DNSSEC Debugger - www.usembassy.gov

Domain Name:

Time: 2025-09-15 10:59:28 UTC

Analyzing DNSSEC problems for www.usembassy.gov

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to c.root-servers.net for ./DNSKEY
	Received 1417 bytes from 192.33.4.12
	;; Response received from [192.33.4.12] 1417 octets ;; HEADER SECTION ;; id = 12213 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 5 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (5 records) . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN DNSKEY ( 256 3 8 AwEAAbEbGCpGTDrcZTWqWWE72nphyshpRcILdzCVlBGU9Ln1Fui9kkseUOP+g5GLUeVFKdTloeRT A9+EYiQdXgWXmXmuW/nGxZjAikluF/O9NzLVrr5iZnth2xu+F48nrJlAgWWiMNau54NI5sZ3iVQf hFsq2pZmf43RauRPniYMShOLO7EBWWXr5glDSgZGS9fSm6xHwwF+g8D4m8oanjvdCBNxXzSEKS31 ibxjLifTfvwCg3y4XXcNW9U6Nu3JmoKUdxqpPPIkBvVQbIz4UO2FwaR13uXC03ALP1Yx2QNSS4SZ lcIMtAftQR9wtCiuPWQnFv4jkzWqlhp1Lmf7bcoL9yk= ) ; keytag 53148 . 172800 IN DNSKEY ( 256 3 8 AwEAAbauxLSFZ+KSWi2cT6TJbm3d+GIVqb2N1XnDjMsRme0b6JlGp/cvwmM5CaJ5LQ7tG1r7LuTH jYZadtbNk2nZmclq9r4KInS48ungoAZb0gJXVw8IvBTBb1YWQmiBqD285pJuORwTii7DF++nNJJk 3i55HJt9SmBI7m7t8nvx7OOY/w0inxg3fLH2uY0SKO8he4FGwMc4Ubiab8N8Yhyhh+FkKKdD/+oA cuGF75PjlSXO460B4MlNLlEcjDEzIsKauRYx4YVgSaNomGhMMFblmXRzgW+1R6ywvm5mC9+omlyy izZp2GJfPwGMezuKSGDndO6CYYEc5/lsRhvBYsGjdPM= ) ; keytag 46441 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20250930000000 20250909000000 20326 . aqj52+DKW6PhTa31l3xyxa0lbMd8T/UyK1sNUC42EY1+cSp0hSC0VlW82RsWYU5G5NmewrInT/Sx glWFlFz94yVqiKAK7ZNQr94nRbA7okrrlfnloiBi3cQ1IvEUgvNcmlZMLTeA6rINvdcBwS7ljMOH m0vQDce9IOxhQT7iAu23oiNORw5nWG/npNkYRFDD4yQvD3HsNeXFTuyDuc57ZEjs/pnIG5nkcqx7 tp/ba3XbOGllDr/V/0ubak7OeWum1eckIljqUsx5BnfBfIA7rJ2JJBIT7JMJ/O/cflTKoJFHQoKG TVYrNVBq9vsnZ01Q4ss688IvI8vO3zkP6LQLEA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 4 DNSKEY records for .
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbEbGCpGTDrcZTWqWWE72nphyshpRcILdzCVlBGU9Ln1Fui9kkseUOP+g5GLUeVFKdTloeRT A9+EYiQdXgWXmXmuW/nGxZjAikluF/O9NzLVrr5iZnth2xu+F48nrJlAgWWiMNau54NI5sZ3iVQf hFsq2pZmf43RauRPniYMShOLO7EBWWXr5glDSgZGS9fSm6xHwwF+g8D4m8oanjvdCBNxXzSEKS31 ibxjLifTfvwCg3y4XXcNW9U6Nu3JmoKUdxqpPPIkBvVQbIz4UO2FwaR13uXC03ALP1Yx2QNSS4SZ lcIMtAftQR9wtCiuPWQnFv4jkzWqlhp1Lmf7bcoL9yk= ) ; keytag 53148`
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAbauxLSFZ+KSWi2cT6TJbm3d+GIVqb2N1XnDjMsRme0b6JlGp/cvwmM5CaJ5LQ7tG1r7LuTH jYZadtbNk2nZmclq9r4KInS48ungoAZb0gJXVw8IvBTBb1YWQmiBqD285pJuORwTii7DF++nNJJk 3i55HJt9SmBI7m7t8nvx7OOY/w0inxg3fLH2uY0SKO8he4FGwMc4Ubiab8N8Yhyhh+FkKKdD/+oA cuGF75PjlSXO460B4MlNLlEcjDEzIsKauRYx4YVgSaNomGhMMFblmXRzgW+1R6ywvm5mC9+omlyy izZp2GJfPwGMezuKSGDndO6CYYEc5/lsRhvBYsGjdPM= ) ; keytag 46441`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20250930000000 20250909000000 20326 . aqj52+DKW6PhTa31l3xyxa0lbMd8T/UyK1sNUC42EY1+cSp0hSC0VlW82RsWYU5G5NmewrInT/Sx glWFlFz94yVqiKAK7ZNQr94nRbA7okrrlfnloiBi3cQ1IvEUgvNcmlZMLTeA6rINvdcBwS7ljMOH m0vQDce9IOxhQT7iAu23oiNORw5nWG/npNkYRFDD4yQvD3HsNeXFTuyDuc57ZEjs/pnIG5nkcqx7 tp/ba3XbOGllDr/V/0ubak7OeWum1eckIljqUsx5BnfBfIA7rJ2JJBIT7JMJ/O/cflTKoJFHQoKG TVYrNVBq9vsnZ01Q4ss688IvI8vO3zkP6LQLEA== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=38696/SEP is now in the chain-of-trust
	DNSKEY=53148 is now in the chain-of-trust
	DNSKEY=46441 is now in the chain-of-trust
	Query to k.root-servers.net for www.usembassy.gov/A
	Received 624 bytes from 193.0.14.129
	;; Response received from [193.0.14.129] 624 octets ;; HEADER SECTION ;; id = 50339 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.usembassy.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS d.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20250928050000 20250915040000 46441 . kwLmj09oejkqdk5ozftFzZUvoJJQ3XAnaZSpf/+lEO2mxfEicCNkg1E5Y4Lsj7kqpLR2iD7vyvtM 0mD6knHmY0Iu4GICBsQfnxm7JwzTjmvSQgtwySkGVxtD7JgDhmq25nGxJH2PLA9KMhqhDmBVHRMz W3MAgP2ylfjOt30RnERQCPTk/4p0GWQxiVC/aJgC81My5UKVW0oehQzwOnL7K5M5uefhu+sasAFT 0Ja8bBvfnHPnkBoN/DLnkAk63kfIGcp5XSLan2bCb60UkEUrEAqZMFhOKvagHF3IEaD8R9dIY7H7 ol8M8hqOmmOCYxnr+4XOBEnjg2XRYn9uklu2Lw== ) ;; ADDITIONAL SECTION (9 records) a.ns.gov. 172800 IN A 199.33.230.1 b.ns.gov. 172800 IN A 199.33.231.1 c.ns.gov. 172800 IN A 199.33.232.1 d.ns.gov. 172800 IN A 199.33.233.1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 ;; { "EDNS-VERSION": 0 }
	Query to i.root-servers.net for gov/DNSKEY
	Received 613 bytes from 192.36.148.17
	;; Response received from [192.36.148.17] 613 octets ;; HEADER SECTION ;; id = 4099 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 9 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) gov. 172800 IN NS d.ns.gov. gov. 172800 IN NS c.ns.gov. gov. 172800 IN NS a.ns.gov. gov. 172800 IN NS b.ns.gov. gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20250928050000 20250915040000 46441 . kwLmj09oejkqdk5ozftFzZUvoJJQ3XAnaZSpf/+lEO2mxfEicCNkg1E5Y4Lsj7kqpLR2iD7vyvtM 0mD6knHmY0Iu4GICBsQfnxm7JwzTjmvSQgtwySkGVxtD7JgDhmq25nGxJH2PLA9KMhqhDmBVHRMz W3MAgP2ylfjOt30RnERQCPTk/4p0GWQxiVC/aJgC81My5UKVW0oehQzwOnL7K5M5uefhu+sasAFT 0Ja8bBvfnHPnkBoN/DLnkAk63kfIGcp5XSLan2bCb60UkEUrEAqZMFhOKvagHF3IEaD8R9dIY7H7 ol8M8hqOmmOCYxnr+4XOBEnjg2XRYn9uklu2Lw== ) ;; ADDITIONAL SECTION (9 records) d.ns.gov. 172800 IN A 199.33.233.1 c.ns.gov. 172800 IN A 199.33.232.1 b.ns.gov. 172800 IN A 199.33.231.1 a.ns.gov. 172800 IN A 199.33.230.1 d.ns.gov. 172800 IN AAAA 2001:503:ff43::1 c.ns.gov. 172800 IN AAAA 2001:503:ff42::1 b.ns.gov. 172800 IN AAAA 2001:503:ff41::1 a.ns.gov. 172800 IN AAAA 2001:503:ff40::1 ;; { "EDNS-VERSION": 0 }
	Found child zone gov

gov

	Checking DS between . and gov
	Query to h.root-servers.net for gov/DS
	Received 367 bytes from 198.97.190.53
	;; Response received from [198.97.190.53] 367 octets ;; HEADER SECTION ;; id = 50611 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DS ;; ANSWER SECTION (2 records) gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 ) gov. 86400 IN RRSIG ( DS 8 1 86400 20250928050000 20250915040000 46441 . kwLmj09oejkqdk5ozftFzZUvoJJQ3XAnaZSpf/+lEO2mxfEicCNkg1E5Y4Lsj7kqpLR2iD7vyvtM 0mD6knHmY0Iu4GICBsQfnxm7JwzTjmvSQgtwySkGVxtD7JgDhmq25nGxJH2PLA9KMhqhDmBVHRMz W3MAgP2ylfjOt30RnERQCPTk/4p0GWQxiVC/aJgC81My5UKVW0oehQzwOnL7K5M5uefhu+sasAFT 0Ja8bBvfnHPnkBoN/DLnkAk63kfIGcp5XSLan2bCb60UkEUrEAqZMFhOKvagHF3IEaD8R9dIY7H7 ol8M8hqOmmOCYxnr+4XOBEnjg2XRYn9uklu2Lw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for gov in the . zone
	DS=2536/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`gov. 86400 IN RRSIG ( DS 8 1 86400 20250928050000 20250915040000 46441 . kwLmj09oejkqdk5ozftFzZUvoJJQ3XAnaZSpf/+lEO2mxfEicCNkg1E5Y4Lsj7kqpLR2iD7vyvtM 0mD6knHmY0Iu4GICBsQfnxm7JwzTjmvSQgtwySkGVxtD7JgDhmq25nGxJH2PLA9KMhqhDmBVHRMz W3MAgP2ylfjOt30RnERQCPTk/4p0GWQxiVC/aJgC81My5UKVW0oehQzwOnL7K5M5uefhu+sasAFT 0Ja8bBvfnHPnkBoN/DLnkAk63kfIGcp5XSLan2bCb60UkEUrEAqZMFhOKvagHF3IEaD8R9dIY7H7 ol8M8hqOmmOCYxnr+4XOBEnjg2XRYn9uklu2Lw== )`
	RRSIG=46441 and DNSKEY=46441 verifies the DS RRset
	DS=2536/SHA-256 is now in the chain-of-trust
	`gov. 86400 IN DS ( 2536 13 2 0baf26b7bbf313a859046fd3b1ee49ddfba33934cfb3e717c21e2a2935c2f259 )`
	Query to d.ns.gov for gov/DNSKEY
	Received 291 bytes from 199.33.233.1
	;; Response received from [199.33.233.1] 291 octets ;; HEADER SECTION ;; id = 22262 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; gov. IN DNSKEY ;; ANSWER SECTION (3 records) gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536 gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496 gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20251101110613 20250901110613 2536 gov. D1H2/lQxqi95pn45IcLLiEhJqLj7xvGsuBj73AYEAzqX48/P7GQMRCj7rQAOTEwKoZaj70cVbIvD dPV4T5L9mw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for gov
	`gov. 3600 IN DNSKEY ( 257 3 13 D6ZhJTObQw3+kcewWf5iTHbzD3uTdbs5xf0kQfP/VXZcDovWJd0DUgHlp2VC002aLDCwhLoPPVN2 VfyoPnjCqg== ) ; keytag 2536`
	`gov. 3600 IN DNSKEY ( 256 3 13 Of5kU9k4XfdcPwCK9k/zRJNu+Xspnw/BDd+1V6ZpDXRIpHe35BnHTZUBJN9gd6++HkiGXx2YnTji iO7/q+Yamg== ) ; keytag 35496`
	DNSKEY=2536/SEP is now in the chain-of-trust
	DS=2536/SHA-256 verifies DNSKEY=2536/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`gov. 3600 IN RRSIG ( DNSKEY 13 1 3600 20251101110613 20250901110613 2536 gov. D1H2/lQxqi95pn45IcLLiEhJqLj7xvGsuBj73AYEAzqX48/P7GQMRCj7rQAOTEwKoZaj70cVbIvD dPV4T5L9mw== )`
	RRSIG=2536 and DNSKEY=2536/SEP verifies the DNSKEY RRset
	DNSKEY=35496 is now in the chain-of-trust
	Query to b.ns.gov for www.usembassy.gov/A
	Received 371 bytes from 199.33.231.1
	;; Response received from [199.33.231.1] 371 octets ;; HEADER SECTION ;; id = 47443 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 9 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.usembassy.gov. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) usembassy.gov. 10800 IN NS a1-63.akam.net. usembassy.gov. 10800 IN NS a14-64.akam.net. usembassy.gov. 10800 IN NS a26-65.akam.net. usembassy.gov. 10800 IN NS a3-66.akam.net. usembassy.gov. 10800 IN NS a8-67.akam.net. usembassy.gov. 10800 IN NS a9-64.akam.net. usembassy.gov. 3600 IN DS ( 2524 8 2 19e43944425f867e6c8702a6871ab589eb2867836cf8ecad08176eafba7b1e88 ) usembassy.gov. 3600 IN DS ( 39784 8 2 70d37f4f71554d6c046456d43104628cf0a65d71357660f01b6f4b04dce88869 ) usembassy.gov. 3600 IN RRSIG ( DS 13 2 3600 20250916115929 20250914095929 35496 gov. kduq1YkM/3+cxG2vtlUCXAlcnXrKZLzUgRcbT4llHQSsSpxUxbh3/8hBmVDNOUDYC1mKk2CsmYRQ OtnjH7iUoA== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to b.ns.gov for usembassy.gov/DNSKEY
	Received 367 bytes from 199.33.231.1
	;; Response received from [199.33.231.1] 367 octets ;; HEADER SECTION ;; id = 7718 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 9 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; usembassy.gov. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (9 records) usembassy.gov. 10800 IN NS a1-63.akam.net. usembassy.gov. 10800 IN NS a14-64.akam.net. usembassy.gov. 10800 IN NS a26-65.akam.net. usembassy.gov. 10800 IN NS a3-66.akam.net. usembassy.gov. 10800 IN NS a8-67.akam.net. usembassy.gov. 10800 IN NS a9-64.akam.net. usembassy.gov. 3600 IN DS ( 2524 8 2 19e43944425f867e6c8702a6871ab589eb2867836cf8ecad08176eafba7b1e88 ) usembassy.gov. 3600 IN DS ( 39784 8 2 70d37f4f71554d6c046456d43104628cf0a65d71357660f01b6f4b04dce88869 ) usembassy.gov. 3600 IN RRSIG ( DS 13 2 3600 20250916115929 20250914095929 35496 gov. zypS/nWRYBssQsAueoLkLUxBGM1X7jrTr+F36dmJhiM11heQP2U7CFoHWQhvPwK+ecBzCNoHqSgC xRpbDHt9bw== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone usembassy.gov

usembassy.gov

	Checking DS between gov and usembassy.gov
	Query to d.ns.gov for usembassy.gov/DS
	Received 237 bytes from 199.33.233.1
	;; Response received from [199.33.233.1] 237 octets ;; HEADER SECTION ;; id = 2387 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; usembassy.gov. IN DS ;; ANSWER SECTION (3 records) usembassy.gov. 3600 IN DS ( 2524 8 2 19e43944425f867e6c8702a6871ab589eb2867836cf8ecad08176eafba7b1e88 ) usembassy.gov. 3600 IN DS ( 39784 8 2 70d37f4f71554d6c046456d43104628cf0a65d71357660f01b6f4b04dce88869 ) usembassy.gov. 3600 IN RRSIG ( DS 13 2 3600 20250916115929 20250914095929 35496 gov. D7EvqKM76rbIsTX0uMq4ZoDw/+aUxAywVSRj6mzNrAbpF5qpvnyeGdRe4odcT8qrydXZMl/znyNt pYjroWIOCA== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DS records for usembassy.gov in the gov zone
	DS=2524/SHA-256 has algorithm RSASHA256
	DS=39784/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`usembassy.gov. 3600 IN RRSIG ( DS 13 2 3600 20250916115929 20250914095929 35496 gov. D7EvqKM76rbIsTX0uMq4ZoDw/+aUxAywVSRj6mzNrAbpF5qpvnyeGdRe4odcT8qrydXZMl/znyNt pYjroWIOCA== )`
	RRSIG=35496 and DNSKEY=35496 verifies the DS RRset
	DS=2524/SHA-256 is now in the chain-of-trust
	DS=39784/SHA-256 is now in the chain-of-trust
	`usembassy.gov. 3600 IN DS ( 2524 8 2 19e43944425f867e6c8702a6871ab589eb2867836cf8ecad08176eafba7b1e88 )`
	`usembassy.gov. 3600 IN DS ( 39784 8 2 70d37f4f71554d6c046456d43104628cf0a65d71357660f01b6f4b04dce88869 )`
	Query to a14-64.akam.net for usembassy.gov/DNSKEY
	Received 1472 bytes from 184.26.161.64
	;; Response received from [184.26.161.64] 1472 octets ;; HEADER SECTION ;; id = 62954 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 5 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; usembassy.gov. IN DNSKEY ;; ANSWER SECTION (5 records) usembassy.gov. 15768000 IN DNSKEY ( 256 3 8 AwEAAbcn2WxWAiBr8CG5XYfxjY+kVMUCF2ZqpO/xNNAuCu6bUJoaUNlHDt+C4wfnky3A3fIc/eb5 XptkC4RDoBNzujn6obyapzxLVVG/wnF2yzvke7oEKS4S6p/lR5QlSAiIWaLRNd3dDOZ6Ba3s4TdX rmjkt//htqfTMJ0s4CTI2ome6UsDtpO7uLFZkycqxb6oHQhJ8/oUkmrM58uSDNN00qExnly/XPkm G2b0GEUfN3DVElh9TAFZM4qakOHGPmlo7TEX5Hxz41LH2qGE1KeqfZye2JttDdhh9Q5j2QwtYGaM 5Dbl3+X2k1j8huLJtU9brMhYRTkAPKNAEsMghDhaKB0= ) ; keytag 40611 usembassy.gov. 15768000 IN DNSKEY ( 256 3 8 AwEAAdJd4r8OBqJZM1Vcu5mIuX9/Sf0a5zQMK5DboM0Y4yt49pRYRsc5/yFdKyT9Lm/wso754Z+5 6zVvXmYlck6S82+dgrYufogcZ/KYnEzQlWCo6SWfIVusCoq4dCNmA/86g4/7ezgFDOx+CuMXTlKw u8QtnveD2vwdRZnIPxXfzI//m1SO5PdknVFufsFp+oJIkjv6+6i2VeZkXlHSpZiR3tju0qswoh4U R1IyUtjBLx+S92GEfjvUpd1QPpdoFMENoknGyfu24aOpGymyNaf8Y3aGW5JSdfbQKiuUvr9uSZvq NAEljW6ynu7zuxpfXxk8ZNI0sWpKYHFKX4oq22vu+Ok= ) ; keytag 8979 usembassy.gov. 15768000 IN DNSKEY ( 257 3 8 AwEAAbPiGr3SJ0TR1RDI+llg6ZYG2eJ7zNgQOykJeG+fbUtNFMSL1OwYMS6FyByQlSjC3R0SXLAE ASuLbxG6d5l3xSCVLUg35YbX6VPJbzonr+Yi44KXUb2AbP59pf0HZSpjl+XqKl0Pdg6hpHEThyr5 X7zAeTSfVPzMQky+xM/L6k0hg92zo8OQaOiHYIt2MWlXI3I8qqcGudkDaZfEnpG+5znvmVrEomKg B6cb41tW6rejKPNSBesmUWSjLYmNYLM0OpDWxpj+nMkdXpzs3dPJ6JW723BqWWv70PJyKCxjaW0t ioxygBsOS3019OdSlpCq/VyQYbc7CoPLCJxAufKaqBs= ) ; keytag 2524 usembassy.gov. 15768000 IN RRSIG ( DNSKEY 8 2 15768000 20260822110305 20250822101508 2524 usembassy.gov. qJcQZI9L/2jFBOf7aq/vfIi3DPvDj2ac/oWnW1YMaU1DA/aIBPPcGJ0UNOat+UZokbTBwh3DBl6x F1vHeFcC8BvmIprmHll1dGbiGp/g8XkCWZN16qIeTvz17eG+bSO3PmN2YnExKunB38gfuN/LrLsE vq98XCacX0Oh0LDhGC2Zzfhx9bg1y6NzT5gj9Vc27BoW0fIe2oWxaACRDbq7OI+qkB1rH4sY8F7a Sdllrsyfki/pobUkTdor2LG/69XAHP8FLS7NmPkAVmCHJq3npRShVZBh6xJ0+2oTzcZnAeLN3nzb cJyPO6795TI76xj/5yfCmzFUagwfb+X3wX2WBw== ) usembassy.gov. 15768000 IN RRSIG ( DNSKEY 8 2 15768000 20260822110305 20250822101508 8979 usembassy.gov. XcTqGyyvZNToo81On0StzZ8PbZ7V8z/+rr4nUdpwUvoTRmREWeyhOHwJKO7bH5a2iIZGSGmXy5S1 NoK1XaclsjXYQ5V6n3QY6YWGZAd0a7gQiGRoT/LRJdEL/mcRjT2FAoYY8Ca9Cy8JvNQ7dNHq9Ppi UJYwbd0Kqj1jQrnZUcaUH3S5pKIE5P0m0ZBt/2WQitpcGLu33ciuaBVugB3dSyRaEfaS1tbz/UWW nla8k24hQKExJePSjngcuFEWhVenxbuNPemPhEGHjOjfJV8ToP2uKD+n6w3r8O5jn/lQ4IRLuelS pKs75A1DWSUdXkqKs88+8qrooQz7Nrz9XI0qMw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for usembassy.gov
	`usembassy.gov. 15768000 IN DNSKEY ( 256 3 8 AwEAAbcn2WxWAiBr8CG5XYfxjY+kVMUCF2ZqpO/xNNAuCu6bUJoaUNlHDt+C4wfnky3A3fIc/eb5 XptkC4RDoBNzujn6obyapzxLVVG/wnF2yzvke7oEKS4S6p/lR5QlSAiIWaLRNd3dDOZ6Ba3s4TdX rmjkt//htqfTMJ0s4CTI2ome6UsDtpO7uLFZkycqxb6oHQhJ8/oUkmrM58uSDNN00qExnly/XPkm G2b0GEUfN3DVElh9TAFZM4qakOHGPmlo7TEX5Hxz41LH2qGE1KeqfZye2JttDdhh9Q5j2QwtYGaM 5Dbl3+X2k1j8huLJtU9brMhYRTkAPKNAEsMghDhaKB0= ) ; keytag 40611`
	`usembassy.gov. 15768000 IN DNSKEY ( 256 3 8 AwEAAdJd4r8OBqJZM1Vcu5mIuX9/Sf0a5zQMK5DboM0Y4yt49pRYRsc5/yFdKyT9Lm/wso754Z+5 6zVvXmYlck6S82+dgrYufogcZ/KYnEzQlWCo6SWfIVusCoq4dCNmA/86g4/7ezgFDOx+CuMXTlKw u8QtnveD2vwdRZnIPxXfzI//m1SO5PdknVFufsFp+oJIkjv6+6i2VeZkXlHSpZiR3tju0qswoh4U R1IyUtjBLx+S92GEfjvUpd1QPpdoFMENoknGyfu24aOpGymyNaf8Y3aGW5JSdfbQKiuUvr9uSZvq NAEljW6ynu7zuxpfXxk8ZNI0sWpKYHFKX4oq22vu+Ok= ) ; keytag 8979`
	`usembassy.gov. 15768000 IN DNSKEY ( 257 3 8 AwEAAbPiGr3SJ0TR1RDI+llg6ZYG2eJ7zNgQOykJeG+fbUtNFMSL1OwYMS6FyByQlSjC3R0SXLAE ASuLbxG6d5l3xSCVLUg35YbX6VPJbzonr+Yi44KXUb2AbP59pf0HZSpjl+XqKl0Pdg6hpHEThyr5 X7zAeTSfVPzMQky+xM/L6k0hg92zo8OQaOiHYIt2MWlXI3I8qqcGudkDaZfEnpG+5znvmVrEomKg B6cb41tW6rejKPNSBesmUWSjLYmNYLM0OpDWxpj+nMkdXpzs3dPJ6JW723BqWWv70PJyKCxjaW0t ioxygBsOS3019OdSlpCq/VyQYbc7CoPLCJxAufKaqBs= ) ; keytag 2524`
	DNSKEY=2524/SEP is now in the chain-of-trust
	DS=2524/SHA-256 verifies DNSKEY=2524/SEP
	DS=39784/SHA-256 is published, but a corresponding DNSKEY is not
	Found 2 RRSIGs over DNSKEY RRset
	`usembassy.gov. 15768000 IN RRSIG ( DNSKEY 8 2 15768000 20260822110305 20250822101508 2524 usembassy.gov. qJcQZI9L/2jFBOf7aq/vfIi3DPvDj2ac/oWnW1YMaU1DA/aIBPPcGJ0UNOat+UZokbTBwh3DBl6x F1vHeFcC8BvmIprmHll1dGbiGp/g8XkCWZN16qIeTvz17eG+bSO3PmN2YnExKunB38gfuN/LrLsE vq98XCacX0Oh0LDhGC2Zzfhx9bg1y6NzT5gj9Vc27BoW0fIe2oWxaACRDbq7OI+qkB1rH4sY8F7a Sdllrsyfki/pobUkTdor2LG/69XAHP8FLS7NmPkAVmCHJq3npRShVZBh6xJ0+2oTzcZnAeLN3nzb cJyPO6795TI76xj/5yfCmzFUagwfb+X3wX2WBw== )`
	`usembassy.gov. 15768000 IN RRSIG ( DNSKEY 8 2 15768000 20260822110305 20250822101508 8979 usembassy.gov. XcTqGyyvZNToo81On0StzZ8PbZ7V8z/+rr4nUdpwUvoTRmREWeyhOHwJKO7bH5a2iIZGSGmXy5S1 NoK1XaclsjXYQ5V6n3QY6YWGZAd0a7gQiGRoT/LRJdEL/mcRjT2FAoYY8Ca9Cy8JvNQ7dNHq9Ppi UJYwbd0Kqj1jQrnZUcaUH3S5pKIE5P0m0ZBt/2WQitpcGLu33ciuaBVugB3dSyRaEfaS1tbz/UWW nla8k24hQKExJePSjngcuFEWhVenxbuNPemPhEGHjOjfJV8ToP2uKD+n6w3r8O5jn/lQ4IRLuelS pKs75A1DWSUdXkqKs88+8qrooQz7Nrz9XI0qMw== )`
	RRSIG=2524 and DNSKEY=2524/SEP verifies the DNSKEY RRset
	RRSIG=8979 and DNSKEY=8979 verifies the DNSKEY RRset
	DNSKEY=40611 is now in the chain-of-trust
	DNSKEY=8979 is now in the chain-of-trust
	Query to a8-67.akam.net for www.usembassy.gov/A
	Received 390 bytes from 2.16.40.67
	;; Response received from [2.16.40.67] 390 octets ;; HEADER SECTION ;; id = 55788 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.usembassy.gov. IN A ;; ANSWER SECTION (2 records) www.usembassy.gov. 10800 IN CNAME d1oj4yrmnvvraf.cloudfront.net. www.usembassy.gov. 10800 IN RRSIG ( CNAME 8 3 10800 20260823202415 20250823195419 8979 usembassy.gov. VwaYyy9YdgmBTJN0BvxOIQPr61uGl5gMJOIeAs93kskAtawZaCg21zAph2ydDssh2f9rytae1TRP MUjdGXDNN4j9u+6MdhOUICU9Pu5IsVnBITMBcg7GGWFvPKfu3sZHzW8d4Y0/Qu+n+rMMB3LhhqIt qunuMDr+wwBgTSJKbEXFjNvL3i1kyeEc1xRIX/dZIjYWE4UxsnYYhFch56avIXpYIkS41K72JdqP gTXcLIe0/jLfG3mFlRBmb8Ga69NQ1wqukg/9janZkXIPeOKBQUcx+HaJopM4k8GqdBrhko0/5Y0D VKNEho4+sOyABblQUQp2mi5zlk/32aHikwDUcw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	a8-67.akam.net is authoritative for www.usembassy.gov
	Query to a14-64.akam.net for www.usembassy.gov/DNSKEY
	Received 390 bytes from 184.26.161.64
	;; Response received from [184.26.161.64] 390 octets ;; HEADER SECTION ;; id = 46578 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.usembassy.gov. IN DNSKEY ;; ANSWER SECTION (2 records) www.usembassy.gov. 10800 IN CNAME d1oj4yrmnvvraf.cloudfront.net. www.usembassy.gov. 10800 IN RRSIG ( CNAME 8 3 10800 20260823202415 20250823195419 8979 usembassy.gov. VwaYyy9YdgmBTJN0BvxOIQPr61uGl5gMJOIeAs93kskAtawZaCg21zAph2ydDssh2f9rytae1TRP MUjdGXDNN4j9u+6MdhOUICU9Pu5IsVnBITMBcg7GGWFvPKfu3sZHzW8d4Y0/Qu+n+rMMB3LhhqIt qunuMDr+wwBgTSJKbEXFjNvL3i1kyeEc1xRIX/dZIjYWE4UxsnYYhFch56avIXpYIkS41K72JdqP gTXcLIe0/jLfG3mFlRBmb8Ga69NQ1wqukg/9janZkXIPeOKBQUcx+HaJopM4k8GqdBrhko0/5Y0D VKNEho4+sOyABblQUQp2mi5zlk/32aHikwDUcw== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found RRSIG signed by usembassy.gov zone
	www.usembassy.gov is a CNAME to d1oj4yrmnvvraf.cloudfront.net
	Found 1 RRSIGs over CNAME RRset
	`www.usembassy.gov. 10800 IN RRSIG ( CNAME 8 3 10800 20260823202415 20250823195419 8979 usembassy.gov. VwaYyy9YdgmBTJN0BvxOIQPr61uGl5gMJOIeAs93kskAtawZaCg21zAph2ydDssh2f9rytae1TRP MUjdGXDNN4j9u+6MdhOUICU9Pu5IsVnBITMBcg7GGWFvPKfu3sZHzW8d4Y0/Qu+n+rMMB3LhhqIt qunuMDr+wwBgTSJKbEXFjNvL3i1kyeEc1xRIX/dZIjYWE4UxsnYYhFch56avIXpYIkS41K72JdqP gTXcLIe0/jLfG3mFlRBmb8Ga69NQ1wqukg/9janZkXIPeOKBQUcx+HaJopM4k8GqdBrhko0/5Y0D VKNEho4+sOyABblQUQp2mi5zlk/32aHikwDUcw== )`
	RRSIG=8979 and DNSKEY=8979 verifies the CNAME RRset

	Query to h.root-servers.net for d1oj4yrmnvvraf.cloudfront.net/A
	Received 1186 bytes from 198.97.190.53
	;; Response received from [198.97.190.53] 1186 octets ;; HEADER SECTION ;; id = 46818 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 15 arcount = 27 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) net. 172800 IN NS a.gtld-servers.net. net. 172800 IN NS b.gtld-servers.net. net. 172800 IN NS c.gtld-servers.net. net. 172800 IN NS d.gtld-servers.net. net. 172800 IN NS e.gtld-servers.net. net. 172800 IN NS f.gtld-servers.net. net. 172800 IN NS g.gtld-servers.net. net. 172800 IN NS h.gtld-servers.net. net. 172800 IN NS i.gtld-servers.net. net. 172800 IN NS j.gtld-servers.net. net. 172800 IN NS k.gtld-servers.net. net. 172800 IN NS l.gtld-servers.net. net. 172800 IN NS m.gtld-servers.net. net. 86400 IN DS ( 37331 13 2 2f0bec2d6f79dfbd1d08fd21a3af92d0e39a4b9ef1e3f4111fff282490da453b ) net. 86400 IN RRSIG ( DS 8 1 86400 20250928050000 20250915040000 46441 . s7Wl4vJuXM5xEIq5BAUxnPnxLW3jEwZuX2BPOK5vM4jgNDtk8QLrjnA/7o1s2+Ap8rpOVcXaWLs6 FIpILO/WxDUAvaPcpRSM0/rJ7BfByHQBdrRpOSWp+/cYFWS3zIU3Jnu90xKmTrY+1axpG633pQUn P4nBsatPJy67PtXeugd1y3lqpRdcfc4AtxEpXtpv6UnjhGEzfdfBE14xUly57I3X8+SxAZgxeoV4 mnHAUt85wwAUBvet/A4VJgpbvFMqZUi2TVYAQoPeVDwhnBlEZ86u80zjyypFd32ekhmjOFaEKA2V Z6mA5TBuPSZ51GRAJOWBEw5zALBJa4V+beaL/Q== ) ;; ADDITIONAL SECTION (27 records) a.gtld-servers.net. 172800 IN A 192.5.6.30 b.gtld-servers.net. 172800 IN A 192.33.14.30 c.gtld-servers.net. 172800 IN A 192.26.92.30 d.gtld-servers.net. 172800 IN A 192.31.80.30 e.gtld-servers.net. 172800 IN A 192.12.94.30 f.gtld-servers.net. 172800 IN A 192.35.51.30 g.gtld-servers.net. 172800 IN A 192.42.93.30 h.gtld-servers.net. 172800 IN A 192.54.112.30 i.gtld-servers.net. 172800 IN A 192.43.172.30 j.gtld-servers.net. 172800 IN A 192.48.79.30 k.gtld-servers.net. 172800 IN A 192.52.178.30 l.gtld-servers.net. 172800 IN A 192.41.162.30 m.gtld-servers.net. 172800 IN A 192.55.83.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 ;; { "EDNS-VERSION": 0 }
	Query to b.root-servers.net for net/DNSKEY
	Received 1160 bytes from 170.247.170.2
	;; Response received from [170.247.170.2] 1160 octets ;; HEADER SECTION ;; id = 55324 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 15 arcount = 27 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (15 records) net. 172800 IN NS a.gtld-servers.net. net. 172800 IN NS b.gtld-servers.net. net. 172800 IN NS c.gtld-servers.net. net. 172800 IN NS d.gtld-servers.net. net. 172800 IN NS e.gtld-servers.net. net. 172800 IN NS f.gtld-servers.net. net. 172800 IN NS g.gtld-servers.net. net. 172800 IN NS h.gtld-servers.net. net. 172800 IN NS i.gtld-servers.net. net. 172800 IN NS j.gtld-servers.net. net. 172800 IN NS k.gtld-servers.net. net. 172800 IN NS l.gtld-servers.net. net. 172800 IN NS m.gtld-servers.net. net. 86400 IN DS ( 37331 13 2 2f0bec2d6f79dfbd1d08fd21a3af92d0e39a4b9ef1e3f4111fff282490da453b ) net. 86400 IN RRSIG ( DS 8 1 86400 20250928050000 20250915040000 46441 . s7Wl4vJuXM5xEIq5BAUxnPnxLW3jEwZuX2BPOK5vM4jgNDtk8QLrjnA/7o1s2+Ap8rpOVcXaWLs6 FIpILO/WxDUAvaPcpRSM0/rJ7BfByHQBdrRpOSWp+/cYFWS3zIU3Jnu90xKmTrY+1axpG633pQUn P4nBsatPJy67PtXeugd1y3lqpRdcfc4AtxEpXtpv6UnjhGEzfdfBE14xUly57I3X8+SxAZgxeoV4 mnHAUt85wwAUBvet/A4VJgpbvFMqZUi2TVYAQoPeVDwhnBlEZ86u80zjyypFd32ekhmjOFaEKA2V Z6mA5TBuPSZ51GRAJOWBEw5zALBJa4V+beaL/Q== ) ;; ADDITIONAL SECTION (27 records) a.gtld-servers.net. 172800 IN A 192.5.6.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 b.gtld-servers.net. 172800 IN A 192.33.14.30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 c.gtld-servers.net. 172800 IN A 192.26.92.30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 d.gtld-servers.net. 172800 IN A 192.31.80.30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 e.gtld-servers.net. 172800 IN A 192.12.94.30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 f.gtld-servers.net. 172800 IN A 192.35.51.30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 g.gtld-servers.net. 172800 IN A 192.42.93.30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 h.gtld-servers.net. 172800 IN A 192.54.112.30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 i.gtld-servers.net. 172800 IN A 192.43.172.30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 j.gtld-servers.net. 172800 IN A 192.48.79.30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 k.gtld-servers.net. 172800 IN A 192.52.178.30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 l.gtld-servers.net. 172800 IN A 192.41.162.30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 m.gtld-servers.net. 172800 IN A 192.55.83.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 ;; { "EDNS-VERSION": 0 }
	Found child zone net

net

	Checking DS between . and net
	Query to h.root-servers.net for net/DS
	Received 367 bytes from 198.97.190.53
	;; Response received from [198.97.190.53] 367 octets ;; HEADER SECTION ;; id = 16358 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; net. IN DS ;; ANSWER SECTION (2 records) net. 86400 IN DS ( 37331 13 2 2f0bec2d6f79dfbd1d08fd21a3af92d0e39a4b9ef1e3f4111fff282490da453b ) net. 86400 IN RRSIG ( DS 8 1 86400 20250928050000 20250915040000 46441 . s7Wl4vJuXM5xEIq5BAUxnPnxLW3jEwZuX2BPOK5vM4jgNDtk8QLrjnA/7o1s2+Ap8rpOVcXaWLs6 FIpILO/WxDUAvaPcpRSM0/rJ7BfByHQBdrRpOSWp+/cYFWS3zIU3Jnu90xKmTrY+1axpG633pQUn P4nBsatPJy67PtXeugd1y3lqpRdcfc4AtxEpXtpv6UnjhGEzfdfBE14xUly57I3X8+SxAZgxeoV4 mnHAUt85wwAUBvet/A4VJgpbvFMqZUi2TVYAQoPeVDwhnBlEZ86u80zjyypFd32ekhmjOFaEKA2V Z6mA5TBuPSZ51GRAJOWBEw5zALBJa4V+beaL/Q== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for net in the . zone
	DS=37331/SHA-256 has algorithm ECDSAP256SHA256
	Found 1 RRSIGs over DS RRset
	`net. 86400 IN RRSIG ( DS 8 1 86400 20250928050000 20250915040000 46441 . s7Wl4vJuXM5xEIq5BAUxnPnxLW3jEwZuX2BPOK5vM4jgNDtk8QLrjnA/7o1s2+Ap8rpOVcXaWLs6 FIpILO/WxDUAvaPcpRSM0/rJ7BfByHQBdrRpOSWp+/cYFWS3zIU3Jnu90xKmTrY+1axpG633pQUn P4nBsatPJy67PtXeugd1y3lqpRdcfc4AtxEpXtpv6UnjhGEzfdfBE14xUly57I3X8+SxAZgxeoV4 mnHAUt85wwAUBvet/A4VJgpbvFMqZUi2TVYAQoPeVDwhnBlEZ86u80zjyypFd32ekhmjOFaEKA2V Z6mA5TBuPSZ51GRAJOWBEw5zALBJa4V+beaL/Q== )`
	RRSIG=46441 and DNSKEY=46441 verifies the DS RRset
	DS=37331/SHA-256 is now in the chain-of-trust
	`net. 86400 IN DS ( 37331 13 2 2f0bec2d6f79dfbd1d08fd21a3af92d0e39a4b9ef1e3f4111fff282490da453b )`
	Query to g.gtld-servers.net for net/DNSKEY
	Received 291 bytes from 192.42.93.30
	;; Response received from [192.42.93.30] 291 octets ;; HEADER SECTION ;; id = 50924 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 3 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; net. IN DNSKEY ;; ANSWER SECTION (3 records) net. 86400 IN DNSKEY ( 257 3 13 HiBoGpzDRAgrDmUXXTSnl7jCX6Hx5bzkU2jSxMbVI01yS+13EyOghnCidBXU0bH2gi2w9GhYGacp U6CrtwoFNg== ) ; keytag 37331 net. 86400 IN DNSKEY ( 256 3 13 BwmuZTRDEnF5yIylRPdiibpfukzvMWY569GigcA4DNHHhLWxndFz8tUHIfAyY9AAVdX9hfRoRvnr 2OThC4+7Hg== ) ; keytag 33296 net. 86400 IN RRSIG ( DNSKEY 13 1 86400 20250924141035 20250909140535 37331 net. ZsvQngDbHjU/4ysaofreMhZ/h/9Avi0TC0QZwO/naxdPNq7cuo5xH4FQbd6MFaDcF9lNMs2O9Fqe EIFLRUsSvg== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 2 DNSKEY records for net
	`net. 86400 IN DNSKEY ( 257 3 13 HiBoGpzDRAgrDmUXXTSnl7jCX6Hx5bzkU2jSxMbVI01yS+13EyOghnCidBXU0bH2gi2w9GhYGacp U6CrtwoFNg== ) ; keytag 37331`
	`net. 86400 IN DNSKEY ( 256 3 13 BwmuZTRDEnF5yIylRPdiibpfukzvMWY569GigcA4DNHHhLWxndFz8tUHIfAyY9AAVdX9hfRoRvnr 2OThC4+7Hg== ) ; keytag 33296`
	DNSKEY=37331/SEP is now in the chain-of-trust
	DS=37331/SHA-256 verifies DNSKEY=37331/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`net. 86400 IN RRSIG ( DNSKEY 13 1 86400 20250924141035 20250909140535 37331 net. ZsvQngDbHjU/4ysaofreMhZ/h/9Avi0TC0QZwO/naxdPNq7cuo5xH4FQbd6MFaDcF9lNMs2O9Fqe EIFLRUsSvg== )`
	RRSIG=37331 and DNSKEY=37331/SEP verifies the DNSKEY RRset
	DNSKEY=33296 is now in the chain-of-trust
	Query to k.gtld-servers.net for d1oj4yrmnvvraf.cloudfront.net/A
	Received 568 bytes from 192.52.178.30
	;; Response received from [192.52.178.30] 568 octets ;; HEADER SECTION ;; id = 29102 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 2 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) cloudfront.net. 172800 IN NS ns-666.awsdns-19.net. cloudfront.net. 172800 IN NS ns-418.awsdns-52.com. cloudfront.net. 172800 IN NS ns-1597.awsdns-07.co.uk. cloudfront.net. 172800 IN NS ns-1306.awsdns-35.org. A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 900 IN NSEC3 ( 1 1 0 - a1rtlnpgulogn7b9a62shje1u3ttp8dr NS SOA RRSIG DNSKEY NSEC3PARAM ) A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 900 IN RRSIG ( NSEC3 13 2 900 20250920030542 20250913015542 33296 net. SZ5B4TI+zAAuSLXBN/WY24JnhWr6202DBIzRARcW5cxTUUZ1XojYTN729H29lItNaP9tXUEfjLJS e/wOjFAkGw== ) FADFU252JJL6DOJN36VP2CSQAMCD7R98.net. 900 IN NSEC3 ( 1 1 0 - fadh7kgl8g232b3m9jmhhmagat37ojk3 NS DS RRSIG ) FADFU252JJL6DOJN36VP2CSQAMCD7R98.net. 900 IN RRSIG ( NSEC3 13 2 900 20250921031128 20250914020128 33296 net. xLVrXReYv4eNf5k/Ns5CsOl4p17pIrCJP/ZFs0m4hmYCbcMTK+OMfpOmo3I1Vz5StjJBZyZotMCh xUfU6ngU1w== ) ;; ADDITIONAL SECTION (2 records) ns-666.awsdns-19.net. 172800 IN A 205.251.194.154 ;; { "EDNS-VERSION": 0 }
	Query to i.gtld-servers.net for cloudfront.net/DNSKEY
	Received 553 bytes from 192.43.172.30
	;; Response received from [192.43.172.30] 553 octets ;; HEADER SECTION ;; id = 41586 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 2 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cloudfront.net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) cloudfront.net. 172800 IN NS ns-666.awsdns-19.net. cloudfront.net. 172800 IN NS ns-418.awsdns-52.com. cloudfront.net. 172800 IN NS ns-1597.awsdns-07.co.uk. cloudfront.net. 172800 IN NS ns-1306.awsdns-35.org. A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 900 IN NSEC3 ( 1 1 0 - a1rtlnpgulogn7b9a62shje1u3ttp8dr NS SOA RRSIG DNSKEY NSEC3PARAM ) A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 900 IN RRSIG ( NSEC3 13 2 900 20250920030542 20250913015542 33296 net. SZ5B4TI+zAAuSLXBN/WY24JnhWr6202DBIzRARcW5cxTUUZ1XojYTN729H29lItNaP9tXUEfjLJS e/wOjFAkGw== ) FADFU252JJL6DOJN36VP2CSQAMCD7R98.net. 900 IN NSEC3 ( 1 1 0 - fadh7kgl8g232b3m9jmhhmagat37ojk3 NS DS RRSIG ) FADFU252JJL6DOJN36VP2CSQAMCD7R98.net. 900 IN RRSIG ( NSEC3 13 2 900 20250921031128 20250914020128 33296 net. xLVrXReYv4eNf5k/Ns5CsOl4p17pIrCJP/ZFs0m4hmYCbcMTK+OMfpOmo3I1Vz5StjJBZyZotMCh xUfU6ngU1w== ) ;; ADDITIONAL SECTION (2 records) ns-666.awsdns-19.net. 172800 IN A 205.251.194.154 ;; { "EDNS-VERSION": 0 }
	Found child zone cloudfront.net

cloudfront.net

	Checking DS between net and cloudfront.net
	Query to j.gtld-servers.net for cloudfront.net/DS
	Received 572 bytes from 192.48.79.30
	;; Response received from [192.48.79.30] 572 octets ;; HEADER SECTION ;; id = 36522 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cloudfront.net. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 900 IN NSEC3 ( 1 1 0 - a1rtlnpgulogn7b9a62shje1u3ttp8dr NS SOA RRSIG DNSKEY NSEC3PARAM ) A1RT98BS5QGC9NFI51S9HCI47ULJG6JH.net. 900 IN RRSIG ( NSEC3 13 2 900 20250920030542 20250913015542 33296 net. SZ5B4TI+zAAuSLXBN/WY24JnhWr6202DBIzRARcW5cxTUUZ1XojYTN729H29lItNaP9tXUEfjLJS e/wOjFAkGw== ) net. 900 IN SOA ( a.gtld-servers.net. nstld.verisign-grs.com. 1757933930 ;serial 1800 ;refresh 900 ;retry 604800 ;expire 900 ;minimum ) net. 900 IN RRSIG ( SOA 13 1 900 20250922105850 20250915094850 33296 net. oocP6jaNM5wMA75gacpz1nYUNG/A+KQW9KbKIwki/WtmoIEJh+ZykvKDpSA/BragjN1sGTNwaYqZ mM4of7K+HQ== ) FADFU252JJL6DOJN36VP2CSQAMCD7R98.net. 900 IN NSEC3 ( 1 1 0 - fadh7kgl8g232b3m9jmhhmagat37ojk3 NS DS RRSIG ) FADFU252JJL6DOJN36VP2CSQAMCD7R98.net. 900 IN RRSIG ( NSEC3 13 2 900 20250921031128 20250914020128 33296 net. xLVrXReYv4eNf5k/Ns5CsOl4p17pIrCJP/ZFs0m4hmYCbcMTK+OMfpOmo3I1Vz5StjJBZyZotMCh xUfU6ngU1w== ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DS records found for cloudfront.net in the net zone
	Query to ns-1306.awsdns-35.org for cloudfront.net/DNSKEY
	Received 110 bytes from 205.251.197.26
	;; Response received from [205.251.197.26] 110 octets ;; HEADER SECTION ;; id = 14566 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 1 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; cloudfront.net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) cloudfront.net. 60 IN SOA ( ns-418.awsdns-52.com. hostmaster.cloudfront.net. 1377556270 ;serial 16384 ;refresh 2048 ;retry 1048576 ;expire 60 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DNSKEY records found
	Query to ns-418.awsdns-52.com for d1oj4yrmnvvraf.cloudfront.net/A
	Received 195 bytes from 205.251.193.162
	;; Response received from [205.251.193.162] 195 octets ;; HEADER SECTION ;; id = 60818 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns-666.awsdns-19.net for d1oj4yrmnvvraf.cloudfront.net/DNSKEY
	Received 195 bytes from 205.251.194.154
	;; Response received from [205.251.194.154] 195 octets ;; HEADER SECTION ;; id = 39777 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 1831 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone d1oj4yrmnvvraf.cloudfront.net

d1oj4yrmnvvraf.cloudfront.net

	Checking DS between cloudfront.net and d1oj4yrmnvvraf.cloudfront.net
	Query to ns-418.awsdns-52.com for d1oj4yrmnvvraf.cloudfront.net/DS
	Received 125 bytes from 205.251.193.162
	;; Response received from [205.251.193.162] 125 octets ;; HEADER SECTION ;; id = 61840 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 1 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) cloudfront.net. 60 IN SOA ( ns-418.awsdns-52.com. hostmaster.cloudfront.net. 1377556270 ;serial 16384 ;refresh 2048 ;retry 1048576 ;expire 60 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DS records found for d1oj4yrmnvvraf.cloudfront.net in the cloudfront.net zone
	Query to ns-605.awsdns-11.net for d1oj4yrmnvvraf.cloudfront.net/DNSKEY
	Received 143 bytes from 205.251.194.93
	;; Response received from [205.251.194.93] 143 octets ;; HEADER SECTION ;; id = 27378 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 1 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) d1oj4yrmnvvraf.cloudfront.net. 60 IN SOA ( ns-1135.awsdns-13.org. awsdns-hostmaster.amazon.com. 1 ;serial 7200 ;refresh 900 ;retry 1209600 ;expire 86400 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DNSKEY records found
	Query to ns-171.awsdns-21.com for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.192.171
	;; Response received from [205.251.192.171] 259 octets ;; HEADER SECTION ;; id = 23695 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns-171.awsdns-21.com is authoritative for d1oj4yrmnvvraf.cloudfront.net
	Query to ns-1135.awsdns-13.org for d1oj4yrmnvvraf.cloudfront.net/SOA
	Received 256 bytes from 205.251.196.111
	;; Response received from [205.251.196.111] 256 octets ;; HEADER SECTION ;; id = 44205 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 1 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN SOA ;; ANSWER SECTION (1 record) d1oj4yrmnvvraf.cloudfront.net. 60 IN SOA ( ns-1135.awsdns-13.org. awsdns-hostmaster.amazon.com. 1 ;serial 7200 ;refresh 900 ;retry 1209600 ;expire 86400 ;minimum ) ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns-605.awsdns-11.net for d1oj4yrmnvvraf.cloudfront.net/SOA
	Received 256 bytes from 205.251.194.93
	;; Response received from [205.251.194.93] 256 octets ;; HEADER SECTION ;; id = 62924 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 1 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN SOA ;; ANSWER SECTION (1 record) d1oj4yrmnvvraf.cloudfront.net. 60 IN SOA ( ns-1135.awsdns-13.org. awsdns-hostmaster.amazon.com. 1 ;serial 7200 ;refresh 900 ;retry 1209600 ;expire 86400 ;minimum ) ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns-1866.awsdns-41.co.uk for d1oj4yrmnvvraf.cloudfront.net/SOA
	Received 256 bytes from 205.251.199.74
	;; Response received from [205.251.199.74] 256 octets ;; HEADER SECTION ;; id = 27987 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 1 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN SOA ;; ANSWER SECTION (1 record) d1oj4yrmnvvraf.cloudfront.net. 60 IN SOA ( ns-1135.awsdns-13.org. awsdns-hostmaster.amazon.com. 1 ;serial 7200 ;refresh 900 ;retry 1209600 ;expire 86400 ;minimum ) ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to ns-171.awsdns-21.com for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.192.171
	;; Response received from [205.251.192.171] 259 octets ;; HEADER SECTION ;; id = 61075 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.29
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.2
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.7
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.120
	No RRSIGs found

d1oj4yrmnvvraf.cloudfront.net

	Query to ns-1135.awsdns-13.org for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.196.111
	;; Response received from [205.251.196.111] 259 octets ;; HEADER SECTION ;; id = 5122 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns-1135.awsdns-13.org is authoritative for d1oj4yrmnvvraf.cloudfront.net
	Query to ns-1135.awsdns-13.org for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.196.111
	;; Response received from [205.251.196.111] 259 octets ;; HEADER SECTION ;; id = 2979 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.7
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.29
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.120
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.2
	No RRSIGs found

d1oj4yrmnvvraf.cloudfront.net

	Query to ns-1866.awsdns-41.co.uk for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.199.74
	;; Response received from [205.251.199.74] 259 octets ;; HEADER SECTION ;; id = 22231 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns-1866.awsdns-41.co.uk is authoritative for d1oj4yrmnvvraf.cloudfront.net
	Query to ns-1866.awsdns-41.co.uk for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.199.74
	;; Response received from [205.251.199.74] 259 octets ;; HEADER SECTION ;; id = 38093 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.2
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.29
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.120
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.7
	No RRSIGs found

d1oj4yrmnvvraf.cloudfront.net

	Query to ns-605.awsdns-11.net for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.194.93
	;; Response received from [205.251.194.93] 259 octets ;; HEADER SECTION ;; id = 8464 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.2 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.29 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.120 d1oj4yrmnvvraf.cloudfront.net. 60 IN A 3.171.85.7 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	ns-605.awsdns-11.net is authoritative for d1oj4yrmnvvraf.cloudfront.net
	Query to ns-605.awsdns-11.net for d1oj4yrmnvvraf.cloudfront.net/A
	Received 259 bytes from 205.251.194.93
	;; Response received from [205.251.194.93] 259 octets ;; HEADER SECTION ;; id = 46919 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 1 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 4 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; d1oj4yrmnvvraf.cloudfront.net. IN A ;; ANSWER SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 59 IN A 3.171.85.7 d1oj4yrmnvvraf.cloudfront.net. 59 IN A 3.171.85.2 d1oj4yrmnvvraf.cloudfront.net. 59 IN A 3.171.85.120 d1oj4yrmnvvraf.cloudfront.net. 59 IN A 3.171.85.29 ;; AUTHORITY SECTION (4 records) d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1135.awsdns-13.org. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-171.awsdns-21.com. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-1866.awsdns-41.co.uk. d1oj4yrmnvvraf.cloudfront.net. 172800 IN NS ns-605.awsdns-11.net. ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.7
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.2
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.120
	d1oj4yrmnvvraf.cloudfront.net A RR has value 3.171.85.29
	No RRSIGs found

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test www.usembassy.gov at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: