DNSSEC Debugger - www.iana.org

Back to Verisign Labs Tools

Domain Name:

Detail: more(+) / less(-)

Time: 2026-05-26 04:33:38 UTC

Analyzing DNSSEC problems for www.iana.org

DS=20326/SHA-256 is now in the chain-of-trust

DS=38696/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	`. IN DS ( 38696 8 2 683d2d0acb8c9b712a1948b27f741219298d0a450d612c483af444a4c0fb2b16 )`
	Query to a.root-servers.net for ./DNSKEY
	Received 1139 bytes from 198.41.0.4
	;; Response received from [198.41.0.4] 1139 octets ;; HEADER SECTION ;; id = 11856 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 256 3 8 AwEAAb5dDYffpgAJ8VUGLwQtWXPlQWsjIFJtCM00/XaKU+8ln+ofah3q2KxEIjvzQg+nqdxRj+8e mtPne1mtYcbFWP4Q9E+DniOJLK09R05FuzvGbrG7DDdRDUX/cedFdV7O8pFEAYpJqYNR9BCTIAV9 73DO2biauKSA31b7I2lK/woxoR1tf5cqJ4SMbJUviuHicAEoUi2ATswloZNWd5T5thmEFZnxFx7D 5UgKCY7oflS7+GU7dNJwEtmFnWYVETHN0kHXVz6aguouaAZp706YXNIoR/iTgQhmsR7XX+wL0Z8Q M2LxQIyU6vRZ06IyuJMGRMiwkSuGElbumyBt12JZbrU= ) ; keytag 54393 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20260611000000 20260521000000 20326 . PrY674kcaqCFM9BMLlHQjBpoNN8qMK9j0/7CfsSsF9/CE4TAO8HB30AK8vHCq4B4jiD4ODo9/Y6w H0i41EMNGR5Yut23/N7sLPOB0ELQlFNbdZUHHAgqqIeU2ywNVv2iEKKd8Lf0VmmSNZIQUCYQdeyy q2xj5xZ2jAtdst7yfrYpWICKWi3d3piiN14r2e1uifNP6h8iL7f6cAMsHpNX2vw3irciB4JsnXZ0 WEZ5p0OCXmgUbXWcDohqLemW2vdSqlrgD4KXhCrvnqw70nppjsR1cZ8irJ7oNF47B6Kmeu3uCkBj CXRLt5B+0d5uJmutAvniyqKXJ353Fdd859J3Lw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAb5dDYffpgAJ8VUGLwQtWXPlQWsjIFJtCM00/XaKU+8ln+ofah3q2KxEIjvzQg+nqdxRj+8e mtPne1mtYcbFWP4Q9E+DniOJLK09R05FuzvGbrG7DDdRDUX/cedFdV7O8pFEAYpJqYNR9BCTIAV9 73DO2biauKSA31b7I2lK/woxoR1tf5cqJ4SMbJUviuHicAEoUi2ATswloZNWd5T5thmEFZnxFx7D 5UgKCY7oflS7+GU7dNJwEtmFnWYVETHN0kHXVz6aguouaAZp706YXNIoR/iTgQhmsR7XX+wL0Z8Q M2LxQIyU6vRZ06IyuJMGRMiwkSuGElbumyBt12JZbrU= ) ; keytag 54393`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	DNSKEY=38696/SEP is now in the chain-of-trust
	DS=38696/SHA-256 verifies DNSKEY=38696/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20260611000000 20260521000000 20326 . PrY674kcaqCFM9BMLlHQjBpoNN8qMK9j0/7CfsSsF9/CE4TAO8HB30AK8vHCq4B4jiD4ODo9/Y6w H0i41EMNGR5Yut23/N7sLPOB0ELQlFNbdZUHHAgqqIeU2ywNVv2iEKKd8Lf0VmmSNZIQUCYQdeyy q2xj5xZ2jAtdst7yfrYpWICKWi3d3piiN14r2e1uifNP6h8iL7f6cAMsHpNX2vw3irciB4JsnXZ0 WEZ5p0OCXmgUbXWcDohqLemW2vdSqlrgD4KXhCrvnqw70nppjsR1cZ8irJ7oNF47B6Kmeu3uCkBj CXRLt5B+0d5uJmutAvniyqKXJ353Fdd859J3Lw== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=54393 is now in the chain-of-trust
	Query to m.root-servers.net for www.iana.org/A
	Received 784 bytes from 202.12.27.33
	;; Response received from [202.12.27.33] 784 octets ;; HEADER SECTION ;; id = 53239 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.iana.org. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) org. 172800 IN NS a2.org.afilias-nst.info. org. 172800 IN NS c0.org.afilias-nst.info. org. 172800 IN NS d0.org.afilias-nst.org. org. 172800 IN NS a0.org.afilias-nst.info. org. 172800 IN NS b0.org.afilias-nst.org. org. 172800 IN NS b2.org.afilias-nst.org. org. 86400 IN DS ( 26974 8 2 4fede294c53f438a158c41d39489cd78a86beb0d8a0aeaff14745c0d16e1de32 ) org. 86400 IN RRSIG ( DS 8 1 86400 20260607170000 20260525160000 54393 . CXv9QDxOvcBPttR9E/PV7YvdrkTjr4TQKaVnNExSLX1d5C+TANrkzwl5R9Pbyq22YSYc7UPkku1e GEGVAI32tVqBGmwRAGWM5bfvNZute4WWQ0YsYuxOgxZC5gGFj0ZEVFTCpMcamnAeQ3qgeaUXIn3B VsUW3/LUcwpDN063yJaNSZkR37EnmZcAAeeyWlHmnyY8efD1HJTMo1EbBg3fr/7ZBJsBgaJREOCW sa7gSsLSJdXdRUA+2A3gHdSsnIydfbMgK+JAnlhb56lr/m3WYk4kVsjjprWHzq1gXdXulRzyVRTD cm0LZ8fQZpiMne+DLlmRLEb+pNq1LFWUPgzgvw== ) ;; ADDITIONAL SECTION (13 records) d0.org.afilias-nst.org. 172800 IN A 199.19.57.1 c0.org.afilias-nst.info. 172800 IN A 199.19.53.1 b2.org.afilias-nst.org. 172800 IN A 199.249.120.1 b0.org.afilias-nst.org. 172800 IN A 199.19.54.1 a2.org.afilias-nst.info. 172800 IN A 199.249.112.1 a0.org.afilias-nst.info. 172800 IN A 199.19.56.1 d0.org.afilias-nst.org. 172800 IN AAAA 2001:500:f::1 c0.org.afilias-nst.info. 172800 IN AAAA 2001:500:b::1 b2.org.afilias-nst.org. 172800 IN AAAA 2001:500:48::1 b0.org.afilias-nst.org. 172800 IN AAAA 2001:500:c::1 a2.org.afilias-nst.info. 172800 IN AAAA 2001:500:40::1 a0.org.afilias-nst.info. 172800 IN AAAA 2001:500:e::1 ;; { "EDNS-VERSION": 0 }
	Query to j.root-servers.net for org/DNSKEY
	Received 811 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 811 octets ;; HEADER SECTION ;; id = 63020 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; org. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) org. 172800 IN NS a0.org.afilias-nst.info. org. 172800 IN NS a2.org.afilias-nst.info. org. 172800 IN NS b0.org.afilias-nst.org. org. 172800 IN NS b2.org.afilias-nst.org. org. 172800 IN NS c0.org.afilias-nst.info. org. 172800 IN NS d0.org.afilias-nst.org. org. 86400 IN DS ( 26974 8 2 4fede294c53f438a158c41d39489cd78a86beb0d8a0aeaff14745c0d16e1de32 ) org. 86400 IN RRSIG ( DS 8 1 86400 20260607170000 20260525160000 54393 . CXv9QDxOvcBPttR9E/PV7YvdrkTjr4TQKaVnNExSLX1d5C+TANrkzwl5R9Pbyq22YSYc7UPkku1e GEGVAI32tVqBGmwRAGWM5bfvNZute4WWQ0YsYuxOgxZC5gGFj0ZEVFTCpMcamnAeQ3qgeaUXIn3B VsUW3/LUcwpDN063yJaNSZkR37EnmZcAAeeyWlHmnyY8efD1HJTMo1EbBg3fr/7ZBJsBgaJREOCW sa7gSsLSJdXdRUA+2A3gHdSsnIydfbMgK+JAnlhb56lr/m3WYk4kVsjjprWHzq1gXdXulRzyVRTD cm0LZ8fQZpiMne+DLlmRLEb+pNq1LFWUPgzgvw== ) ;; ADDITIONAL SECTION (13 records) b0.org.afilias-nst.org. 172800 IN A 199.19.54.1 b0.org.afilias-nst.org. 172800 IN AAAA 2001:500:c::1 b2.org.afilias-nst.org. 172800 IN A 199.249.120.1 b2.org.afilias-nst.org. 172800 IN AAAA 2001:500:48::1 d0.org.afilias-nst.org. 172800 IN A 199.19.57.1 d0.org.afilias-nst.org. 172800 IN AAAA 2001:500:f::1 a0.org.afilias-nst.info. 172800 IN A 199.19.56.1 a0.org.afilias-nst.info. 172800 IN AAAA 2001:500:e::1 a2.org.afilias-nst.info. 172800 IN A 199.249.112.1 a2.org.afilias-nst.info. 172800 IN AAAA 2001:500:40::1 c0.org.afilias-nst.info. 172800 IN A 199.19.53.1 c0.org.afilias-nst.info. 172800 IN AAAA 2001:500:b::1 ;; { "EDNS-VERSION": 0 }
	Found child zone org

org

	Checking DS between . and org
	Query to l.root-servers.net for org/DS
	Received 367 bytes from 199.7.83.42
	;; Response received from [199.7.83.42] 367 octets ;; HEADER SECTION ;; id = 56310 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; org. IN DS ;; ANSWER SECTION (2 records) org. 86400 IN DS ( 26974 8 2 4fede294c53f438a158c41d39489cd78a86beb0d8a0aeaff14745c0d16e1de32 ) org. 86400 IN RRSIG ( DS 8 1 86400 20260607170000 20260525160000 54393 . CXv9QDxOvcBPttR9E/PV7YvdrkTjr4TQKaVnNExSLX1d5C+TANrkzwl5R9Pbyq22YSYc7UPkku1e GEGVAI32tVqBGmwRAGWM5bfvNZute4WWQ0YsYuxOgxZC5gGFj0ZEVFTCpMcamnAeQ3qgeaUXIn3B VsUW3/LUcwpDN063yJaNSZkR37EnmZcAAeeyWlHmnyY8efD1HJTMo1EbBg3fr/7ZBJsBgaJREOCW sa7gSsLSJdXdRUA+2A3gHdSsnIydfbMgK+JAnlhb56lr/m3WYk4kVsjjprWHzq1gXdXulRzyVRTD cm0LZ8fQZpiMne+DLlmRLEb+pNq1LFWUPgzgvw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for org in the . zone
	DS=26974/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`org. 86400 IN RRSIG ( DS 8 1 86400 20260607170000 20260525160000 54393 . CXv9QDxOvcBPttR9E/PV7YvdrkTjr4TQKaVnNExSLX1d5C+TANrkzwl5R9Pbyq22YSYc7UPkku1e GEGVAI32tVqBGmwRAGWM5bfvNZute4WWQ0YsYuxOgxZC5gGFj0ZEVFTCpMcamnAeQ3qgeaUXIn3B VsUW3/LUcwpDN063yJaNSZkR37EnmZcAAeeyWlHmnyY8efD1HJTMo1EbBg3fr/7ZBJsBgaJREOCW sa7gSsLSJdXdRUA+2A3gHdSsnIydfbMgK+JAnlhb56lr/m3WYk4kVsjjprWHzq1gXdXulRzyVRTD cm0LZ8fQZpiMne+DLlmRLEb+pNq1LFWUPgzgvw== )`
	RRSIG=54393 and DNSKEY=54393 verifies the DS RRset
	DS=26974/SHA-256 is now in the chain-of-trust
	`org. 86400 IN DS ( 26974 8 2 4fede294c53f438a158c41d39489cd78a86beb0d8a0aeaff14745c0d16e1de32 )`
	Query to d0.org.afilias-nst.org for org/DNSKEY
	Received 895 bytes from 199.19.57.1
	;; Response received from [199.19.57.1] 895 octets ;; HEADER SECTION ;; id = 43448 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; org. IN DNSKEY ;; ANSWER SECTION (4 records) org. 3600 IN DNSKEY ( 256 3 8 AwEAAbGsX9LnjKaz7rh+Wa5IJrvbqt3DUxjzN5QtPyBwJtlcE12ONYYzCbzTZaXEYiPJCmMFRn39 bDqHTrlSrhHHqeXxd64xzpwPbu/xszH8rT4yaDzCVPON4Nku+BiGaeqbfzDXjoLo5pYd05BnOUHW fzl9+VvQCFnsIwaSTu5zfsYr ) ; keytag 22809 org. 3600 IN DNSKEY ( 257 3 8 AwEAAexZJ/1wfyNCxNPrTZizaG7UlibGhP+AyogR6bqjptKweEgE4gD8GxRQJkt+Fn5pCoNqzmm1 ZnEoKqvm93uOYtbKkYQDGH+W69J66MSKpgIyS+mT/4iaXn+lpb5o99l/sf7lHMa975O/fqN6aPUl l4hUbN2T1LHv6HzQuQCtNRJA8jHGwX5q0NMmh2Z+yaG6B9cISerje9l5L+ID2ydJ6zXquYteoIUv X2xzqnXCdHPSvD+oL6R/weW+tztdFS1hok/1z3tn5NzmcaOLll9nXniCozEpLFEGPswyvtphWgCY hI8bBTqhUsIwfIwLSBQTEg2oCX7sS5CbXg44OqwhIW8= ) ; keytag 26974 org. 3600 IN DNSKEY ( 256 3 8 AwEAAdc3zoey96ZxM7zxOkwht46jj6B78njb2RkWGvyur8oIGx4eAbz+I38N2Sn3xpXepsXhmFOT UiT2A0tSye6yVaC3lzBLdxv0ZtKPOLDgOSdukMZz15AaOTfpoylOTXjOH5wm/3IuG2i3NbxoC0BS Ie9s1qTamCd47kLQ2yv9gDHx ) ; keytag 39684 org. 3600 IN RRSIG ( DNSKEY 8 1 3600 20260615152626 20260525142626 26974 org. wYKGg1RdY8ZvPv56TWvzHEA4Ovnz8JuoTgGgwvK0EyzGNBsHoOo7rVNkgACtzzweqHZdEMj5jDTz 8OKrG+RvjSj5w7VDUn+9Yaxki7q3tX/Ic0LACPJdgmEyyBAYxcAp7YfEkfRj5keiqU0ivCC677By mSQN+MYUp+HLEly5g6AJdi8fwDxAREeeIWE8Jore7iRSbK8tdZ5o3bed4Ww1mnJOXoDP9V7iZf4c zdkBUQnsuWub6j9WU5MK1NFCwiqVPLIRq7v8y2LoeUj1Dpb2z5hhDuy+Qhxumn0fxuyB0HpY17gw AFKMVqiMhab5WLZAHaf5MwaOm5CX63kjIcLnHA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for org
	`org. 3600 IN DNSKEY ( 256 3 8 AwEAAbGsX9LnjKaz7rh+Wa5IJrvbqt3DUxjzN5QtPyBwJtlcE12ONYYzCbzTZaXEYiPJCmMFRn39 bDqHTrlSrhHHqeXxd64xzpwPbu/xszH8rT4yaDzCVPON4Nku+BiGaeqbfzDXjoLo5pYd05BnOUHW fzl9+VvQCFnsIwaSTu5zfsYr ) ; keytag 22809`
	`org. 3600 IN DNSKEY ( 257 3 8 AwEAAexZJ/1wfyNCxNPrTZizaG7UlibGhP+AyogR6bqjptKweEgE4gD8GxRQJkt+Fn5pCoNqzmm1 ZnEoKqvm93uOYtbKkYQDGH+W69J66MSKpgIyS+mT/4iaXn+lpb5o99l/sf7lHMa975O/fqN6aPUl l4hUbN2T1LHv6HzQuQCtNRJA8jHGwX5q0NMmh2Z+yaG6B9cISerje9l5L+ID2ydJ6zXquYteoIUv X2xzqnXCdHPSvD+oL6R/weW+tztdFS1hok/1z3tn5NzmcaOLll9nXniCozEpLFEGPswyvtphWgCY hI8bBTqhUsIwfIwLSBQTEg2oCX7sS5CbXg44OqwhIW8= ) ; keytag 26974`
	`org. 3600 IN DNSKEY ( 256 3 8 AwEAAdc3zoey96ZxM7zxOkwht46jj6B78njb2RkWGvyur8oIGx4eAbz+I38N2Sn3xpXepsXhmFOT UiT2A0tSye6yVaC3lzBLdxv0ZtKPOLDgOSdukMZz15AaOTfpoylOTXjOH5wm/3IuG2i3NbxoC0BS Ie9s1qTamCd47kLQ2yv9gDHx ) ; keytag 39684`
	DNSKEY=26974/SEP is now in the chain-of-trust
	DS=26974/SHA-256 verifies DNSKEY=26974/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`org. 3600 IN RRSIG ( DNSKEY 8 1 3600 20260615152626 20260525142626 26974 org. wYKGg1RdY8ZvPv56TWvzHEA4Ovnz8JuoTgGgwvK0EyzGNBsHoOo7rVNkgACtzzweqHZdEMj5jDTz 8OKrG+RvjSj5w7VDUn+9Yaxki7q3tX/Ic0LACPJdgmEyyBAYxcAp7YfEkfRj5keiqU0ivCC677By mSQN+MYUp+HLEly5g6AJdi8fwDxAREeeIWE8Jore7iRSbK8tdZ5o3bed4Ww1mnJOXoDP9V7iZf4c zdkBUQnsuWub6j9WU5MK1NFCwiqVPLIRq7v8y2LoeUj1Dpb2z5hhDuy+Qhxumn0fxuyB0HpY17gw AFKMVqiMhab5WLZAHaf5MwaOm5CX63kjIcLnHA== )`
	RRSIG=26974 and DNSKEY=26974/SEP verifies the DNSKEY RRset
	DNSKEY=22809 is now in the chain-of-trust
	DNSKEY=39684 is now in the chain-of-trust
	Query to b0.org.afilias-nst.org for www.iana.org/A
	Received 383 bytes from 199.19.54.1
	;; Response received from [199.19.54.1] 383 octets ;; HEADER SECTION ;; id = 10205 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 3 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.iana.org. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) iana.org. 3600 IN NS a.iana-servers.net. iana.org. 3600 IN NS c.iana-servers.net. iana.org. 3600 IN NS ns.icann.org. iana.org. 3600 IN NS b.iana-servers.net. iana.org. 3600 IN DS ( 2234 13 2 005b228ce3dad3486f713ebb9bb6f96a53839bd0e2f5a999d3400e1b7355ce8c ) iana.org. 3600 IN RRSIG ( DS 8 2 3600 20260615152626 20260525142626 39684 org. JzuXkfG9TiyrIx1UrpiSAFPrdqfk1i7nhP7oGZUYZE+FtYRLmZaRMtHQPGgKiR/AQFYX5HD+a+rC bQqnqtMbOTqe+uIaBU26eAbP+O5D5DWakOxfKljRzkRVW07HLDZRTRBdgTtgL+UO6p6C4xJ6fgjD 7coC8/4F/L773PaWZIM= ) ;; ADDITIONAL SECTION (3 records) ns.icann.org. 3600 IN A 199.4.138.53 ns.icann.org. 3600 IN AAAA 2001:500:89::53 ;; { "EDNS-VERSION": 0 }
	Query to c0.org.afilias-nst.info for iana.org/DNSKEY
	Received 379 bytes from 199.19.53.1
	;; Response received from [199.19.53.1] 379 octets ;; HEADER SECTION ;; id = 14629 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 3 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iana.org. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) iana.org. 3600 IN NS ns.icann.org. iana.org. 3600 IN NS c.iana-servers.net. iana.org. 3600 IN NS a.iana-servers.net. iana.org. 3600 IN NS b.iana-servers.net. iana.org. 3600 IN DS ( 2234 13 2 005b228ce3dad3486f713ebb9bb6f96a53839bd0e2f5a999d3400e1b7355ce8c ) iana.org. 3600 IN RRSIG ( DS 8 2 3600 20260615152626 20260525142626 39684 org. JzuXkfG9TiyrIx1UrpiSAFPrdqfk1i7nhP7oGZUYZE+FtYRLmZaRMtHQPGgKiR/AQFYX5HD+a+rC bQqnqtMbOTqe+uIaBU26eAbP+O5D5DWakOxfKljRzkRVW07HLDZRTRBdgTtgL+UO6p6C4xJ6fgjD 7coC8/4F/L773PaWZIM= ) ;; ADDITIONAL SECTION (3 records) ns.icann.org. 3600 IN A 199.4.138.53 ns.icann.org. 3600 IN AAAA 2001:500:89::53 ;; { "EDNS-VERSION": 0 }
	Found child zone iana.org

iana.org

	Checking DS between org and iana.org
	Query to b2.org.afilias-nst.org for iana.org/DS
	Received 248 bytes from 199.249.120.1
	;; Response received from [199.249.120.1] 248 octets ;; HEADER SECTION ;; id = 12815 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iana.org. IN DS ;; ANSWER SECTION (2 records) iana.org. 3600 IN DS ( 2234 13 2 005b228ce3dad3486f713ebb9bb6f96a53839bd0e2f5a999d3400e1b7355ce8c ) iana.org. 3600 IN RRSIG ( DS 8 2 3600 20260615152626 20260525142626 39684 org. JzuXkfG9TiyrIx1UrpiSAFPrdqfk1i7nhP7oGZUYZE+FtYRLmZaRMtHQPGgKiR/AQFYX5HD+a+rC bQqnqtMbOTqe+uIaBU26eAbP+O5D5DWakOxfKljRzkRVW07HLDZRTRBdgTtgL+UO6p6C4xJ6fgjD 7coC8/4F/L773PaWZIM= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for iana.org in the org zone
	DS=2234/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`iana.org. 3600 IN RRSIG ( DS 8 2 3600 20260615152626 20260525142626 39684 org. JzuXkfG9TiyrIx1UrpiSAFPrdqfk1i7nhP7oGZUYZE+FtYRLmZaRMtHQPGgKiR/AQFYX5HD+a+rC bQqnqtMbOTqe+uIaBU26eAbP+O5D5DWakOxfKljRzkRVW07HLDZRTRBdgTtgL+UO6p6C4xJ6fgjD 7coC8/4F/L773PaWZIM= )`
	RRSIG=39684 and DNSKEY=39684 verifies the DS RRset
	DS=2234/SHA-256 is now in the chain-of-trust
	`iana.org. 3600 IN DS ( 2234 13 2 005b228ce3dad3486f713ebb9bb6f96a53839bd0e2f5a999d3400e1b7355ce8c )`
	Query to a.iana-servers.net for iana.org/DNSKEY
	Received 381 bytes from 199.43.135.53
	;; Response received from [199.43.135.53] 381 octets ;; HEADER SECTION ;; id = 6006 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; iana.org. IN DNSKEY ;; ANSWER SECTION (4 records) iana.org. 3600 IN DNSKEY ( 256 3 13 T7J32R8zZxD+XWfS4jK9tUoiME+XqPUQwJSNxwmov0L21td18I9Ua/ncOXAHyuxnRdZ0E0y7mySb Ac4khFXunQ== ) ; keytag 12050 iana.org. 3600 IN DNSKEY ( 256 3 13 2CvLkoyU/37J4emcwE+9RgrNV9fTFjNyozoLPR8IwKE2z5Z6yqbNDzpCCNN5qFna9fO6tTaTPu8D DephSEyoVA== ) ; keytag 56343 iana.org. 3600 IN DNSKEY ( 257 3 13 ShmRDG25b0nhrnRcBavHgaSO+vmS+46ZiZ+lQJd3UWXQrl/NWSg+CBBaqSTBD1N9eHthbudy+9Qq EocCRUcHKg== ) ; keytag 2234 iana.org. 3600 IN RRSIG ( DNSKEY 13 2 3600 20260614053121 20260524091159 2234 iana.org. DoQcWintxaeSApIjEb8xFQIQxNmZEUdS5GL2dXuYY4o4TRydrRbZua0qa/RnTlTaM0MQD4QJ1KTH EJtF96ipAw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for iana.org
	`iana.org. 3600 IN DNSKEY ( 256 3 13 T7J32R8zZxD+XWfS4jK9tUoiME+XqPUQwJSNxwmov0L21td18I9Ua/ncOXAHyuxnRdZ0E0y7mySb Ac4khFXunQ== ) ; keytag 12050`
	`iana.org. 3600 IN DNSKEY ( 256 3 13 2CvLkoyU/37J4emcwE+9RgrNV9fTFjNyozoLPR8IwKE2z5Z6yqbNDzpCCNN5qFna9fO6tTaTPu8D DephSEyoVA== ) ; keytag 56343`
	`iana.org. 3600 IN DNSKEY ( 257 3 13 ShmRDG25b0nhrnRcBavHgaSO+vmS+46ZiZ+lQJd3UWXQrl/NWSg+CBBaqSTBD1N9eHthbudy+9Qq EocCRUcHKg== ) ; keytag 2234`
	DNSKEY=2234/SEP is now in the chain-of-trust
	DS=2234/SHA-256 verifies DNSKEY=2234/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`iana.org. 3600 IN RRSIG ( DNSKEY 13 2 3600 20260614053121 20260524091159 2234 iana.org. DoQcWintxaeSApIjEb8xFQIQxNmZEUdS5GL2dXuYY4o4TRydrRbZua0qa/RnTlTaM0MQD4QJ1KTH EJtF96ipAw== )`
	RRSIG=2234 and DNSKEY=2234/SEP verifies the DNSKEY RRset
	DNSKEY=12050 is now in the chain-of-trust
	DNSKEY=56343 is now in the chain-of-trust
	Query to b.iana-servers.net for www.iana.org/A
	Received 1160 bytes from 199.43.133.53
	;; Response received from [199.43.133.53] 1160 octets ;; HEADER SECTION ;; id = 47337 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 5 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.iana.org. IN A ;; ANSWER SECTION (2 records) www.iana.org. 3600 IN CNAME ianawww.vip.icann.org. www.iana.org. 3600 IN RRSIG ( CNAME 13 3 3600 20260615123652 20260525131355 12050 iana.org. YKVCrjTR/Njo+6Fsf9hWb9etR9+rpsrbzlTQKm+c5NX8N7oIk9CDOxJviJmSWvMZHWOUUkmxXFWP up0joS/6bA== ) ;; AUTHORITY SECTION (5 records) vip.icann.org. 3600 IN NS gtm1.dc.icann.org. vip.icann.org. 3600 IN NS gtm1.lax.icann.org. vip.icann.org. 3600 IN NS gtm1.mdr.icann.org. vip.icann.org. 3600 IN DS ( 6025 8 2 4daafdc62528cefc8c8f52b50d70d822115bd9c0f6662a6505603ef18401fe49 ) vip.icann.org. 3600 IN RRSIG ( DS 13 3 3600 20260608235329 20260519034456 21057 icann.org. ZL1IanjC+GLSCfdnSsisv/tW3m3QadG/jPYbSoo0y6oGZ+UwbUivqzmxcY+0XixMZkaphy4wC5KK kyHbhfc7jw== ) ;; ADDITIONAL SECTION (13 records) gtm1.dc.icann.org. 3600 IN A 192.0.47.252 gtm1.dc.icann.org. 3600 IN RRSIG ( A 13 4 3600 20260611085626 20260521074559 21057 icann.org. e5o7PCRLTdGXdcID5Kq1JWCE6jpFiDV68WaAeFxTQV6t1cG9GUplKnOGgHgfeCNHmaa1Ni5n7RXb RkuhZe29qA== ) gtm1.lax.icann.org. 3600 IN A 192.0.32.252 gtm1.lax.icann.org. 3600 IN RRSIG ( A 13 4 3600 20260610085836 20260520154459 21057 icann.org. npRxXnME5AkK0aucOvrfMgWPS9H+N3MeWmMf/gvuC0TvzGsrZIKXtpAa60b797e9zrdmIHWaunpl eq8Fdbp+vg== ) gtm1.mdr.icann.org. 3600 IN A 192.0.36.252 gtm1.mdr.icann.org. 3600 IN RRSIG ( A 13 4 3600 20260611062945 20260520234500 21057 icann.org. ESSq/G/XO+3QyENv2sweMXO4V0Tamas3rgEPksBd6o6BwzEDM6fsL3QRCLKHVqYa12YONdB0xP4z 5zWNx02Mkg== ) gtm1.dc.icann.org. 3600 IN AAAA 2620:0:2830:296::252 gtm1.dc.icann.org. 3600 IN RRSIG ( AAAA 13 4 3600 20260609185149 20260519074457 21057 icann.org. uSDKUIX/Gekgg0GTMf3/s65+C5HsyoYOL7gpRo08+UWPLt4L4JjzgrCywMNY4hHANzdRJP60UE85 OKJgWonvFA== ) gtm1.lax.icann.org. 3600 IN AAAA 2620:0:2d0:296::252 gtm1.lax.icann.org. 3600 IN RRSIG ( AAAA 13 4 3600 20260611101621 20260521114644 21057 icann.org. 43wHyQamCa6w0Wu1BuKHI5Y2tEEDRtzXvthrgIc/HffbTBjAo5RG74mKzZ0hnvaoBDEYqHXvPIlD v1RJAxD8Ew== ) gtm1.mdr.icann.org. 3600 IN AAAA 2620:0:2ed0:296::252 gtm1.mdr.icann.org. 3600 IN RRSIG ( AAAA 13 4 3600 20260609230037 20260520054459 21057 icann.org. GqqjTPsinEdOcaZ94WxB6OvIA+N1K8ExLhDfcHPfwbEG8b1W1JWj/k2PX9lb9RaI2TOSpQ4z0nFa 0hcin1BeOQ== ) ;; { "EDNS-VERSION": 0 }
	b.iana-servers.net is authoritative for www.iana.org
	Query to a.iana-servers.net for www.iana.org/DNSKEY
	Received 177 bytes from 199.43.135.53
	;; Response received from [199.43.135.53] 177 octets ;; HEADER SECTION ;; id = 50379 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.iana.org. IN DNSKEY ;; ANSWER SECTION (2 records) www.iana.org. 3600 IN CNAME ianawww.vip.icann.org. www.iana.org. 3600 IN RRSIG ( CNAME 13 3 3600 20260615123652 20260525131355 12050 iana.org. YKVCrjTR/Njo+6Fsf9hWb9etR9+rpsrbzlTQKm+c5NX8N7oIk9CDOxJviJmSWvMZHWOUUkmxXFWP up0joS/6bA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found RRSIG signed by iana.org zone
	www.iana.org is a CNAME to ianawww.vip.icann.org
	Found 1 RRSIGs over CNAME RRset
	`www.iana.org. 3600 IN RRSIG ( CNAME 13 3 3600 20260615123652 20260525131355 12050 iana.org. YKVCrjTR/Njo+6Fsf9hWb9etR9+rpsrbzlTQKm+c5NX8N7oIk9CDOxJviJmSWvMZHWOUUkmxXFWP up0joS/6bA== )`
	RRSIG=12050 and DNSKEY=12050 verifies the CNAME RRset

org

	Query to b0.org.afilias-nst.org for ianawww.vip.icann.org/A
	Received 387 bytes from 199.19.54.1
	;; Response received from [199.19.54.1] 387 octets ;; HEADER SECTION ;; id = 3390 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 3 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ianawww.vip.icann.org. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) icann.org. 3600 IN NS ns.icann.org. icann.org. 3600 IN NS a.icann-servers.net. icann.org. 3600 IN NS c.icann-servers.net. icann.org. 3600 IN NS b.icann-servers.net. icann.org. 3600 IN DS ( 20149 13 2 cf066bceadb799a27b62e3e82dc2e4da314c1807db98f13d82f0043b1418cf4e ) icann.org. 3600 IN RRSIG ( DS 8 2 3600 20260615152626 20260525142626 39684 org. tcEBUha8SAGUOUCgMAfwMtoVwnfjOTsAkKvq4ZPipoH9hD1InhBHi9JtZcHmh3Ze8E0A0A1YJaUE 3iu4q77rPqifeTwx14JKrDITVEic4jPC+Akd6RnLfSUmhM+OmDm9vqGh6yW+E5ueuDDwPlqK3Rk2 51fR8wWyNhpCTjjhIWo= ) ;; ADDITIONAL SECTION (3 records) ns.icann.org. 3600 IN A 199.4.138.53 ns.icann.org. 3600 IN AAAA 2001:500:89::53 ;; { "EDNS-VERSION": 0 }
	Query to a2.org.afilias-nst.info for icann.org/DNSKEY
	Received 375 bytes from 199.249.112.1
	;; Response received from [199.249.112.1] 375 octets ;; HEADER SECTION ;; id = 38001 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 3 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; icann.org. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) icann.org. 3600 IN NS c.icann-servers.net. icann.org. 3600 IN NS ns.icann.org. icann.org. 3600 IN NS a.icann-servers.net. icann.org. 3600 IN NS b.icann-servers.net. icann.org. 3600 IN DS ( 20149 13 2 cf066bceadb799a27b62e3e82dc2e4da314c1807db98f13d82f0043b1418cf4e ) icann.org. 3600 IN RRSIG ( DS 8 2 3600 20260615152626 20260525142626 39684 org. tcEBUha8SAGUOUCgMAfwMtoVwnfjOTsAkKvq4ZPipoH9hD1InhBHi9JtZcHmh3Ze8E0A0A1YJaUE 3iu4q77rPqifeTwx14JKrDITVEic4jPC+Akd6RnLfSUmhM+OmDm9vqGh6yW+E5ueuDDwPlqK3Rk2 51fR8wWyNhpCTjjhIWo= ) ;; ADDITIONAL SECTION (3 records) ns.icann.org. 3600 IN A 199.4.138.53 ns.icann.org. 3600 IN AAAA 2001:500:89::53 ;; { "EDNS-VERSION": 0 }
	Found child zone icann.org

icann.org

	Checking DS between org and icann.org
	Query to b0.org.afilias-nst.org for icann.org/DS
	Received 249 bytes from 199.19.54.1
	;; Response received from [199.19.54.1] 249 octets ;; HEADER SECTION ;; id = 47872 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; icann.org. IN DS ;; ANSWER SECTION (2 records) icann.org. 3600 IN DS ( 20149 13 2 cf066bceadb799a27b62e3e82dc2e4da314c1807db98f13d82f0043b1418cf4e ) icann.org. 3600 IN RRSIG ( DS 8 2 3600 20260615152626 20260525142626 39684 org. tcEBUha8SAGUOUCgMAfwMtoVwnfjOTsAkKvq4ZPipoH9hD1InhBHi9JtZcHmh3Ze8E0A0A1YJaUE 3iu4q77rPqifeTwx14JKrDITVEic4jPC+Akd6RnLfSUmhM+OmDm9vqGh6yW+E5ueuDDwPlqK3Rk2 51fR8wWyNhpCTjjhIWo= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for icann.org in the org zone
	DS=20149/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`icann.org. 3600 IN RRSIG ( DS 8 2 3600 20260615152626 20260525142626 39684 org. tcEBUha8SAGUOUCgMAfwMtoVwnfjOTsAkKvq4ZPipoH9hD1InhBHi9JtZcHmh3Ze8E0A0A1YJaUE 3iu4q77rPqifeTwx14JKrDITVEic4jPC+Akd6RnLfSUmhM+OmDm9vqGh6yW+E5ueuDDwPlqK3Rk2 51fR8wWyNhpCTjjhIWo= )`
	RRSIG=39684 and DNSKEY=39684 verifies the DS RRset
	DS=20149/SHA-256 is now in the chain-of-trust
	`icann.org. 3600 IN DS ( 20149 13 2 cf066bceadb799a27b62e3e82dc2e4da314c1807db98f13d82f0043b1418cf4e )`
	Query to c.icann-servers.net for icann.org/DNSKEY
	Received 383 bytes from 199.43.134.53
	;; Response received from [199.43.134.53] 383 octets ;; HEADER SECTION ;; id = 17302 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; icann.org. IN DNSKEY ;; ANSWER SECTION (4 records) icann.org. 3600 IN DNSKEY ( 257 3 13 d25y9HFMnvNDVXria3ODfdcjUwA6S0MjGnOftautpQ9Aztpc95MKKNo7uUgH6qQDwqvD2ycNYQJS q75K3YuW8A== ) ; keytag 20149 icann.org. 3600 IN DNSKEY ( 256 3 13 Ihrqo37vwboZMulIb9bxdRFDC9DGodt+OT/WthNwv+HS+ujh7/PyETjS0Nns5Q6+Br0Le+SjYpGz yONXZpkALw== ) ; keytag 21057 icann.org. 3600 IN DNSKEY ( 256 3 13 xop1aCXt+nx/orAOvytsv/F7PdVX+R2ENudq1kSB0ldoIwGBEaZ8itT+bBwKwLb1bGK1wfzEUwoZ tSLAYcyxHw== ) ; keytag 54630 icann.org. 3600 IN RRSIG ( DNSKEY 13 2 3600 20260614185639 20260524091159 20149 icann.org. 0fmgJ4wwppQ/wMTWtYjqE1P7JsMjBtYcw7G1SfwFyeOOTKCJrFYfejiP20C9DtIBzp28GUJ9K4iY l9Cp+ejNCw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for icann.org
	`icann.org. 3600 IN DNSKEY ( 257 3 13 d25y9HFMnvNDVXria3ODfdcjUwA6S0MjGnOftautpQ9Aztpc95MKKNo7uUgH6qQDwqvD2ycNYQJS q75K3YuW8A== ) ; keytag 20149`
	`icann.org. 3600 IN DNSKEY ( 256 3 13 Ihrqo37vwboZMulIb9bxdRFDC9DGodt+OT/WthNwv+HS+ujh7/PyETjS0Nns5Q6+Br0Le+SjYpGz yONXZpkALw== ) ; keytag 21057`
	`icann.org. 3600 IN DNSKEY ( 256 3 13 xop1aCXt+nx/orAOvytsv/F7PdVX+R2ENudq1kSB0ldoIwGBEaZ8itT+bBwKwLb1bGK1wfzEUwoZ tSLAYcyxHw== ) ; keytag 54630`
	DNSKEY=20149/SEP is now in the chain-of-trust
	DS=20149/SHA-256 verifies DNSKEY=20149/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`icann.org. 3600 IN RRSIG ( DNSKEY 13 2 3600 20260614185639 20260524091159 20149 icann.org. 0fmgJ4wwppQ/wMTWtYjqE1P7JsMjBtYcw7G1SfwFyeOOTKCJrFYfejiP20C9DtIBzp28GUJ9K4iY l9Cp+ejNCw== )`
	RRSIG=20149 and DNSKEY=20149/SEP verifies the DNSKEY RRset
	DNSKEY=21057 is now in the chain-of-trust
	DNSKEY=54630 is now in the chain-of-trust
	Query to b.icann-servers.net for ianawww.vip.icann.org/A
	Received 1033 bytes from 199.43.133.53
	;; Response received from [199.43.133.53] 1033 octets ;; HEADER SECTION ;; id = 9596 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 5 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ianawww.vip.icann.org. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (5 records) vip.icann.org. 3600 IN NS gtm1.dc.icann.org. vip.icann.org. 3600 IN NS gtm1.lax.icann.org. vip.icann.org. 3600 IN NS gtm1.mdr.icann.org. vip.icann.org. 3600 IN DS ( 6025 8 2 4daafdc62528cefc8c8f52b50d70d822115bd9c0f6662a6505603ef18401fe49 ) vip.icann.org. 3600 IN RRSIG ( DS 13 3 3600 20260608235329 20260519034456 21057 icann.org. ZL1IanjC+GLSCfdnSsisv/tW3m3QadG/jPYbSoo0y6oGZ+UwbUivqzmxcY+0XixMZkaphy4wC5KK kyHbhfc7jw== ) ;; ADDITIONAL SECTION (13 records) gtm1.dc.icann.org. 3600 IN A 192.0.47.252 gtm1.dc.icann.org. 3600 IN RRSIG ( A 13 4 3600 20260611085626 20260521074559 21057 icann.org. e5o7PCRLTdGXdcID5Kq1JWCE6jpFiDV68WaAeFxTQV6t1cG9GUplKnOGgHgfeCNHmaa1Ni5n7RXb RkuhZe29qA== ) gtm1.lax.icann.org. 3600 IN A 192.0.32.252 gtm1.lax.icann.org. 3600 IN RRSIG ( A 13 4 3600 20260610085836 20260520154459 21057 icann.org. npRxXnME5AkK0aucOvrfMgWPS9H+N3MeWmMf/gvuC0TvzGsrZIKXtpAa60b797e9zrdmIHWaunpl eq8Fdbp+vg== ) gtm1.mdr.icann.org. 3600 IN A 192.0.36.252 gtm1.mdr.icann.org. 3600 IN RRSIG ( A 13 4 3600 20260611062945 20260520234500 21057 icann.org. ESSq/G/XO+3QyENv2sweMXO4V0Tamas3rgEPksBd6o6BwzEDM6fsL3QRCLKHVqYa12YONdB0xP4z 5zWNx02Mkg== ) gtm1.dc.icann.org. 3600 IN AAAA 2620:0:2830:296::252 gtm1.dc.icann.org. 3600 IN RRSIG ( AAAA 13 4 3600 20260609185149 20260519074457 21057 icann.org. uSDKUIX/Gekgg0GTMf3/s65+C5HsyoYOL7gpRo08+UWPLt4L4JjzgrCywMNY4hHANzdRJP60UE85 OKJgWonvFA== ) gtm1.lax.icann.org. 3600 IN AAAA 2620:0:2d0:296::252 gtm1.lax.icann.org. 3600 IN RRSIG ( AAAA 13 4 3600 20260611101621 20260521114644 21057 icann.org. 43wHyQamCa6w0Wu1BuKHI5Y2tEEDRtzXvthrgIc/HffbTBjAo5RG74mKzZ0hnvaoBDEYqHXvPIlD v1RJAxD8Ew== ) gtm1.mdr.icann.org. 3600 IN AAAA 2620:0:2ed0:296::252 gtm1.mdr.icann.org. 3600 IN RRSIG ( AAAA 13 4 3600 20260609230037 20260520054459 21057 icann.org. GqqjTPsinEdOcaZ94WxB6OvIA+N1K8ExLhDfcHPfwbEG8b1W1JWj/k2PX9lb9RaI2TOSpQ4z0nFa 0hcin1BeOQ== ) ;; { "EDNS-VERSION": 0 }
	Query to ns.icann.org for vip.icann.org/DNSKEY
	Received 1025 bytes from 199.4.138.53
	;; Response received from [199.4.138.53] 1025 octets ;; HEADER SECTION ;; id = 20795 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 5 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; vip.icann.org. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (5 records) vip.icann.org. 3600 IN NS gtm1.dc.icann.org. vip.icann.org. 3600 IN NS gtm1.lax.icann.org. vip.icann.org. 3600 IN NS gtm1.mdr.icann.org. vip.icann.org. 3600 IN DS ( 6025 8 2 4daafdc62528cefc8c8f52b50d70d822115bd9c0f6662a6505603ef18401fe49 ) vip.icann.org. 3600 IN RRSIG ( DS 13 3 3600 20260608235329 20260519034456 21057 icann.org. ZL1IanjC+GLSCfdnSsisv/tW3m3QadG/jPYbSoo0y6oGZ+UwbUivqzmxcY+0XixMZkaphy4wC5KK kyHbhfc7jw== ) ;; ADDITIONAL SECTION (13 records) gtm1.dc.icann.org. 3600 IN A 192.0.47.252 gtm1.dc.icann.org. 3600 IN RRSIG ( A 13 4 3600 20260611085626 20260521074559 21057 icann.org. e5o7PCRLTdGXdcID5Kq1JWCE6jpFiDV68WaAeFxTQV6t1cG9GUplKnOGgHgfeCNHmaa1Ni5n7RXb RkuhZe29qA== ) gtm1.lax.icann.org. 3600 IN A 192.0.32.252 gtm1.lax.icann.org. 3600 IN RRSIG ( A 13 4 3600 20260610085836 20260520154459 21057 icann.org. npRxXnME5AkK0aucOvrfMgWPS9H+N3MeWmMf/gvuC0TvzGsrZIKXtpAa60b797e9zrdmIHWaunpl eq8Fdbp+vg== ) gtm1.mdr.icann.org. 3600 IN A 192.0.36.252 gtm1.mdr.icann.org. 3600 IN RRSIG ( A 13 4 3600 20260611062945 20260520234500 21057 icann.org. ESSq/G/XO+3QyENv2sweMXO4V0Tamas3rgEPksBd6o6BwzEDM6fsL3QRCLKHVqYa12YONdB0xP4z 5zWNx02Mkg== ) gtm1.dc.icann.org. 3600 IN AAAA 2620:0:2830:296::252 gtm1.dc.icann.org. 3600 IN RRSIG ( AAAA 13 4 3600 20260609185149 20260519074457 21057 icann.org. uSDKUIX/Gekgg0GTMf3/s65+C5HsyoYOL7gpRo08+UWPLt4L4JjzgrCywMNY4hHANzdRJP60UE85 OKJgWonvFA== ) gtm1.lax.icann.org. 3600 IN AAAA 2620:0:2d0:296::252 gtm1.lax.icann.org. 3600 IN RRSIG ( AAAA 13 4 3600 20260611101621 20260521114644 21057 icann.org. 43wHyQamCa6w0Wu1BuKHI5Y2tEEDRtzXvthrgIc/HffbTBjAo5RG74mKzZ0hnvaoBDEYqHXvPIlD v1RJAxD8Ew== ) gtm1.mdr.icann.org. 3600 IN AAAA 2620:0:2ed0:296::252 gtm1.mdr.icann.org. 3600 IN RRSIG ( AAAA 13 4 3600 20260609230037 20260520054459 21057 icann.org. GqqjTPsinEdOcaZ94WxB6OvIA+N1K8ExLhDfcHPfwbEG8b1W1JWj/k2PX9lb9RaI2TOSpQ4z0nFa 0hcin1BeOQ== ) ;; { "EDNS-VERSION": 0 }
	Found child zone vip.icann.org

vip.icann.org

	Checking DS between icann.org and vip.icann.org
	Query to b.icann-servers.net for vip.icann.org/DS
	Received 195 bytes from 199.43.133.53
	;; Response received from [199.43.133.53] 195 octets ;; HEADER SECTION ;; id = 56261 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; vip.icann.org. IN DS ;; ANSWER SECTION (2 records) vip.icann.org. 3600 IN DS ( 6025 8 2 4daafdc62528cefc8c8f52b50d70d822115bd9c0f6662a6505603ef18401fe49 ) vip.icann.org. 3600 IN RRSIG ( DS 13 3 3600 20260608235329 20260519034456 21057 icann.org. ZL1IanjC+GLSCfdnSsisv/tW3m3QadG/jPYbSoo0y6oGZ+UwbUivqzmxcY+0XixMZkaphy4wC5KK kyHbhfc7jw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for vip.icann.org in the icann.org zone
	DS=6025/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`vip.icann.org. 3600 IN RRSIG ( DS 13 3 3600 20260608235329 20260519034456 21057 icann.org. ZL1IanjC+GLSCfdnSsisv/tW3m3QadG/jPYbSoo0y6oGZ+UwbUivqzmxcY+0XixMZkaphy4wC5KK kyHbhfc7jw== )`
	RRSIG=21057 and DNSKEY=21057 verifies the DS RRset
	DS=6025/SHA-256 is now in the chain-of-trust
	`vip.icann.org. 3600 IN DS ( 6025 8 2 4daafdc62528cefc8c8f52b50d70d822115bd9c0f6662a6505603ef18401fe49 )`
	Query to gtm1.mdr.icann.org for vip.icann.org/DNSKEY
	Received 940 bytes from 192.0.36.252
	;; Response received from [192.0.36.252] 940 octets ;; HEADER SECTION ;; id = 26864 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; vip.icann.org. IN DNSKEY ;; ANSWER SECTION (4 records) vip.icann.org. 3600 IN DNSKEY ( 257 3 8 AwEAAa8hgHkq4/7LtCF+DQ71ZrBhMV1TLpMf8qV3uPkkBig73b5z88C+HovqSm300B0RLKVy8/Jy 5qjXh7GMTjkGyspIRbmUPVXwXxjuWlLWbeGXE7OzgT87mxXvRyWYdpclWp50eVvwkLXu5h8dKQU6 IKxKfBXiqcK4cVCZIDtMCx3wqERKCs83q5y0t0fVdl5ZH8yR4TEFgA0L4SROHbUO+je6XUgBUskO w2eTS1ukpeU6owa8zr+fpN0lpZahzjmZ9NpPda8Btn0HVhbghdU5Ykrt1v3IPn98v/MMtSXD2Bei JjWrsQPVS3CJ9WfD81j/bAYf1D5crMcuenrFcGBfgPk= ) ; keytag 6025 vip.icann.org. 3600 IN DNSKEY ( 256 3 8 AwEAAac9wSdTcGcGZnIhlTaXrRqL6ngI6FA/S1UTOiORntURavA3d+qeQl0vxpVjX9dIdoqDSCTI S+a+AJQ/zl9dr1hRTi/4xOljTSivkTGBeL+wlMWR+qHcUWHRfXY+1fo6YqzHaiBUfeU4UXjzs+zM wsEprfmi5obRj+83mPe0cpAl ) ; keytag 51426 vip.icann.org. 3600 IN RRSIG ( DNSKEY 8 3 3600 20260530161136 20260523151136 6025 vip.icann.org. CSYM4bV9ciQWpclhW9ToPs2c+ANI77bjYKycHVIOvrGfqVZ6f4vWcXps0nui5vDu/4BRL+GcNMAZ xc9ifg6Q+7jL+L6sXuKcC2Pk7WBAHDiTP0fuG8yuumnQoWx22/AFUkRwk0Q9dMlqivNkun6zG/Zp q9oJPDcwR58NDhRhX2dKuhFjhiPVdXc9pDj7DA0iWzJmQsRqXdMX7khVCM+qOp9VJKPJhvlo6U15 fCOml+JgEXhsUPP3wWpqdNmEDbJZ6RRaNJ2l2cqxS0QHzj9VgYscOjvhJectz+V0vMxM1jRHuQTr sVLF46egmd7uFj7rh3dxT15PREwJ8cw3yFERAA== ) vip.icann.org. 3600 IN RRSIG ( DNSKEY 8 3 3600 20260530161136 20260523151136 51426 vip.icann.org. WdWAHyIPcCKt6I7/Ymv6flXfYouCKxoc4Z9cpL/xJ0aw9oXM6KxLDkKK2DB2kqsYIE8IB19iFrd5 HTdFFXCEdm0WZODXOFOREpb0OmKos9EEY4G041nindPFr3jULNRHK2Tig3+BCJdLg5xeeDU3soZs P7t85ufYI7rlixMjfJY= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for vip.icann.org
	`vip.icann.org. 3600 IN DNSKEY ( 257 3 8 AwEAAa8hgHkq4/7LtCF+DQ71ZrBhMV1TLpMf8qV3uPkkBig73b5z88C+HovqSm300B0RLKVy8/Jy 5qjXh7GMTjkGyspIRbmUPVXwXxjuWlLWbeGXE7OzgT87mxXvRyWYdpclWp50eVvwkLXu5h8dKQU6 IKxKfBXiqcK4cVCZIDtMCx3wqERKCs83q5y0t0fVdl5ZH8yR4TEFgA0L4SROHbUO+je6XUgBUskO w2eTS1ukpeU6owa8zr+fpN0lpZahzjmZ9NpPda8Btn0HVhbghdU5Ykrt1v3IPn98v/MMtSXD2Bei JjWrsQPVS3CJ9WfD81j/bAYf1D5crMcuenrFcGBfgPk= ) ; keytag 6025`
	`vip.icann.org. 3600 IN DNSKEY ( 256 3 8 AwEAAac9wSdTcGcGZnIhlTaXrRqL6ngI6FA/S1UTOiORntURavA3d+qeQl0vxpVjX9dIdoqDSCTI S+a+AJQ/zl9dr1hRTi/4xOljTSivkTGBeL+wlMWR+qHcUWHRfXY+1fo6YqzHaiBUfeU4UXjzs+zM wsEprfmi5obRj+83mPe0cpAl ) ; keytag 51426`
	DNSKEY=6025/SEP is now in the chain-of-trust
	DS=6025/SHA-256 verifies DNSKEY=6025/SEP
	Found 2 RRSIGs over DNSKEY RRset
	`vip.icann.org. 3600 IN RRSIG ( DNSKEY 8 3 3600 20260530161136 20260523151136 6025 vip.icann.org. CSYM4bV9ciQWpclhW9ToPs2c+ANI77bjYKycHVIOvrGfqVZ6f4vWcXps0nui5vDu/4BRL+GcNMAZ xc9ifg6Q+7jL+L6sXuKcC2Pk7WBAHDiTP0fuG8yuumnQoWx22/AFUkRwk0Q9dMlqivNkun6zG/Zp q9oJPDcwR58NDhRhX2dKuhFjhiPVdXc9pDj7DA0iWzJmQsRqXdMX7khVCM+qOp9VJKPJhvlo6U15 fCOml+JgEXhsUPP3wWpqdNmEDbJZ6RRaNJ2l2cqxS0QHzj9VgYscOjvhJectz+V0vMxM1jRHuQTr sVLF46egmd7uFj7rh3dxT15PREwJ8cw3yFERAA== )`
	`vip.icann.org. 3600 IN RRSIG ( DNSKEY 8 3 3600 20260530161136 20260523151136 51426 vip.icann.org. WdWAHyIPcCKt6I7/Ymv6flXfYouCKxoc4Z9cpL/xJ0aw9oXM6KxLDkKK2DB2kqsYIE8IB19iFrd5 HTdFFXCEdm0WZODXOFOREpb0OmKos9EEY4G041nindPFr3jULNRHK2Tig3+BCJdLg5xeeDU3soZs P7t85ufYI7rlixMjfJY= )`
	RRSIG=6025 and DNSKEY=6025/SEP verifies the DNSKEY RRset
	RRSIG=51426 and DNSKEY=51426 verifies the DNSKEY RRset
	DNSKEY=51426 is now in the chain-of-trust
	Query to gtm1.mdr.icann.org for ianawww.vip.icann.org/A
	Received 239 bytes from 192.0.36.252
	;; Response received from [192.0.36.252] 239 octets ;; HEADER SECTION ;; id = 8551 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ianawww.vip.icann.org. IN A ;; ANSWER SECTION (2 records) ianawww.vip.icann.org. 30 IN A 192.0.46.8 ianawww.vip.icann.org. 30 IN RRSIG ( A 8 4 30 20260528161142 20260521151142 51426 vip.icann.org. ZBuIn/Bs+Zd477N4Zh/SucXOOfL6poY7CGRPrZ64Ytc6m5jhJ7MLAXjnSJkdvVPMBG82g5yjOZHu m7a9oXXrJY5lUtZOFH4fBy1RQqQxvCr+sgBxvzzXJ/S6jO+tgQUXPvNGTwgZx1DNPNDikui9eu1f MbvXSn0KjfMvqK/+7f0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	gtm1.mdr.icann.org is authoritative for ianawww.vip.icann.org
	Query to gtm1.dc.icann.org for ianawww.vip.icann.org/DNSKEY
	Received 539 bytes from 192.0.47.252
	;; Response received from [192.0.47.252] 539 octets ;; HEADER SECTION ;; id = 6487 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ianawww.vip.icann.org. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) vip.icann.org. 60 IN SOA ( gtm1.lax.icann.org. hostmaster.gtm1.lax.icann.org. 2026012001 ;serial 10800 ;refresh 3600 ;retry 604800 ;expire 60 ;minimum ) vip.icann.org. 60 IN RRSIG ( SOA 8 3 60 20260528161142 20260521151142 51426 vip.icann.org. ZCHSIvVGIKOYpIRqkbOlzdO7KXqh8y8G6IIo8a7uDibXuN1q0Mva/73vMv1Z6DBNQCLjJIdSUCGB Ipc+gQ5OCgeWHDPlcoKOXS07TkegjehE9/jUv5utKqQXmQbeeoqf35P+8iw3co/kNWX0kBZjq6H7 Tk/eU20qvR1bW/vuCPI= ) 03uash370b0je0lfi67o6mcena8rg2an.vip.icann.org. 60 IN NSEC3 ( 1 0 1 fba0fa017d0f7104 03uash370b0je0lfi67o6mcena8rg2ao A MX TXT AAAA RRSIG ) 03uash370b0je0lfi67o6mcena8rg2an.vip.icann.org. 60 IN RRSIG ( NSEC3 8 4 60 20260602040225 20260526030225 51426 vip.icann.org. aV5wB8+V1I0yGzKY/HHIjVvjL/oMGNBILcf8AF9CKKKil+uvo7aXHPagNt2bYWURE+IJ/P42ze7y 3xjYytsVhcbDU1pCqLVPBp7t9eFGBpsTS2k7Du1XQtbtK1rshzjL2ZEg+glx7iisdux4G1078/ie otLCybNlD2LMv1erA60= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found RRSIG signed by vip.icann.org zone
	Query to gtm1.lax.icann.org for vip.icann.org/SOA
	Received 503 bytes from 192.0.32.252
	;; Response received from [192.0.32.252] 503 octets ;; HEADER SECTION ;; id = 50249 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; vip.icann.org. IN SOA ;; ANSWER SECTION (2 records) vip.icann.org. 600 IN SOA ( gtm1.lax.icann.org. hostmaster.gtm1.lax.icann.org. 2026012001 ;serial 10800 ;refresh 3600 ;retry 604800 ;expire 60 ;minimum ) vip.icann.org. 600 IN RRSIG ( SOA 8 3 600 20260529194716 20260522184716 51426 vip.icann.org. C9XdOQAY/GSqp+XvB1nFmhI9wBwV5KJG3uphzuJfyJhhGivbkhuzYrXpie1u8Khi59oHJTFIQLkn SqxEzkmEvfz8NDMY+t9IxJRegVAHMwNhUL152Pwvd8dys3syuGrMyiIZaCXh9JLEypaysHxBW0WS c4iGRRYkgLwZWMuBBnM= ) ;; AUTHORITY SECTION (4 records) vip.icann.org. 600 IN NS gtm1.lax.icann.org. vip.icann.org. 600 IN NS gtm1.dc.icann.org. vip.icann.org. 600 IN NS gtm1.mdr.icann.org. vip.icann.org. 600 IN RRSIG ( NS 8 3 600 20260528161142 20260521151142 51426 vip.icann.org. eCCwKvpWTnCfujm8oDQ5ID6Q3Zybt8O6ZaFm2BilQAaJ4Zd5KUfRi5RPyaOsqK38hpBhOXMch7e6 P9FLumM9NF9Rx738qpiSuQj/7jM6t0f/XTntDJUy/QiRdRAgFmY0ynwNasOmihdFXkffBmxJsY6q P6udDgKWK+gfH6w8Nng= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to gtm1.dc.icann.org for vip.icann.org/SOA
	Received 503 bytes from 192.0.47.252
	;; Response received from [192.0.47.252] 503 octets ;; HEADER SECTION ;; id = 41050 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; vip.icann.org. IN SOA ;; ANSWER SECTION (2 records) vip.icann.org. 600 IN SOA ( gtm1.lax.icann.org. hostmaster.gtm1.lax.icann.org. 2026012001 ;serial 10800 ;refresh 3600 ;retry 604800 ;expire 60 ;minimum ) vip.icann.org. 600 IN RRSIG ( SOA 8 3 600 20260529024247 20260522014247 51426 vip.icann.org. VFG6Va3cZu85mJD7/UgDEPThYLI9wCwJayl+9J83kxP/+1NWteEyI14UioA+ytV4+xMWhPOpfUWb IiN7vlLCM7yD1cG5cFf7lMGl4MMCglsNbUeMXfQcJskVwQa76l6xwhXTpOCNbeS0t0deQPtalFOg cKzlmjDTuFdWMERgtiQ= ) ;; AUTHORITY SECTION (4 records) vip.icann.org. 600 IN NS gtm1.lax.icann.org. vip.icann.org. 600 IN NS gtm1.dc.icann.org. vip.icann.org. 600 IN NS gtm1.mdr.icann.org. vip.icann.org. 600 IN RRSIG ( NS 8 3 600 20260528161142 20260521151142 51426 vip.icann.org. eCCwKvpWTnCfujm8oDQ5ID6Q3Zybt8O6ZaFm2BilQAaJ4Zd5KUfRi5RPyaOsqK38hpBhOXMch7e6 P9FLumM9NF9Rx738qpiSuQj/7jM6t0f/XTntDJUy/QiRdRAgFmY0ynwNasOmihdFXkffBmxJsY6q P6udDgKWK+gfH6w8Nng= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to gtm1.mdr.icann.org for ianawww.vip.icann.org/A
	ianawww.vip.icann.org A RR has value 192.0.46.8
	Found 1 RRSIGs over A RRset
	`ianawww.vip.icann.org. 30 IN RRSIG ( A 8 4 30 20260528161142 20260521151142 51426 vip.icann.org. ZBuIn/Bs+Zd477N4Zh/SucXOOfL6poY7CGRPrZ64Ytc6m5jhJ7MLAXjnSJkdvVPMBG82g5yjOZHu m7a9oXXrJY5lUtZOFH4fBy1RQqQxvCr+sgBxvzzXJ/S6jO+tgQUXPvNGTwgZx1DNPNDikui9eu1f MbvXSn0KjfMvqK/+7f0= )`
	RRSIG=51426 and DNSKEY=51426 verifies the A RRset

vip.icann.org

	Query to gtm1.dc.icann.org for ianawww.vip.icann.org/A
	Received 239 bytes from 192.0.47.252
	;; Response received from [192.0.47.252] 239 octets ;; HEADER SECTION ;; id = 50300 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ianawww.vip.icann.org. IN A ;; ANSWER SECTION (2 records) ianawww.vip.icann.org. 30 IN A 192.0.46.8 ianawww.vip.icann.org. 30 IN RRSIG ( A 8 4 30 20260528161142 20260521151142 51426 vip.icann.org. ZBuIn/Bs+Zd477N4Zh/SucXOOfL6poY7CGRPrZ64Ytc6m5jhJ7MLAXjnSJkdvVPMBG82g5yjOZHu m7a9oXXrJY5lUtZOFH4fBy1RQqQxvCr+sgBxvzzXJ/S6jO+tgQUXPvNGTwgZx1DNPNDikui9eu1f MbvXSn0KjfMvqK/+7f0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	gtm1.dc.icann.org is authoritative for ianawww.vip.icann.org
	Query to gtm1.lax.icann.org for ianawww.vip.icann.org/DNSKEY
	Received 539 bytes from 192.0.32.252
	;; Response received from [192.0.32.252] 539 octets ;; HEADER SECTION ;; id = 46674 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ianawww.vip.icann.org. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) vip.icann.org. 60 IN SOA ( gtm1.lax.icann.org. hostmaster.gtm1.lax.icann.org. 2026012001 ;serial 10800 ;refresh 3600 ;retry 604800 ;expire 60 ;minimum ) vip.icann.org. 60 IN RRSIG ( SOA 8 3 60 20260528161143 20260521151143 51426 vip.icann.org. MKJrO+JEu1dkdmR9WbU38R408pvkoaZn5uRgyzrg/wj05pImILemyuV4SYKcxeoDVekvhF7xvizH BViw5qBCDo5CJFfvPFTwuznxd3D/379+8/BW5MfdGKQALQuSvRMj4DJOu/zOykr8zCzE8jrbyVl3 shqspV3FFCCQAqmCJ2o= ) bbqss7kdvmothv4sc0u95i9f757m542d.vip.icann.org. 60 IN NSEC3 ( 1 0 1 242097affc6a1f29 bbqss7kdvmothv4sc0u95i9f757m542e A MX TXT AAAA RRSIG ) bbqss7kdvmothv4sc0u95i9f757m542d.vip.icann.org. 60 IN RRSIG ( NSEC3 8 4 60 20260602021715 20260526011715 51426 vip.icann.org. J7TQH3PHHTve1GzrN8lPjEXpEVve8WZzWWiTStFYieQ3TNf+UTAy9/zyzJkUZRkI1KeXFrZvBicH 8L//6bESXpbTSOnj9qJhyxHkh3hr2oc0S4i36P97MZF9V2vyUBDlrUWw4pXZXMWOoIb6lhcz/tGq 0zCUoQp6ds+0OpwUyPw= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found RRSIG signed by vip.icann.org zone
	Query to gtm1.dc.icann.org for ianawww.vip.icann.org/A
	ianawww.vip.icann.org A RR has value 192.0.46.8
	Found 1 RRSIGs over A RRset
	`ianawww.vip.icann.org. 30 IN RRSIG ( A 8 4 30 20260528161142 20260521151142 51426 vip.icann.org. ZBuIn/Bs+Zd477N4Zh/SucXOOfL6poY7CGRPrZ64Ytc6m5jhJ7MLAXjnSJkdvVPMBG82g5yjOZHu m7a9oXXrJY5lUtZOFH4fBy1RQqQxvCr+sgBxvzzXJ/S6jO+tgQUXPvNGTwgZx1DNPNDikui9eu1f MbvXSn0KjfMvqK/+7f0= )`
	RRSIG=51426 and DNSKEY=51426 verifies the A RRset

vip.icann.org

	Query to gtm1.lax.icann.org for ianawww.vip.icann.org/A
	Received 239 bytes from 192.0.32.252
	;; Response received from [192.0.32.252] 239 octets ;; HEADER SECTION ;; id = 19704 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; ianawww.vip.icann.org. IN A ;; ANSWER SECTION (2 records) ianawww.vip.icann.org. 30 IN A 192.0.46.8 ianawww.vip.icann.org. 30 IN RRSIG ( A 8 4 30 20260528161142 20260521151142 51426 vip.icann.org. ZBuIn/Bs+Zd477N4Zh/SucXOOfL6poY7CGRPrZ64Ytc6m5jhJ7MLAXjnSJkdvVPMBG82g5yjOZHu m7a9oXXrJY5lUtZOFH4fBy1RQqQxvCr+sgBxvzzXJ/S6jO+tgQUXPvNGTwgZx1DNPNDikui9eu1f MbvXSn0KjfMvqK/+7f0= ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	gtm1.lax.icann.org is authoritative for ianawww.vip.icann.org
	Query to gtm1.lax.icann.org for ianawww.vip.icann.org/DNSKEY
	Found RRSIG signed by vip.icann.org zone
	Query to gtm1.lax.icann.org for ianawww.vip.icann.org/A
	ianawww.vip.icann.org A RR has value 192.0.46.8
	Found 1 RRSIGs over A RRset
	`ianawww.vip.icann.org. 30 IN RRSIG ( A 8 4 30 20260528161142 20260521151142 51426 vip.icann.org. ZBuIn/Bs+Zd477N4Zh/SucXOOfL6poY7CGRPrZ64Ytc6m5jhJ7MLAXjnSJkdvVPMBG82g5yjOZHu m7a9oXXrJY5lUtZOFH4fBy1RQqQxvCr+sgBxvzzXJ/S6jO+tgQUXPvNGTwgZx1DNPNDikui9eu1f MbvXSn0KjfMvqK/+7f0= )`
	RRSIG=51426 and DNSKEY=51426 verifies the A RRset

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test www.iana.org at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: