEAAbWg93B3r4ZbiOdJ7MpJq9NLprGgKcPQQUEAm7H/sfjP7vUbFef1ahNsSoQpUBLy8qysSzMq LMi0kkX8XfCwk6FhVW4X4kRPIr2J3WGblR3IAchp0I8TzST9fjWLY6NEJleyxAQdbEx6213QFf6P kva7Xb7ojlykUXBTlLfsZkBqXflMgnxyD6yQHXr8czkuD20wE6ICU6L8iqn/P6tTtAm7uUR89PdR x+Ohb1sahJBebqq9QSi0J6+s0pcpxK0cVG7KSLm6BuZzKOAkqLCwzCSth1QGg2fVQjIVQv58VB94 1wUIhcxYkDc8C02ptcKj0rxlgHAqv0jnwTur3WD8f3c= ) ; keytag 29044`
	`direct. 3600 IN DNSKEY ( 256 3 8 AwEAAaZBkFQ+6zP8B5/Ko1BzeT8k5UXtldNG5a/oJJlB+hC9YQnTOAM4X8NOHjCK1cthT3rkk3zP I3AEpbUmD8MKORYzZpezROYdG4xK87M6F1HPctSzn74baF62unVzSNxkwQflPcuOU8MGH5J4hOFn mwMxuXMyhSCnZ6emgEoPlDjl ) ; keytag 27351`
	DNSKEY=29044/SEP is now in the chain-of-trust
	DS=29044/SHA-256 verifies DNSKEY=29044/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`direct. 3600 IN RRSIG ( DNSKEY 8 1 3600 20260716153856 20260625143856 29044 direct. UKkr7oBfXok8jY4QGL4jB82N43+ppZfRfulBwCCzdZtrmZN7hHnPfRsOXqzWjOhsPTYM/LilMjzy eqWhs6UNqC5BNdvz88Wghq7jlS3DNulgu2yB3tZO12jhLoni1LShMO9bje1FqzQX1KQQEwKlsydO ImRmQDuXa+xmi3OALmw9R/8rUTlz81qSoMtOyiAl4y0zfAmpkicvh3IjdPUbZJcxlNWQiBt4UAiH MUGJg9Ta9WxJCvXDyhk8JW/LMcIRDBxVN5I2xVq2RTdN+fUsQsHbKBMTCuPf93sg3cEonxYtYCrg u3M8w1KatQrccz75qjiFCiCfp7RVRfFZ8jtK3w== )`
	RRSIG=29044 and DNSKEY=29044/SEP verifies the DNSKEY RRset
	DNSKEY=45216 is now in the chain-of-trust
	DNSKEY=27351 is now in the chain-of-trust
	Query to v2n0.nic.direct for try.direct/A
	Received 624 bytes from 65.22.27.46
	;; Response received from [65.22.27.46] 624 octets ;; HEADER SECTION ;; id = 39679 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; try.direct. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) try.direct. 3600 IN NS oxygen.ns.hetzner.com. try.direct. 3600 IN NS hydrogen.ns.hetzner.com. try.direct. 3600 IN NS helium.ns.hetzner.de. 3f0of5cs4lqldtd0vvrepelhtk0vpq45.direct. 3600 IN NSEC3 ( 1 1 0 73 3f229sj61ckrqvf02tujitfhq49uaa4p NS SOA RRSIG DNSKEY NSEC3PARAM ) 3f0of5cs4lqldtd0vvrepelhtk0vpq45.direct. 3600 IN RRSIG ( NSEC3 8 2 3600 20260717210500 20260626200500 27351 direct. MpS/x10ztu+tAlJsXW7PVQQ7ZWV7Z81hObCIgGoWvncizcEQ+CA1AJFtOG9X/G07QaViXYqrA/kD HLfxxpB4A9D/ShGZzJQ5vy/RRoZDpe/tnNmvAE5EJTQFa6n221F7redP8rjImTDdiDpprlix4pMN IIjmignHTrsZ0YSuuRU= ) p7ku8nlqv70po20a11ldbmlkofubq34v.direct. 3600 IN NSEC3 ( 1 1 0 73 pagigaf6h566opoulhs37jl8lfsoptjq NS DS RRSIG ) p7ku8nlqv70po20a11ldbmlkofubq34v.direct. 3600 IN RRSIG ( NSEC3 8 2 3600 20260716153856 20260625143856 27351 direct. iY4RthO9ZN1bhJZnDIPTJOzzt5c9SiCQ+USVtEGakkhp4uhOQs2AuECDExH20jHxV9TVOsXep30l wVsoGotLJ/ts4vItXR5hYygCcwY9E4M4djkAhYDtzM7jbsLVhtPT7EbV3DsSvkJPJjQfL5HQGrMG GVAl4iYUHi0SWlID6D0= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to v0n2.nic.direct for try.direct/DNSKEY
	Received 624 bytes from 65.22.26.46
	;; Response received from [65.22.26.46] 624 octets ;; HEADER SECTION ;; id = 32370 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; try.direct. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) try.direct. 3600 IN NS hydrogen.ns.hetzner.com. try.direct. 3600 IN NS helium.ns.hetzner.de. try.direct. 3600 IN NS oxygen.ns.hetzner.com. 3f0of5cs4lqldtd0vvrepelhtk0vpq45.direct. 3600 IN NSEC3 ( 1 1 0 73 3f229sj61ckrqvf02tujitfhq49uaa4p NS SOA RRSIG DNSKEY NSEC3PARAM ) 3f0of5cs4lqldtd0vvrepelhtk0vpq45.direct. 3600 IN RRSIG ( NSEC3 8 2 3600 20260717210500 20260626200500 27351 direct. MpS/x10ztu+tAlJsXW7PVQQ7ZWV7Z81hObCIgGoWvncizcEQ+CA1AJFtOG9X/G07QaViXYqrA/kD HLfxxpB4A9D/ShGZzJQ5vy/RRoZDpe/tnNmvAE5EJTQFa6n221F7redP8rjImTDdiDpprlix4pMN IIjmignHTrsZ0YSuuRU= ) p7ku8nlqv70po20a11ldbmlkofubq34v.direct. 3600 IN NSEC3 ( 1 1 0 73 pagigaf6h566opoulhs37jl8lfsoptjq NS DS RRSIG ) p7ku8nlqv70po20a11ldbmlkofubq34v.direct. 3600 IN RRSIG ( NSEC3 8 2 3600 20260716153856 20260625143856 27351 direct. iY4RthO9ZN1bhJZnDIPTJOzzt5c9SiCQ+USVtEGakkhp4uhOQs2AuECDExH20jHxV9TVOsXep30l wVsoGotLJ/ts4vItXR5hYygCcwY9E4M4djkAhYDtzM7jbsLVhtPT7EbV3DsSvkJPJjQfL5HQGrMG GVAl4iYUHi0SWlID6D0= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone try.direct

try.direct

	Checking DS between direct and try.direct
	Query to v0n3.nic.direct for try.direct/DS
	Received 766 bytes from 161.232.12.46
	;; Response received from [161.232.12.46] 766 octets ;; HEADER SECTION ;; id = 5608 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; try.direct. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) 3f0of5cs4lqldtd0vvrepelhtk0vpq45.direct. 3600 IN NSEC3 ( 1 1 0 73 3f229sj61ckrqvf02tujitfhq49uaa4p NS SOA RRSIG DNSKEY NSEC3PARAM ) 3f0of5cs4lqldtd0vvrepelhtk0vpq45.direct. 3600 IN RRSIG ( NSEC3 8 2 3600 20260717210500 20260626200500 27351 direct. MpS/x10ztu+tAlJsXW7PVQQ7ZWV7Z81hObCIgGoWvncizcEQ+CA1AJFtOG9X/G07QaViXYqrA/kD HLfxxpB4A9D/ShGZzJQ5vy/RRoZDpe/tnNmvAE5EJTQFa6n221F7redP8rjImTDdiDpprlix4pMN IIjmignHTrsZ0YSuuRU= ) direct. 3600 IN SOA ( v0n0.nic.direct. hostmaster.donuts.email. 1782507713 ;serial 7200 ;refresh 900 ;retry 1209600 ;expire 3600 ;minimum ) direct. 3600 IN RRSIG ( SOA 8 1 3600 20260717210500 20260626200500 27351 direct. othKSUcAticGOiZrtRgQsyS/5fankQNxzE0jTBSiB9goGHDBMtZokePdF5NoO1P9f0PmRD6YqW/p wYVg6Ma+fWRw2FCjxbwmkZSMlMMWuLCsFeVwi7a4SAdUmvGbPskmj426yIr2EhLa3KURw7g84rxe +vdfFnLYwc/UrQ/lWos= ) p7ku8nlqv70po20a11ldbmlkofubq34v.direct. 3600 IN NSEC3 ( 1 1 0 73 pagigaf6h566opoulhs37jl8lfsoptjq NS DS RRSIG ) p7ku8nlqv70po20a11ldbmlkofubq34v.direct. 3600 IN RRSIG ( NSEC3 8 2 3600 20260716153856 20260625143856 27351 direct. iY4RthO9ZN1bhJZnDIPTJOzzt5c9SiCQ+USVtEGakkhp4uhOQs2AuECDExH20jHxV9TVOsXep30l wVsoGotLJ/ts4vItXR5hYygCcwY9E4M4djkAhYDtzM7jbsLVhtPT7EbV3DsSvkJPJjQfL5HQGrMG GVAl4iYUHi0SWlID6D0= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DS records found for try.direct in the direct zone
	Query to helium.ns.hetzner.de for try.direct/DNSKEY
	Received 102 bytes from 193.47.99.5
	;; Response received from [193.47.99.5] 102 octets ;; HEADER SECTION ;; id = 46707 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 1 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; try.direct. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) try.direct. 3600 IN SOA ( hydrogen.ns.hetzner.com. dns.hetzner.com. 2026062603 ;serial 86400 ;refresh 10800 ;retry 3600000 ;expire 3600 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DNSKEY records found
	Query to oxygen.ns.hetzner.com for try.direct/A
	Received 147 bytes from 88.198.229.192
	;; Response received from [88.198.229.192] 147 octets ;; HEADER SECTION ;; id = 22259 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 1 ;; nscount = 3 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; try.direct. IN A ;; ANSWER SECTION (1 record) try.direct. 300 IN A 167.233.9.19 ;; AUTHORITY SECTION (3 records) try.direct. 86400 IN NS helium.ns.hetzner.de. try.direct. 86400 IN NS hydrogen.ns.hetzner.com. try.direct. 86400 IN NS oxygen.ns.hetzner.com. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	oxygen.ns.hetzner.com is authoritative for try.direct
	Query to hydrogen.ns.hetzner.com for try.direct/SOA
	Received 171 bytes from 213.133.100.98
	;; Response received from [213.133.100.98] 171 octets ;; HEADER SECTION ;; id = 11234 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 1 ;; nscount = 3 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; try.direct. IN SOA ;; ANSWER SECTION (1 record) try.direct. 86400 IN SOA ( hydrogen.ns.hetzner.com. dns.hetzner.com. 2026062603 ;serial 86400 ;refresh 10800 ;retry 3600000 ;expire 3600 ;minimum ) ;; AUTHORITY SECTION (3 records) try.direct. 86400 IN NS helium.ns.hetzner.de. try.direct. 86400 IN NS hydrogen.ns.hetzner.com. try.direct. 86400 IN NS oxygen.ns.hetzner.com. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to helium.ns.hetzner.de for try.direct/SOA
	Received 171 bytes from 193.47.99.5
	;; Response received from [193.47.99.5] 171 octets ;; HEADER SECTION ;; id = 27253 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 1 ;; nscount = 3 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; try.direct. IN SOA ;; ANSWER SECTION (1 record) try.direct. 86400 IN SOA ( hydrogen.ns.hetzner.com. dns.hetzner.com. 2026062603 ;serial 86400 ;refresh 10800 ;retry 3600000 ;expire 3600 ;minimum ) ;; AUTHORITY SECTION (3 records) try.direct. 86400 IN NS helium.ns.hetzner.de. try.direct. 86400 IN NS hydrogen.ns.hetzner.com. try.direct. 86400 IN NS oxygen.ns.hetzner.com. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to oxygen.ns.hetzner.com for try.direct/A
	try.direct A RR has value 167.233.9.19
	No RRSIGs found

try.direct

	Query to hydrogen.ns.hetzner.com for try.direct/A
	Received 147 bytes from 213.133.100.98
	;; Response received from [213.133.100.98] 147 octets ;; HEADER SECTION ;; id = 34920 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 1 ;; nscount = 3 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; try.direct. IN A ;; ANSWER SECTION (1 record) try.direct. 300 IN A 167.233.9.19 ;; AUTHORITY SECTION (3 records) try.direct. 86400 IN NS helium.ns.hetzner.de. try.direct. 86400 IN NS hydrogen.ns.hetzner.com. try.direct. 86400 IN NS oxygen.ns.hetzner.com. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	hydrogen.ns.hetzner.com is authoritative for try.direct
	Query to hydrogen.ns.hetzner.com for try.direct/A
	try.direct A RR has value 167.233.9.19
	No RRSIGs found

try.direct

	Query to helium.ns.hetzner.de for try.direct/A
	Received 147 bytes from 193.47.99.5
	;; Response received from [193.47.99.5] 147 octets ;; HEADER SECTION ;; id = 47362 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 1 ;; nscount = 3 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; try.direct. IN A ;; ANSWER SECTION (1 record) try.direct. 300 IN A 167.233.9.19 ;; AUTHORITY SECTION (3 records) try.direct. 86400 IN NS helium.ns.hetzner.de. try.direct. 86400 IN NS hydrogen.ns.hetzner.com. try.direct. 86400 IN NS oxygen.ns.hetzner.com. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	helium.ns.hetzner.de is authoritative for try.direct
	Query to helium.ns.hetzner.de for try.direct/A
	try.direct A RR has value 167.233.9.19
	No RRSIGs found

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test try.direct at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: