DNSSEC Debugger - www.usembassy.gov

Domain Name:

Time: 2025-07-03 05:35:21 UTC

Analyzing DNSSEC problems for www.usembassy.gov

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to h.root-servers.net for ./DNSKEY
	Received 1414 bytes from 198.97.190.53
	;; Response received from [198.97.190.53] 1414 octets ;; HEADER SECTION ;; id = 41269 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 5 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (5 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAbEbGCpGTDrcZTWqWWE72nphyshpRcILdzCVlBGU9Ln1Fui9kkseUOP+g5GLUeVFKdTloeRT A9+EYiQdXgWXmXmuW/nGxZjAikluF/O9NzLVrr5iZnth2xu+F48nrJlAgWWiMNau54NI5sZ3iVQf hFsq2pZmf43RauRPniYMShOLO7EBWWXr5glDSgZGS9fSm6xHwwF+g8D4m8oanjvdCBNxXzSEKS31 ibxjLifTfvwCg3y4XXcNW9U6Nu3JmoKUdxqpPPIkBvVQbIz4UO2FwaR13uXC03ALP1Yx2QNSS4SZ lcIMtAftQR9wtCiuPWQnFv4jkzWqlhp1Lmf7bcoL9yk= ) ; keytag 53148 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN DNSKEY ( 256 3 8 AwEAAbauxLSFZ+KSWi2cT6TJbm3d+GIVqb2N1XnDjMsRme0b6JlGp/cvwmM5CaJ5LQ7tG1r7LuTH jYZadtbNk2nZmclq9r4KInS48ungoAZb0gJXVw8IvBTBb1YWQmiBqD285pJuORwTii7DF++nNJJk 3i55HJt9SmBI7m7t8nvx7OOY/w0inxg3fLH2uY0SKO8he4FGwMc4Ubiab8N8Yhyhh+FkKKdD/+oA cuGF75PjlSXO460B4MlNLlEcjDEzIsKauRYx4YVgSaNomGhMMFblmXRzgW+1R6ywvm5mC9+omlyy izZp2GJfPwGMezuKSGDndO6CYYEc5/lsRhvBYsGjdPM= ) ; keytag 46441 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20250722000000 20250701000000 20326 . UGhOn2e0xbV2um4IqDwLtkXZVqk32Dz6Orahd8l3n5pQxAPO+PzC96lwt3YdDLFpzmu1FqPWugCK eq5uju1L2DklkEX7hnvBKKzb/Q2dkEA1w85dQQH34II778mePR3fvIDckntFXGsT9a8tdN9tFaP+ qJiwgtNbiKej8YheeX/DAAmZPn0s6/Bg3cLuozR9FXAwkgrA3rjcRpN/jKhPSauHvsin7gCbcUjs jA+P3l9y4Izc5ibPfdUIxVaTUt+OofHUV9VaZoexMQKwggIE78BLAs7AsP7KwlXDB8++Cy6IXVcg +9Gzv3k/gJokM3UHOGa0UrSfCIAKlfMFYADJBA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 4 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbEbGCpGTDrcZTWqWWE72nphyshpRcILdzCVlBGU9Ln1Fui9kkseUOP+g5GLUeVFKdTloeRT A9+EYiQdXgWXmXmuW/nGxZjAikluF/O9NzLVrr5iZnth2xu+F48nrJlAgWWiMNau54NI5sZ3iVQf hFsq2pZmf43RauRPniYMShOLO7EBWWXr5glDSgZGS9fSm6xHwwF+g8D4m8oanjvdCBNxXzSEKS31 ibxjLifTfvwCg3y4XXcNW9U6Nu3JmoKUdxqpPPIkBvVQbIz4UO2FwaR13uXC03ALP1Yx2QNSS4SZ lcIMtAftQR9wtCiuPWQnFv4jkzWqlhp1Lmf7bcoL9yk= ) ; keytag 53148`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbauxLSFZ+KSWi2cT6TJbm3d+GIVqb2N1XnDjMsRme0b6JlGp/cvwmM5CaJ5LQ7tG1r7LuTH jYZadtbNk2nZmclq9r4KInS48ungoAZb0gJXVw8IvBTBb1YWQmiBqD285pJuORwTii7DF++nNJJk 3i55HJt9SmBI7m7t8nvx7OOY/w0inxg3fLH2uY0SKO8he4FGwMc4Ubiab8N8Yhyhh+FkKKdD/+oA cuGF75PjlSXO460B4MlNLlEcjDEzIsKauRYx4YVgSaNomGhMMFblmXRzgW+1R6ywvm5mC9+omlyy izZp2GJfPwGMezuKSGDndO6CYYEc5/lsRhvBYsGjdPM= ) ; keytag 46441`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20250722000000 20250701000000 20326 . UGhOn2e0xbV2um4IqDwLtkXZVqk32Dz6Orahd8l3n5pQxAPO+PzC96lwt3YdDLFpzmu1FqPWugCK eq5uju1L2DklkEX7hnvBKKzb/Q2dkEA1w85dQQH34II778mePR3fvIDckntFXGsT9a8tdN9tFaP+ qJiwgtNbiKej8YheeX/DAAmZPn0s6/Bg3cLuozR9FXAwkgrA3rjcRpN/jKhPSauHvsin7gCbcUjs jA+P3l9y4Izc5ibPfdUIxVaTUt+OofHUV9VaZoexMQKwggIE78BLAs7AsP7KwlXDB8++Cy6IXVcg +9Gzv3k/gJokM3UHOGa0UrSfCIAKlfMFYADJBA== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=53148 is now in the chain-of-trust
	DNSKEY=38696/SEP is now in the chain-of-trust
	DNSKEY=46441 is now in the chain-of-trust
	Query to a.root-servers.net for www.usembassy.gov/A
	Received 624 bytes from 198.41.0.4
	;; Response received from [198.41.0.4] 624 octets ;; HEADER SECTION ;; id = 53046 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.usembassy.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20250715170000 20250702160000 46441 . IpARZe8MTs8tiRk0TnFrPW6Qi0iJU/LKNSzxrDM/ak/3YsAgfD8sdShZ6VGMK8zxUuDp8dIYrDhe lqHyI9b+q25+sx/0stxKsLfizJJatYSFyCBDZqVybsIJ47aD7nVuZBcrPkiKhticdvgvwlamBhOS cxVD1tqPUz9F8nMANkAyhOBxg4eRiJHcif1iD5w2g5uQI9UCGWLUk0Hok16cbNo5kxvV6BfbqTg+ ZwD9gDrN1m2hMP/l0jZzoLhekUWThXz3UOzzOJcXf1H4czdtHAf5Gpcwn+PWtvAL6fDqgZwb9R8X VZArUa8jxFKxEfYTSfbV7QgEZ27dJqjuj1aI+g== ) ;; ADDITIONAL SECTION (9 records) c.ns.gov. 172800 IN A 199.33.232.1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 a.ns.gov. 172800 IN A 199.33.230.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 d.ns.gov. 172800 IN A 199.33.233.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 b.ns.gov. 172800 IN A 199.33.231.1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 ;; { "EDNS-VERSION": 0 }
	Query to j.root-servers.net for gov/DNSKEY
	Received 610 bytes from 192.58.128.30
	;; Response received from [192.58.128.30] 610 octets ;; HEADER SECTION ;; id = 49677 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20250715170000 20250702160000 46441 . IpARZe8MTs8tiRk0TnFrPW6Qi0iJU/LKNSzxrDM/ak/3YsAgfD8sdShZ6VGMK8zxUuDp8dIYrDhe lqHyI9b+q25+sx/0stxKsLfizJJatYSFyCBDZqVybsIJ47aD7nVuZBcrPkiKhticdvgvwlamBhOS cxVD1tqPUz9F8nMANkAyhOBxg4eRiJHcif1iD5w2g5uQI9UCGWLUk0Hok16cbNo5kxvV6BfbqTg+ ZwD9gDrN1m2hMP/l0jZzoLhekUWThXz3UOzzOJcXf1H4czdtHAf5Gpcwn+PWtvAL6fDqgZwb9R8X VZArUa8jxFKxEfYTSfbV7QgEZ27dJqjuj1aI+g== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 b.ns.gov. 172800 IN A 199.33.231.1 c.ns.gov. 172800 IN A 199.33.232.1 d.ns.gov. 172800 IN A 199.33.233.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Found child zone gov

gov

	Checking DS between . and gov
	Query to g.root-servers.net for gov/DS
	Received 367 bytes from 192.112.36.4
	;; Response received from [192.112.36.4] 367 octets ;; HEADER SECTION ;; id = 17387 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20250715170000 20250702160000 46441 . IpARZe8MTs8tiRk0TnFrPW6Qi0iJU/LKNSzxrDM/ak/3YsAgfD8sdShZ6VGMK8zxUuDp8dIYrDhe lqHyI9b+q25+sx/0stxKsLfizJJatYSFyCBDZqVybsIJ47aD7nVuZBcrPkiKhticdvgvwlamBhOS cxVD1tqPUz9F8nMANkAyhOBxg4eRiJHcif1iD5w2g5uQI9UCGWLUk0Hok16cbNo5kxvV6BfbqTg+ ZwD9gDrN1m2hMP/l0jZzoLhekUWThXz3UOzzOJcXf1H4czdtHAf5Gpcwn+PWtvAL6fDqgZwb9R8X VZArUa8jxFKxEfYTSfbV7QgEZ27dJqjuj1aI+g== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for gov in the . zone
	DS=2536/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20250715170000 20250702160000 46441 . IpARZe8MTs8tiRk0TnFrPW6Qi0iJU/LKNSzxrDM/ak/3YsAgfD8sdShZ6VGMK8zxUuDp8dIYrDhe lqHyI9b+q25+sx/0stxKsLfizJJatYSFyCBDZqVybsIJ47aD7nVuZBcrPkiKhticdvgvwlamBhOS cxVD1tqPUz9F8nMANkAyhOBxg4eRiJHcif1iD5w2g5uQI9UCGWLUk0Hok16cbNo5kxvV6BfbqTg+ ZwD9gDrN1m2hMP/l0jZzoLhekUWThXz3UOzzOJcXf1H4czdtHAf5Gpcwn+PWtvAL6fDqgZwb9R8X VZArUa8jxFKxEfYTSfbV7QgEZ27dJqjuj1aI+g== )`
	RRSIG=46441 and DNSKEY=46441 verifies the DS RRset
	DS=2536/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 )`
	Query to d.ns.gov for gov/DNSKEY
	Received 291 bytes from 199.33.233.1
	;; Response received from [199.33.233.1] 291 octets ;; HEADER SECTION ;; id = 23279 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536 gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496 gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20250821110604 20250621110604 2536 gov. n6svyrR3H3gY3Fie3fgekD6gXenvEpExK1GXpXb0NxWZW3AHyD02jwlrZecgESKHXU9ydtsw6ibM Y9FOlT+89A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for gov
	`gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536`
	`gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496`
	DNSKEY=2536/SEP is now in the chain-of-trust
	DS=2536/SHA-256 verifies DNSKEY=2536/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20250821110604 20250621110604 2536 gov. n6svyrR3H3gY3Fie3fgekD6gXenvEpExK1GXpXb0NxWZW3AHyD02jwlrZecgESKHXU9ydtsw6ibM Y9FOlT+89A== )`
	RRSIG=2536 and DNSKEY=2536/SEP verifies the DNSKEY RRset
	DNSKEY=35496 is now in the chain-of-trust
	Query to a.ns.gov for www.usembassy.gov/A
	Received 371 bytes from 199.33.230.1
	;; Response received from [199.33.230.1] 371 octets ;; HEADER SECTION ;; id = 40002 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 9 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.usembassy.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) usembassy.gov. 10800 IN NS a1-63.akam.net. usembassy.gov. 10800 IN NS a14-64.akam.net. usembassy.gov. 10800 IN NS a26-65.akam.net. usembassy.gov. 10800 IN NS a3-66.akam.net. usembassy.gov. 10800 IN NS a8-67.akam.net. usembassy.gov. 10800 IN NS a9-64.akam.net. usembassy.gov. 3600 IN DS ( 2524 8 2 19e43944425f867e6c8702a6871ab589eb2867836cf8ecad08176eafba7b1e88 ) usembassy.gov. 3600 IN DS ( 39784 8 2 70d37f4f71554d6c046456d43104628cf0a65d71357660f01b6f4b04dce88869 ) usembassy.gov. 3600 IN RRSIG ( DS 13 2 3600 20250704063521 20250702043521 35496 gov. xxTaMjYrss0fCu38BtHiITgh+EH2R468TaL1LGHc8g4InO6W7l2SyVUvc7Fpu63m8xm6BjIh+7/1 7XC3BH9quQ== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to b.ns.gov for usembassy.gov/DNSKEY
	Received 367 bytes from 199.33.231.1
	;; Response received from [199.33.231.1] 367 octets ;; HEADER SECTION ;; id = 53896 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 9 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; usembassy.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) usembassy.gov. 10800 IN NS a1-63.akam.net. usembassy.gov. 10800 IN NS a14-64.akam.net. usembassy.gov. 10800 IN NS a26-65.akam.net. usembassy.gov. 10800 IN NS a3-66.akam.net. usembassy.gov. 10800 IN NS a8-67.akam.net. usembassy.gov. 10800 IN NS a9-64.akam.net. usembassy.gov. 3600 IN DS ( 2524 8 2 19e43944425f867e6c8702a6871ab589eb2867836cf8ecad08176eafba7b1e88 ) usembassy.gov. 3600 IN DS ( 39784 8 2 70d37f4f71554d6c046456d43104628cf0a65d71357660f01b6f4b04dce88869 ) usembassy.gov. 3600 IN RRSIG ( DS 13 2 3600 20250704063521 20250702043521 35496 gov. HCX3wtWSij6xz8AFaf6RnrNsTs90kZ3agaSSUwmQDr1XMJJ1qmEjlM775mBWS4hG/IaZ1OBD3DrP eJGLkwVTZQ== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone usembassy.gov

usembassy.gov

	Checking DS between gov and usembassy.gov
	Query to d.ns.gov for usembassy.gov/DS
	Received 237 bytes from 199.33.233.1
	;; Response received from [199.33.233.1] 237 octets ;; HEADER SECTION ;; id = 37561 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; usembassy.gov. IN DS ;; ANSWER SECTION (3 records) usembassy.gov. 3600 IN DS ( 2524 8 2 19e43944425f867e6c8702a6871ab589eb2867836cf8ecad08176eafba7b1e88 ) usembassy.gov. 3600 IN DS ( 39784 8 2 70d37f4f71554d6c046456d43104628cf0a65d71357660f01b6f4b04dce88869 ) usembassy.gov. 3600 IN RRSIG ( DS 13 2 3600 20250704063521 20250702043521 35496 gov. dya9gURI2cf3u3SFgACrHnFdeicVxEtIJNI54UWjeymPSBgY/307WlQDwMz6LpzO4o7babeIPR66 JCk7pbBimA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DS records for usembassy.gov in the gov zone
	DS=2524/SHA-256 has algorithm RSASHA256
	DS=39784/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`usembassy.gov. 3600 IN RRSIG ( DS 13 2 3600 20250704063521 20250702043521 35496 gov. dya9gURI2cf3u3SFgACrHnFdeicVxEtIJNI54UWjeymPSBgY/307WlQDwMz6LpzO4o7babeIPR66 JCk7pbBimA== )`
	RRSIG=35496 and DNSKEY=35496 verifies the DS RRset
	DS=2524/SHA-256 is now in the chain-of-trust
	DS=39784/SHA-256 is now in the chain-of-trust
	`usembassy.gov. 3600 IN DS ( 2524 8 2 19e43944425f867e6c8702a6871ab589eb2867836cf8ecad08176eafba7b1e88 )`
	`usembassy.gov. 3600 IN DS ( 39784 8 2 70d37f4f71554d6c046456d43104628cf0a65d71357660f01b6f4b04dce88869 )`
	Query to a14-64.akam.net for usembassy.gov/DNSKEY
	Received 1472 bytes from 184.26.161.64
	;; Response received from [184.26.161.64] 1472 octets ;; HEADER SECTION ;; id = 54081 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 5 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; usembassy.gov. IN DNSKEY ;; ANSWER SECTION (5 records) usembassy.gov. 15768000 IN DNSKEY ( 256 3 8 AwEAAdJd4r8OBqJZM1Vcu5mIuX9/Sf0a5zQMK5DboM0Y4yt49pRYRsc5/yFdKyT9Lm/wso754Z+5 6zVvXmYlck6S82+dgrYufogcZ/KYnEzQlWCo6SWfIVusCoq4dCNmA/86g4/7ezgFDOx+CuMXTlKw u8QtnveD2vwdRZnIPxXfzI//m1SO5PdknVFufsFp+oJIkjv6+6i2VeZkXlHSpZiR3tju0qswoh4U R1IyUtjBLx+S92GEfjvUpd1QPpdoFMENoknGyfu24aOpGymyNaf8Y3aGW5JSdfbQKiuUvr9uSZvq NAEljW6ynu7zuxpfXxk8ZNI0sWpKYHFKX4oq22vu+Ok= ) ; keytag 8979 usembassy.gov. 15768000 IN DNSKEY ( 256 3 8 AwEAAbcn2WxWAiBr8CG5XYfxjY+kVMUCF2ZqpO/xNNAuCu6bUJoaUNlHDt+C4wfnky3A3fIc/eb5 XptkC4RDoBNzujn6obyapzxLVVG/wnF2yzvke7oEKS4S6p/lR5QlSAiIWaLRNd3dDOZ6Ba3s4TdX rmjkt//htqfTMJ0s4CTI2ome6UsDtpO7uLFZkycqxb6oHQhJ8/oUkmrM58uSDNN00qExnly/XPkm G2b0GEUfN3DVElh9TAFZM4qakOHGPmlo7TEX5Hxz41LH2qGE1KeqfZye2JttDdhh9Q5j2QwtYGaM 5Dbl3+X2k1j8huLJtU9brMhYRTkAPKNAEsMghDhaKB0= ) ; keytag 40611 usembassy.gov. 15768000 IN DNSKEY ( 257 3 8 AwEAAbPiGr3SJ0TR1RDI+llg6ZYG2eJ7zNgQOykJeG+fbUtNFMSL1OwYMS6FyByQlSjC3R0SXLAE ASuLbxG6d5l3xSCVLUg35YbX6VPJbzonr+Yi44KXUb2AbP59pf0HZSpjl+XqKl0Pdg6hpHEThyr5 X7zAeTSfVPzMQky+xM/L6k0hg92zo8OQaOiHYIt2MWlXI3I8qqcGudkDaZfEnpG+5znvmVrEomKg B6cb41tW6rejKPNSBesmUWSjLYmNYLM0OpDWxpj+nMkdXpzs3dPJ6JW723BqWWv70PJyKCxjaW0t ioxygBsOS3019OdSlpCq/VyQYbc7CoPLCJxAufKaqBs= ) ; keytag 2524 usembassy.gov. 15768000 IN RRSIG ( DNSKEY 8 2 15768000 20260522111508 20250522101508 2524 usembassy.gov. ZCKMJ0SLYG0mB0/0zQt2zp0xepGZnQ6zJn1iUbtgV011QkNkfDzyA/R7y5BjNJeUjJnwn2KjMjpk 6aBSnEbAAD24+/mKvN7+5syZQU95HgcbeAuN9Qm/0yokzJBCrebJk7MsI29j0rRwelZQVw7V3S/C /0EXMl5LS4JZJNW3VFntCVdgcWgdfOz6naE3TuAk9f2qlUvBZsnPTl0sJNqepfc9xo68RU9hv58P 7yWKd/pwUTJ2pRfUXudh9AqHbOv5zGxzPo+PWMGZNOe3N2kDYvxPRYbvoudRmqF81OwUf26p5cnD so2ham1NfHSJ0VwyEvWYKMWXkzxkJDSPujZ5hQ== ) usembassy.gov. 15768000 IN RRSIG ( DNSKEY 8 2 15768000 20260522111508 20250522101508 8979 usembassy.gov. rFHlukrXiKAwtBIq3qzLuWNFIq7nfT2Bsta2oIxxmz0lydPXuG2PstfRKuuEPLFXTCcm2qL1AA03 5iD+plu8gvXtu5fH9/ppniddt2UtcoIlex2dNEJp0TD0KtRwQRgSj6tCB2POpJ31Ruqfo7yaOqCr gUzQM1vMuLm/nlkyth5EZs0UISWSyY/N5fMQyAj9nvaTMB7SF+jKMq0tEtYMw7urL2H5vC1Vsm0L 7Z88dDL6oXGRs1SaDRS6tJdFpHT9p4NQ9RKiqqCv6P9h+It7ZoKfWOgLcztEdVM/kkmqbdBaKWBW Dt03B7JTejIujRTQAMD0Ayc6Hy5dT/yEMy9qdQ== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for usembassy.gov
	`usembassy.gov. 15768000 IN DNSKEY ( 256 3 8 AwEAAdJd4r8OBqJZM1Vcu5mIuX9/Sf0a5zQMK5DboM0Y4yt49pRYRsc5/yFdKyT9Lm/wso754Z+5 6zVvXmYlck6S82+dgrYufogcZ/KYnEzQlWCo6SWfIVusCoq4dCNmA/86g4/7ezgFDOx+CuMXTlKw u8QtnveD2vwdRZnIPxXfzI//m1SO5PdknVFufsFp+oJIkjv6+6i2VeZkXlHSpZiR3tju0qswoh4U R1IyUtjBLx+S92GEfjvUpd1QPpdoFMENoknGyfu24aOpGymyNaf8Y3aGW5JSdfbQKiuUvr9uSZvq NAEljW6ynu7zuxpfXxk8ZNI0sWpKYHFKX4oq22vu+Ok= ) ; keytag 8979`
	`usembassy.gov. 15768000 IN DNSKEY ( 256 3 8 AwEAAbcn2WxWAiBr8CG5XYfxjY+kVMUCF2ZqpO/xNNAuCu6bUJoaUNlHDt+C4wfnky3A3fIc/eb5 XptkC4RDoBNzujn6obyapzxLVVG/wnF2yzvke7oEKS4S6p/lR5QlSAiIWaLRNd3dDOZ6Ba3s4TdX rmjkt//htqfTMJ0s4CTI2ome6UsDtpO7uLFZkycqxb6oHQhJ8/oUkmrM58uSDNN00qExnly/XPkm G2b0GEUfN3DVElh9TAFZM4qakOHGPmlo7TEX5Hxz41LH2qGE1KeqfZye2JttDdhh9Q5j2QwtYGaM 5Dbl3+X2k1j8huLJtU9brMhYRTkAPKNAEsMghDhaKB0= ) ; keytag 40611`
	`usembassy.gov. 15768000 IN DNSKEY ( 257 3 8 AwEAAbPiGr3SJ0TR1RDI+llg6ZYG2eJ7zNgQOykJeG+fbUtNFMSL1OwYMS6FyByQlSjC3R0SXLAE ASuLbxG6d5l3xSCVLUg35YbX6VPJbzonr+Yi44KXUb2AbP59pf0HZSpjl+XqKl0Pdg6hpHEThyr5 X7zAeTSfVPzMQky+xM/L6k0hg92zo8OQaOiHYIt2MWlXI3I8qqcGudkDaZfEnpG+5znvmVrEomKg B6cb41tW6rejKPNSBesmUWSjLYmNYLM0OpDWxpj+nMkdXpzs3dPJ6JW723BqWWv70PJyKCxjaW0t ioxygBsOS3019OdSlpCq/VyQYbc7CoPLCJxAufKaqBs= ) ; keytag 2524`
	DNSKEY=2524/SEP is now in the chain-of-trust
	DS=2524/SHA-256 verifies DNSKEY=2524/SEP
	DS=39784/SHA-256 is published, but a corresponding DNSKEY is not
	Found 2 RRSIGs over DNSKEY RRset
	`usembassy.gov. 15768000 IN RRSIG ( DNSKEY 8 2 15768000 20260522111508 20250522101508 2524 usembassy.gov. ZCKMJ0SLYG0mB0/0zQt2zp0xepGZnQ6zJn1iUbtgV011QkNkfDzyA/R7y5BjNJeUjJnwn2KjMjpk 6aBSnEbAAD24+/mKvN7+5syZQU95HgcbeAuN9Qm/0yokzJBCrebJk7MsI29j0rRwelZQVw7V3S/C /0EXMl5LS4JZJNW3VFntCVdgcWgdfOz6naE3TuAk9f2qlUvBZsnPTl0sJNqepfc9xo68RU9hv58P 7yWKd/pwUTJ2pRfUXudh9AqHbOv5zGxzPo+PWMGZNOe3N2kDYvxPRYbvoudRmqF81OwUf26p5cnD so2ham1NfHSJ0VwyEvWYKMWXkzxkJDSPujZ5hQ== )`
	`usembassy.gov. 15768000 IN RRSIG ( DNSKEY 8 2 15768000 20260522111508 20250522101508 8979 usembassy.gov. rFHlukrXiKAwtBIq3qzLuWNFIq7nfT2Bsta2oIxxmz0lydPXuG2PstfRKuuEPLFXTCcm2qL1AA03 5iD+plu8gvXtu5fH9/ppniddt2UtcoIlex2dNEJp0TD0KtRwQRgSj6tCB2POpJ31Ruqfo7yaOqCr gUzQM1vMuLm/nlkyth5EZs0UISWSyY/N5fMQyAj9nvaTMB7SF+jKMq0tEtYMw7urL2H5vC1Vsm0L 7Z88dDL6oXGRs1SaDRS6tJdFpHT9p4NQ9RKiqqCv6P9h+It7ZoKfWOgLcztEdVM/kkmqbdBaKWBW Dt03B7JTejIujRTQAMD0Ayc6Hy5dT/yEMy9qdQ== )`
	RRSIG=2524 and DNSKEY=2524/SEP verifies the DNSKEY RRset
	RRSIG=8979 and DNSKEY=8979 verifies the DNSKEY RRset
	DNSKEY=8979 is now in the chain-of-trust
	DNSKEY=40611 is now in the chain-of-trust
	Query to a14-64.akam.net for www.usembassy.gov/A
	Received 390 bytes from 184.26.161.64
	;; Response received from [184.26.161.64] 390 octets ;; HEADER SECTION ;; id = 16604 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.usembassy.gov. IN A ;; ANSWER SECTION (2 records) www.usembassy.gov. 10800 IN CNAME d1oj4yrmnvvraf.cloudfront.net. www.usembassy.gov. 10800 IN RRSIG ( CNAME 8 3 10800 20260523205419 20250523205320 8979 usembassy.gov. MYD0/RJY0zBFcy/QPrk6pchuQSeuh0ly+aAa+xPVknRfLR/whP8T6teDekjvQ2N6nHXe6EYjds7y BWp1A71gIm5cP0SeeJ5nfvpPmy06Gcn6DaF8XUAVZsQZpaDbeqsKmS8kL85MN9P4WiJTI5lexxUe BNDqCZTgVLg5yBCN1kK1TKQKZ400fmvrChjGBuAMV4vqlOHFBz8pQqeG4HFjvE817bW9MR1j5LsI 3BDJiEZEO1NbX56iLp/hzdM1g82ETKo5UvbgPqKOEtAyixr2Mz2fXllHPcEDH9gkKAY1N11uvFvW hSrI2R+92mUx586+TvmSVEucUDMKYh6fgJfVJw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a14-64.akam.net is authoritative for www.usembassy.gov
	Query to a9-64.akam.net for www.usembassy.gov/DNSKEY
	Received 390 bytes from 184.85.248.64
	;; Response received from [184.85.248.64] 390 octets ;; HEADER SECTION ;; id = 6144 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.usembassy.gov. IN DNSKEY ;; ANSWER SECTION (2 records) www.usembassy.gov. 10800 IN CNAME d1oj4yrmnvvraf.cloudfront.net. www.usembassy.gov. 10800 IN RRSIG ( CNAME 8 3 10800 20260523205419 20250523205320 8979 usembassy.gov. MYD0/RJY0zBFcy/QPrk6pchuQSeuh0ly+aAa+xPVknRfLR/whP8T6teDekjvQ2N6nHXe6EYjds7y BWp1A71gIm5cP0SeeJ5nfvpPmy06Gcn6DaF8XUAVZsQZpaDbeqsKmS8kL85MN9P4WiJTI5lexxUe BNDqCZTgVLg5yBCN1kK1TKQKZ400fmvrChjGBuAMV4vqlOHFBz8pQqeG4HFjvE817bW9MR1j5LsI 3BDJiEZEO1NbX56iLp/hzdM1g82ETKo5UvbgPqKOEtAyixr2Mz2fXllHPcEDH9gkKAY1N11uvFvW hSrI2R+92mUx586+TvmSVEucUDMKYh6fgJfVJw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found RRSIG signed by usembassy.gov zone
	www.usembassy.gov is a CNAME to d1oj4yrmnvvraf.cloudfront.net
	Found 1 RRSIGs over CNAME RRset
	`www.usembassy.gov. 10800 IN RRSIG ( CNAME 8 3 10800 20260523205419 20250523205320 8979 usembassy.gov. MYD0/RJY0zBFcy/QPrk6pchuQSeuh0ly+aAa+xPVknRfLR/whP8T6teDekjvQ2N6nHXe6EYjds7y BWp1A71gIm5cP0SeeJ5nfvpPmy06Gcn6DaF8XUAVZsQZpaDbeqsKmS8kL85MN9P4WiJTI5lexxUe BNDqCZTgVLg5yBCN1kK1TKQKZ400fmvrChjGBuAMV4vqlOHFBz8pQqeG4HFjvE817bW9MR1j5LsI 3BDJiEZEO1NbX56iLp/hzdM1g82ETKo5UvbgPqKOEtAyixr2Mz2fXllHPcEDH9gkKAY1N11uvFvW hSrI2R+92mUx586+TvmSVEucUDMKYh6fgJfVJw== )`
	RRSIG=8979 and DNSKEY=8979 verifies the CNAME RRset

	Query to m.root-servers.net for d1oj4yrmnvvraf.cloudfront.net/A
	Received 1192 bytes from 202.12.27.33
	;; Response received from [202.12.27.33] 1192 octets ;; HEADER SECTION ;; id = 49131 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 15 arcount = 27 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) net. 172800 IN NS c.gtld-servers.net. net. 172800 IN NS d.gtld-servers.net. net. 172800 IN NS a.gtld-servers.net. net. 172800 IN NS f.gtld-servers.net. net. 172800 IN NS g.gtld-servers.net. net. 172800 IN NS l.gtld-servers.net. net. 172800 IN NS k.gtld-servers.net. net. 172800 IN NS j.gtld-servers.net. net. 172800 IN NS e.gtld-servers.net. net. 172800 IN NS b.gtld-servers.net. net. 172800 IN NS m.gtld-servers.net. net. 172800 IN NS h.gtld-servers.net. net. 172800 IN NS i.gtld-servers.net. net. 86400 IN DS ( 37331 13 2 2f0bec2d6f79dfbd1d08fd21a3af92d0e39a4b9ef1e3f4111fff282490da453b ) net. 86400 IN RRSIG ( DS 8 1 86400 20250715170000 20250702160000 46441 . CJgu+yIIdusLYk7R6UYDX7v68zQlVvE9YvBeGy2DbRFLyPUCgiiNSASA5ZMawTc3vI0GvmHfzFt2 wu0QdjvvgZa1aKzB3fNy7HkGSFk3EV5rlR/oWGHzUx6rPVp40iGoRTXK9gDoNJSI5eoF4MiviC/8 oCsHb8PkoWeUOsgsU7VMphnXWoKElifKGyepMkHSbjESmssFWh4h0Hrc7/yuLIymAh3so6DhEBJP 0iTc3l7J/FILrVY9RHgQV3A3SbRMPOFCNkF5yjD19InRsrtq0YfHwo5bgVcnM/20IGergYnMH9+o uU0bpk9P+y5/YBhRQuqowBaW7P3D0pEroCU/8g== ) ;; ADDITIONAL SECTION (27 records) m.gtld-servers.net. 172800 IN A 192.55.83.30 l.gtld-servers.net. 172800 IN A 192.41.162.30 k.gtld-servers.net. 172800 IN A 192.52.178.30 j.gtld-servers.net. 172800 IN A 192.48.79.30 i.gtld-servers.net. 172800 IN A 192.43.172.30 h.gtld-servers.net. 172800 IN A 192.54.112.30 g.gtld-servers.net. 172800 IN A 192.42.93.30 f.gtld-servers.net. 172800 IN A 192.35.51.30 e.gtld-servers.net. 172800 IN A 192.12.94.30 d.gtld-servers.net. 172800 IN A 192.31.80.30 c.gtld-servers.net. 172800 IN A 192.26.92.30 b.gtld-servers.net. 172800 IN A 192.33.14.30 a.gtld-servers.net. 172800 IN A 192.5.6.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 ;; { "EDNS-VERSION": 0 }
	Query to c.root-servers.net for net/DNSKEY
	Received 1163 bytes from 192.33.4.12
	;; Response received from [192.33.4.12] 1163 octets ;; HEADER SECTION ;; id = 3584 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 15 arcount = 27 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) net. 172800 IN NS c.gtld-servers.net. net. 172800 IN NS k.gtld-servers.net. net. 172800 IN NS i.gtld-servers.net. net. 172800 IN NS g.gtld-servers.net. net. 172800 IN NS e.gtld-servers.net. net. 172800 IN NS b.gtld-servers.net. net. 172800 IN NS j.gtld-servers.net. net. 172800 IN NS f.gtld-servers.net. net. 172800 IN NS l.gtld-servers.net. net. 172800 IN NS h.gtld-servers.net. net. 172800 IN NS d.gtld-servers.net. net. 172800 IN NS m.gtld-servers.net. net. 172800 IN NS a.gtld-servers.net. net. 86400 IN DS ( 37331 13 2 2f0bec2d6f79dfbd1d08fd21a3af92d0e39a4b9ef1e3f4111fff282490da453b ) net. 86400 IN RRSIG ( DS 8 1 86400 20250715170000 20250702160000 46441 . CJgu+yIIdusLYk7R6UYDX7v68zQlVvE9YvBeGy2DbRFLyPUCgiiNSASA5ZMawTc3vI0GvmHfzFt2 wu0QdjvvgZa1aKzB3fNy7HkGSFk3EV5rlR/oWGHzUx6rPVp40iGoRTXK9gDoNJSI5eoF4MiviC/8 oCsHb8PkoWeUOsgsU7VMphnXWoKElifKGyepMkHSbjESmssFWh4h0Hrc7/yuLIymAh3so6DhEBJP 0iTc3l7J/FILrVY9RHgQV3A3SbRMPOFCNkF5yjD19InRsrtq0YfHwo5bgVcnM/20IGergYnMH9+o uU0bpk9P+y5/YBhRQuqowBaW7P3D0pEroCU/8g== ) ;; ADDITIONAL SECTION (27 records) m.gtld-servers.net. 172800 IN A 192.55.83.30 l.gtld-servers.net. 172800 IN A 192.41.162.30 k.gtld-servers.net. 172800 IN A 192.52.178.30 j.gtld-servers.net. 172800 IN A 192.48.79.30 i.gtld-servers.net. 172800 IN A 192.43.172.30 h.gtld-servers.net. 172800 IN A 192.54.112.30 g.gtld-servers.net. 172800 IN A 192.42.93.30 f.gtld-servers.net. 172800 IN A 192.35.51.30 e.gtld-servers.net. 172800 IN A 192.12.94.30 d.gtld-servers.net. 172800 IN A 192.31.80.30 c.gtld-servers.net. 172800 IN A 192.26.92.30 b.gtld-servers.net. 172800 IN A 192.33.14.30 a.gtld-servers.net. 172800 IN A 192.5.6.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 ;; { "EDNS-VERSION": 0 }
	Found child zone net

net

	Checking DS between . and net
	Query to e.root-servers.net for net/DS
	Received 367 bytes from 192.203.230.10
	;; Response received from [192.203.230.10] 367 octets ;; HEADER SECTION ;; id = 9495 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; net. IN DS ;; ANSWER SECTION (2 records) net. 86400 IN DS ( 37331 13 2 2f0bec2d6f79dfbd1d08fd21a3af92d0e39a4b9ef1e3f4111fff282490da453b ) net. 86400 IN RRSIG ( DS 8 1 86400 20250715170000 20250702160000 46441 . CJgu+yIIdusLYk7R6UYDX7v68zQlVvE9YvBeGy2DbRFLyPUCgiiNSASA5ZMawTc3vI0GvmHfzFt2 wu0QdjvvgZa1aKzB3fNy7HkGSFk3EV5rlR/oWGHzUx6rPVp40iGoRTXK9gDoNJSI5eoF4MiviC/8 oCsHb8PkoWeUOsgsU7VMphnXWoKElifKGyepMkHSbjESmssFWh4h0Hrc7/yuLIymAh3so6DhEBJP 0iTc3l7J/FILrVY9RHgQV3A3SbRMPOFCNkF5yjD19InRsrtq0YfHwo5bgVcnM/20IGergYnMH9+o uU0bpk9P+y5/YBhRQuqowBaW7P3D0pEroCU/8g== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for net in the . zone
	DS=37331/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`net. 86400 IN RRSIG ( DS 8 1 86400 20250715170000 20250702160000 46441 . CJgu+yIIdusLYk7R6UYDX7v68zQlVvE9YvBeGy2DbRFLyPUCgiiNSASA5ZMawTc3vI0GvmHfzFt2 wu0QdjvvgZa1aKzB3fNy7HkGSFk3EV5rlR/oWGHzUx6rPVp40iGoRTXK9gDoNJSI5eoF4MiviC/8 oCsHb8PkoWeUOsgsU7VMphnXWoKElifKGyepMkHSbjESmssFWh4h0Hrc7/yuLIymAh3so6DhEBJP 0iTc3l7J/FILrVY9RHgQV3A3SbRMPOFCNkF5yjD19InRsrtq0YfHwo5bgVcnM/20IGergYnMH9+o uU0bpk9P+y5/YBhRQuqowBaW7P3D0pEroCU/8g== )`
	RRSIG=46441 and DNSKEY=46441 verifies the DS RRset
	DS=37331/SHA-256 is now in the chain-of-trust
	`net. 86400 IN DS ( 37331 13 2 2f0bec2d6f79dfbd1d08fd21a3af92d0e39a4b9ef1e3f4111fff282490da453b )`
	Query to f.gtld-servers.net for net/DNSKEY
	Received 291 bytes from 192.35.51.30
	;; Response received from [192.35.51.30] 291 octets ;; HEADER SECTION ;; id = 31749 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; net. IN DNSKEY ;; ANSWER SECTION (3 records) net. 86400 IN DNSKEY ( 256 3 13 16NvlxmHDHZoafgfgQSqMzWNHJPVXuq7/qyicuulQJHyyBrjltAVFAMZN5TR173kCAoeearbeoQB PRJqmYFXxQ== ) ; keytag 45412 net. 86400 IN DNSKEY ( 257 3 13 HiBoGpzDRAgrDmUXXTSnl7jCX6Hx5bzkU2jSxMbVI01yS+13EyOghnCidBXU0bH2gi2w9GhYGacp U6CrtwoFNg== ) ; keytag 37331 net. 86400 IN RRSIG ( DNSKEY 13 1 86400 20250716141035 20250701140535 37331 net. W5PtEswdOREW/YgwQILxvEfD4BU21CzS6B3r8OXxXCStEmtvXTyUVMo9V9MiFNP0LR4f+uR/hjzO H97kpTpKKw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for net
	`net. 86400 IN DNSKEY ( 256 3 13 16NvlxmHDHZoafgfgQSqMzWNHJPVXuq7/qyicuulQJHyyBrjltAVFAMZN5TR173kCAoeearbeoQB PRJqmYFXxQ== ) ; keytag 45412`
	`net. 86400 IN DNSKEY ( 257 3 13 HiBoGpzDRAgrDmUXXTSnl7jCX6Hx5bzkU2jSxMbVI01yS+13EyOghnCidBXU0bH2gi2w9GhYGacp U6CrtwoFNg== ) ; keytag 37331`
	DNSKEY=37331/SEP is now in the chain-of-trust
	DS=37331/SHA-256 verifies DNSKEY=37331/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`net. 86400 IN RRSIG ( DNSKEY 13 1 86400 20250716141035 20250701140535 37331 net. W5PtEswdOREW/YgwQILxvEfD4BU21CzS6B3r8OXxXCStEmtvXTyUVMo9V9MiFNP0LR4f+uR/hjzO H97kpTpKKw== )`
	RRSIG=37331 and DNSKEY=37331/SEP verifies the DNSKEY RRset
	DNSKEY=45412 is now in the chain-of-trust
	Query to d.gtld-servers.net for d1oj4yrmnvvraf.cloudfront.net/A
	Received 568 bytes from 192.31.80.30
	;; Response received from [192.31.80.30] 568 octets ;; HEADER SECTION ;; id = 3889 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 2 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) cloudfront.net. 172800 IN NS ns-666.awsdns-19.net. cloudfront.net. 172800 IN NS ns-418.awsdns-52.com. cloudfront.net. 172800 IN NS ns-1597.awsdns-07.co.uk. cloudfront.net. 172800 IN NS ns-1306.awsdns-35.org. A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 900 IN NSEC3 ( 1 1 0 - a1rtlnpgulogn7b9a62shje1u3ttp8dr NS SOA RRSIG DNSKEY NSEC3PARAM ) A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 900 IN RRSIG ( NSEC3 13 2 900 20250710024917 20250703013917 45412 net. iUo/xPi9rgUgm0ZfRAWJFtZ7EED7CDpOpB6qazbGBngpWTvAQryWCnu2fs9L5METeBmw2IfdUHRs QlR1lmiELA== ) FADFU252JJL6DOJN36VP2CSQAMCD7R98.net. 900 IN NSEC3 ( 1 1 0 - fadh7kgl8g232b3m9jmhhmagat37ojk3 NS DS RRSIG ) FADFU252JJL6DOJN36VP2CSQAMCD7R98.net. 900 IN RRSIG ( NSEC3 13 2 900 20250707025053 20250630014053 45412 net. 368BahpoKExm4SokdDGqdUOg4A7vLTAWYYD6aZXj/2wibzALttY434I8YyHPd/5OsPmqDNV4YmG/ aCNRYveRqw== ) ;; ADDITIONAL SECTION (2 records) ns-666.awsdns-19.net. 172800 IN A 205.251.194.154 ;; { "EDNS-VERSION": 0 }
	Query to b.gtld-servers.net for cloudfront.net/DNSKEY
	Received 553 bytes from 192.33.14.30
	;; Response received from [192.33.14.30] 553 octets ;; HEADER SECTION ;; id = 34865 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 2 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cloudfront.net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) cloudfront.net. 172800 IN NS ns-666.awsdns-19.net. cloudfront.net. 172800 IN NS ns-418.awsdns-52.com. cloudfront.net. 172800 IN NS ns-1597.awsdns-07.co.uk. cloudfront.net. 172800 IN NS ns-1306.awsdns-35.org. A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 900 IN NSEC3 ( 1 1 0 - a1rtlnpgulogn7b9a62shje1u3ttp8dr NS SOA RRSIG DNSKEY NSEC3PARAM ) A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 900 IN RRSIG ( NSEC3 13 2 900 20250710024917 20250703013917 45412 net. iUo/xPi9rgUgm0ZfRAWJFtZ7EED7CDpOpB6qazbGBngpWTvAQryWCnu2fs9L5METeBmw2IfdUHRs QlR1lmiELA== ) FADFU252JJL6DOJN36VP2CSQAMCD7R98.net. 900 IN NSEC3 ( 1 1 0 - fadh7kgl8g232b3m9jmhhmagat37ojk3 NS DS RRSIG ) FADFU252JJL6DOJN36VP2CSQAMCD7R98.net. 900 IN RRSIG ( NSEC3 13 2 900 20250707025053 20250630014053 45412 net. 368BahpoKExm4SokdDGqdUOg4A7vLTAWYYD6aZXj/2wibzALttY434I8YyHPd/5OsPmqDNV4YmG/ aCNRYveRqw== ) ;; ADDITIONAL SECTION (2 records) ns-666.awsdns-19.net. 172800 IN A 205.251.194.154 ;; { "EDNS-VERSION": 0 }
	Found child zone cloudfront.net

cloudfront.net

	Checking DS between net and cloudfront.net
	Query to a.gtld-servers.net for cloudfront.net/DS
	Received 572 bytes from 192.5.6.30
	;; Response received from [192.5.6.30] 572 octets ;; HEADER SECTION ;; id = 294 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cloudfront.net. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 900 IN NSEC3 ( 1 1 0 - a1rtlnpgulogn7b9a62shje1u3ttp8dr NS SOA RRSIG DNSKEY NSEC3PARAM ) A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 900 IN RRSIG ( NSEC3 13 2 900 20250710024917 20250703013917 45412 net. iUo/xPi9rgUgm0ZfRAWJFtZ7EED7CDpOpB6qazbGBngpWTvAQryWCnu2fs9L5METeBmw2IfdUHRs QlR1lmiELA== ) net. 900 IN SOA ( a.gtld-servers.net. nstld.verisign-grs.com. 1751520908 ;serial 1800 ;refresh 900 ;retry 604800 ;expire 900 ;minimum ) net. 900 IN RRSIG ( SOA 13 1 900 20250710053508 20250703042508 45412 net. t8Cf26QbIChQtOamMTcPzIOY8YZGJ5y5wzZrkhQ3QRMMkwHXVhhcmT2SADt9QVkDrBaCrjpQzjaG 5lBUo+VznQ== ) FADFU252JJL6DOJN36VP2CSQAMCD7R98.net. 900 IN NSEC3 ( 1 1 0 - fadh7kgl8g232b3m9jmhhmagat37ojk3 NS DS RRSIG ) FADFU252JJL6DOJN36VP2CSQAMCD7R98.net. 900 IN RRSIG ( NSEC3 13 2 900 20250707025053 20250630014053 45412 net. 368BahpoKExm4SokdDGqdUOg4A7vLTAWYYD6aZXj/2wibzALttY434I8YyHPd/5OsPmqDNV4YmG/ aCNRYveRqw== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DS records found for cloudfront.net in the net zone
	Query to ns-1597.awsdns-07.co.uk for cloudfront.net/DNSKEY
	Received 110 bytes from 205.251.198.61
	;; Response received from [205.251.198.61] 110 octets ;; HEADER SECTION ;; id = 37926 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 1 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cloudfront.net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) cloudfront.net. 60 IN SOA ( ns-418.awsdns-52.com. hostmaster.cloudfront.net. 1377556270 ;serial 16384 ;refresh 2048 ;retry 1048576 ;expire 60 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DNSKEY records found
	Query to ns-418.awsdns-52.com for d1oj4yrmnvvraf.cloudfront.net/A
	Received 195 bytes from 205.251.193.162
	;; Response received from [205.251.193.162] 195 octets ;; HEADER SECTION ;; id = 10918 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns-418.awsdns-52.com for d1oj4yrmnvvraf.cloudfront.net/DNSKEY
	Received 195 bytes from 205.251.193.162
	;; Response received from [205.251.193.162] 195 octets ;; HEADER SECTION ;; id = 60297 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone d1oj4yrmnvvraf.cloudfront.net

d1oj4yrmnvvraf.cloudfront.net

	Checking DS between cloudfront.net and d1oj4yrmnvvraf.cloudfront.net
	Query to ns-666.awsdns-19.net for d1oj4yrmnvvraf.cloudfront.net/DS
	Received 125 bytes from 205.251.194.154
	;; Response received from [205.251.194.154] 125 octets ;; HEADER SECTION ;; id = 49733 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 1 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) cloudfront.net. 60 IN SOA ( ns-418.awsdns-52.com. hostmaster.cloudfront.net. 1377556270 ;serial 16384 ;refresh 2048 ;retry 1048576 ;expire 60 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DS records found for d1oj4yrmnvvraf.cloudfront.net in the cloudfront.net zone
	Query to ns-171.awsdns-21.com for d1oj4yrmnvvraf.cloudfront.net/DNSKEY
	Received 143 bytes from 205.251.192.171
	;; Response received from [205.251.192.171] 143 octets ;; HEADER SECTION ;; id = 53155 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 1 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) d1oj4yrmnvvraf.cloudfront.net. 60 IN SOA ( ns-1135.awsdns-13.org. awsdns-hostmaster.amazon.com. 1 ;serial 7200 ;refresh 900 ;retry 1209600 ;expire 86400 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DNSKEY records found
	Query to ns-605.awsdns-11.net for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.194.93
	;; Response received from [205.251.194.93] 259 octets ;; HEADER SECTION ;; id = 36589 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns-605.awsdns-11.net is authoritative for d1oj4yrmnvvraf.cloudfront.net
	Query to ns-1135.awsdns-13.org for d1oj4yrmnvvraf.cloudfront.net/SOA
	Received 256 bytes from 205.251.196.111
	;; Response received from [205.251.196.111] 256 octets ;; HEADER SECTION ;; id = 33383 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 1 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN SOA ;; ANSWER SECTION (1 record) d1oj4yrmnvvraf.cloudfront.net. 60 IN SOA ( ns-1135.awsdns-13.org. awsdns-hostmaster.amazon.com. 1 ;serial 7200 ;refresh 900 ;retry 1209600 ;expire 86400 ;minimum ) ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns-171.awsdns-21.com for d1oj4yrmnvvraf.cloudfront.net/SOA
	Received 256 bytes from 205.251.192.171
	;; Response received from [205.251.192.171] 256 octets ;; HEADER SECTION ;; id = 57588 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 1 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN SOA ;; ANSWER SECTION (1 record) d1oj4yrmnvvraf.cloudfront.net. 60 IN SOA ( ns-1135.awsdns-13.org. awsdns-hostmaster.amazon.com. 1 ;serial 7200 ;refresh 900 ;retry 1209600 ;expire 86400 ;minimum ) ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns-1866.awsdns-41.co.uk for d1oj4yrmnvvraf.cloudfront.net/SOA
	Received 256 bytes from 205.251.199.74
	;; Response received from [205.251.199.74] 256 octets ;; HEADER SECTION ;; id = 12651 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 1 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN SOA ;; ANSWER SECTION (1 record) d1oj4yrmnvvraf.cloudfront.net. 60 IN SOA ( ns-1135.awsdns-13.org. awsdns-hostmaster.amazon.com. 1 ;serial 7200 ;refresh 900 ;retry 1209600 ;expire 86400 ;minimum ) ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns-605.awsdns-11.net for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.194.93
	;; Response received from [205.251.194.93] 259 octets ;; HEADER SECTION ;; id = 48321 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.29
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.7
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.2
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.120
	No RRSIGs found

d1oj4yrmnvvraf.cloudfront.net

	Query to ns-1135.awsdns-13.org for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.196.111
	;; Response received from [205.251.196.111] 259 octets ;; HEADER SECTION ;; id = 22011 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns-1135.awsdns-13.org is authoritative for d1oj4yrmnvvraf.cloudfront.net
	Query to ns-1135.awsdns-13.org for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.196.111
	;; Response received from [205.251.196.111] 259 octets ;; HEADER SECTION ;; id = 44527 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.29
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.2
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.120
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.7
	No RRSIGs found

d1oj4yrmnvvraf.cloudfront.net

	Query to ns-171.awsdns-21.com for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.192.171
	;; Response received from [205.251.192.171] 259 octets ;; HEADER SECTION ;; id = 44857 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns-171.awsdns-21.com is authoritative for d1oj4yrmnvvraf.cloudfront.net
	Query to ns-171.awsdns-21.com for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.192.171
	;; Response received from [205.251.192.171] 259 octets ;; HEADER SECTION ;; id = 3221 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.29
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.2
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.7
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.120
	No RRSIGs found

d1oj4yrmnvvraf.cloudfront.net

	Query to ns-1866.awsdns-41.co.uk for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.199.74
	;; Response received from [205.251.199.74] 259 octets ;; HEADER SECTION ;; id = 62335 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns-1866.awsdns-41.co.uk is authoritative for d1oj4yrmnvvraf.cloudfront.net
	Query to ns-1866.awsdns-41.co.uk for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.199.74
	;; Response received from [205.251.199.74] 259 octets ;; HEADER SECTION ;; id = 47000 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.29
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.120
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.7
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.2
	No RRSIGs found

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test www.usembassy.gov at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: