DNSSEC Debugger - www.zgt.de

Domain Name:

Time: 2025-02-15 09:33:56 UTC

Analyzing DNSSEC problems for www.zgt.de

DS=20326/SHA-256 is now in the chain-of-trust

	Checking DS between Trust Anchor and .
	`. IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )`
	Query to b.root-servers.net for ./DNSKEY
	Received 1139 bytes from 170.247.170.2
	;; Response received from [170.247.170.2] 1139 octets ;; HEADER SECTION ;; id = 25224 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; . IN DNSKEY ;; ANSWER SECTION (4 records) . 172800 IN DNSKEY ( 256 3 8 AwEAAZ5A7jOztf62cGqhPhutjnyl7KBjIsjbyTb8il+FsgbMUbO2NQHaSbatHdlOlqANncDwSIKZ 9ryqd1+Dy1PoGzeTUv95vOJnVVJHlJu7xdavnUmPs+Mh2NV7hDlTTwPn5uXgFxAaxoO9M/YIAC92 GryCLjoJEg9JzeevkktEM/sFpmRv4I5jQtlLyRqVbnCzcWpi04XaVLxRKvURkd/Mdb/2RQS3MYvr kEBXuqtnAVBCf6Fx4sgBYOfYvbUuG2diLnGJW/MXvFpctZgQ76+3FwMqAZfR9k5bohL7AF3+jqz4 MUiootYoh5koyt7VEnUULxxy6U5PINTGgOC26f3zZuk= ) ; keytag 26470 . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326 . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696 . 172800 IN RRSIG ( DNSKEY 8 0 172800 20250303000000 20250210000000 20326 . ZmOemMGLOMIaulJ6x69cRQw2fXloQIbGRJIBAfey6RVjlI9KFDkuaiaK/GDX1z3VgHM3BFfe5Mt5 y3q7bjb4lte/4rKybSu2y9GUUV0AOAPORu46B5f3nhOpWVlDefHmYhqAgHkPq/qsX27wp+XkNnPu UsjN+Ki+EbmSJCMvCfD3+mzirmtrDLC7hrCwKcBx3vEncFuv+e8xp4V8kHWYMeaEj+PqA9JrFcDN NLtZPbcgJsCBYia0WQPwVYBKtVlJHzzOR7bjlxkwwaGgtqGm2fUYhl2BsYk8bPmjg2Wj774CWEu7 ssM0ynnwP+nDxCK9RJej2mY9cD7SBDEzzVni1w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for .
	`. 172800 IN DNSKEY ( 256 3 8 AwEAAZ5A7jOztf62cGqhPhutjnyl7KBjIsjbyTb8il+FsgbMUbO2NQHaSbatHdlOlqANncDwSIKZ 9ryqd1+Dy1PoGzeTUv95vOJnVVJHlJu7xdavnUmPs+Mh2NV7hDlTTwPn5uXgFxAaxoO9M/YIAC92 GryCLjoJEg9JzeevkktEM/sFpmRv4I5jQtlLyRqVbnCzcWpi04XaVLxRKvURkd/Mdb/2RQS3MYvr kEBXuqtnAVBCf6Fx4sgBYOfYvbUuG2diLnGJW/MXvFpctZgQ76+3FwMqAZfR9k5bohL7AF3+jqz4 MUiootYoh5koyt7VEnUULxxy6U5PINTGgOC26f3zZuk= ) ; keytag 26470`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326`
	`. 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696`
	DNSKEY=20326/SEP is now in the chain-of-trust
	DS=20326/SHA-256 verifies DNSKEY=20326/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`. 172800 IN RRSIG ( DNSKEY 8 0 172800 20250303000000 20250210000000 20326 . ZmOemMGLOMIaulJ6x69cRQw2fXloQIbGRJIBAfey6RVjlI9KFDkuaiaK/GDX1z3VgHM3BFfe5Mt5 y3q7bjb4lte/4rKybSu2y9GUUV0AOAPORu46B5f3nhOpWVlDefHmYhqAgHkPq/qsX27wp+XkNnPu UsjN+Ki+EbmSJCMvCfD3+mzirmtrDLC7hrCwKcBx3vEncFuv+e8xp4V8kHWYMeaEj+PqA9JrFcDN NLtZPbcgJsCBYia0WQPwVYBKtVlJHzzOR7bjlxkwwaGgtqGm2fUYhl2BsYk8bPmjg2Wj774CWEu7 ssM0ynnwP+nDxCK9RJej2mY9cD7SBDEzzVni1w== )`
	RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
	DNSKEY=26470 is now in the chain-of-trust
	DNSKEY=38696/SEP is now in the chain-of-trust
	Query to b.root-servers.net for www.zgt.de/A
	Received 750 bytes from 170.247.170.2
	;; Response received from [170.247.170.2] 750 octets ;; HEADER SECTION ;; id = 13263 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.zgt.de. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) de. 172800 IN NS a.nic.de. de. 172800 IN NS f.nic.de. de. 172800 IN NS l.de.net. de. 172800 IN NS n.de.net. de. 172800 IN NS s.de.net. de. 172800 IN NS z.nic.de. de. 86400 IN DS ( 26755 8 2 f341357809a5954311ccb82ade114c6c1d724a75c0395137aa3978035425e78d ) de. 86400 IN RRSIG ( DS 8 1 86400 20250228050000 20250215040000 26470 . iW8gbLvL72sNWj291QXkRIAcNOcyRB3GAuqSoa6Y6iiQJ3F3WHPHNoKuEDFS3+K9un2bZCyAEg/P uFjjUC8RtqMTdaFQXGPmRpeLZesDqpcVSiq2XVr4E+CnbNApe9TQ4ZwSYXuLri6u5i7oEWOSza/s efXgWlu/wN+Wf5yqeo+SlUXuxIbzNFVY42H39fzlip79af64C8kW9GwbiDgn5u8NuuDiGMv1trzF PAZo/llrS9RbyH+GE0I9jPcGrlV+tYI4jvKsOgNAvQcgywAygcFj9q6U9VHXPqQrjFG3mAmqjo9g uWFK1UP3I+uFIEvJohQKBaRHHUk2DN2joNvB8w== ) ;; ADDITIONAL SECTION (13 records) a.nic.de. 172800 IN A 194.0.0.53 a.nic.de. 172800 IN AAAA 2001:678:2::53 f.nic.de. 172800 IN A 81.91.164.5 f.nic.de. 172800 IN AAAA 2a02:568:0:2::53 z.nic.de. 172800 IN A 194.246.96.1 z.nic.de. 172800 IN AAAA 2a02:568:fe02::de l.de.net. 172800 IN A 77.67.63.105 l.de.net. 172800 IN AAAA 2001:668:1f:11::105 n.de.net. 172800 IN A 194.146.107.6 n.de.net. 172800 IN AAAA 2001:67c:1011:1::53 s.de.net. 172800 IN A 195.243.137.26 s.de.net. 172800 IN AAAA 2003:8:14::53 ;; { "EDNS-VERSION": 0 }
	Query to m.root-servers.net for de/DNSKEY
	Received 738 bytes from 202.12.27.33
	;; Response received from [202.12.27.33] 738 octets ;; HEADER SECTION ;; id = 61605 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 8 arcount = 13 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; de. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (8 records) de. 172800 IN NS a.nic.de. de. 172800 IN NS l.de.net. de. 172800 IN NS s.de.net. de. 172800 IN NS n.de.net. de. 172800 IN NS f.nic.de. de. 172800 IN NS z.nic.de. de. 86400 IN DS ( 26755 8 2 f341357809a5954311ccb82ade114c6c1d724a75c0395137aa3978035425e78d ) de. 86400 IN RRSIG ( DS 8 1 86400 20250228050000 20250215040000 26470 . iW8gbLvL72sNWj291QXkRIAcNOcyRB3GAuqSoa6Y6iiQJ3F3WHPHNoKuEDFS3+K9un2bZCyAEg/P uFjjUC8RtqMTdaFQXGPmRpeLZesDqpcVSiq2XVr4E+CnbNApe9TQ4ZwSYXuLri6u5i7oEWOSza/s efXgWlu/wN+Wf5yqeo+SlUXuxIbzNFVY42H39fzlip79af64C8kW9GwbiDgn5u8NuuDiGMv1trzF PAZo/llrS9RbyH+GE0I9jPcGrlV+tYI4jvKsOgNAvQcgywAygcFj9q6U9VHXPqQrjFG3mAmqjo9g uWFK1UP3I+uFIEvJohQKBaRHHUk2DN2joNvB8w== ) ;; ADDITIONAL SECTION (13 records) z.nic.de. 172800 IN A 194.246.96.1 s.de.net. 172800 IN A 195.243.137.26 n.de.net. 172800 IN A 194.146.107.6 l.de.net. 172800 IN A 77.67.63.105 f.nic.de. 172800 IN A 81.91.164.5 a.nic.de. 172800 IN A 194.0.0.53 z.nic.de. 172800 IN AAAA 2a02:568:fe02::de s.de.net. 172800 IN AAAA 2003:8:14::53 n.de.net. 172800 IN AAAA 2001:67c:1011:1::53 l.de.net. 172800 IN AAAA 2001:668:1f:11::105 f.nic.de. 172800 IN AAAA 2a02:568:0:2::53 a.nic.de. 172800 IN AAAA 2001:678:2::53 ;; { "EDNS-VERSION": 0 }
	Found child zone de

	Checking DS between . and de
	Query to e.root-servers.net for de/DS
	Received 366 bytes from 192.203.230.10
	;; Response received from [192.203.230.10] 366 octets ;; HEADER SECTION ;; id = 57728 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 2 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1472, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; de. IN DS ;; ANSWER SECTION (2 records) de. 86400 IN DS ( 26755 8 2 f341357809a5954311ccb82ade114c6c1d724a75c0395137aa3978035425e78d ) de. 86400 IN RRSIG ( DS 8 1 86400 20250228050000 20250215040000 26470 . iW8gbLvL72sNWj291QXkRIAcNOcyRB3GAuqSoa6Y6iiQJ3F3WHPHNoKuEDFS3+K9un2bZCyAEg/P uFjjUC8RtqMTdaFQXGPmRpeLZesDqpcVSiq2XVr4E+CnbNApe9TQ4ZwSYXuLri6u5i7oEWOSza/s efXgWlu/wN+Wf5yqeo+SlUXuxIbzNFVY42H39fzlip79af64C8kW9GwbiDgn5u8NuuDiGMv1trzF PAZo/llrS9RbyH+GE0I9jPcGrlV+tYI4jvKsOgNAvQcgywAygcFj9q6U9VHXPqQrjFG3mAmqjo9g uWFK1UP3I+uFIEvJohQKBaRHHUk2DN2joNvB8w== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 1 DS records for de in the . zone
	DS=26755/SHA-256 has algorithm RSASHA256
	Found 1 RRSIGs over DS RRset
	`de. 86400 IN RRSIG ( DS 8 1 86400 20250228050000 20250215040000 26470 . iW8gbLvL72sNWj291QXkRIAcNOcyRB3GAuqSoa6Y6iiQJ3F3WHPHNoKuEDFS3+K9un2bZCyAEg/P uFjjUC8RtqMTdaFQXGPmRpeLZesDqpcVSiq2XVr4E+CnbNApe9TQ4ZwSYXuLri6u5i7oEWOSza/s efXgWlu/wN+Wf5yqeo+SlUXuxIbzNFVY42H39fzlip79af64C8kW9GwbiDgn5u8NuuDiGMv1trzF PAZo/llrS9RbyH+GE0I9jPcGrlV+tYI4jvKsOgNAvQcgywAygcFj9q6U9VHXPqQrjFG3mAmqjo9g uWFK1UP3I+uFIEvJohQKBaRHHUk2DN2joNvB8w== )`
	RRSIG=26470 and DNSKEY=26470 verifies the DS RRset
	DS=26755/SHA-256 is now in the chain-of-trust
	`de. 86400 IN DS ( 26755 8 2 f341357809a5954311ccb82ade114c6c1d724a75c0395137aa3978035425e78d )`
	Query to f.nic.de for de/DNSKEY
	Received 893 bytes from 81.91.164.5
	;; Response received from [81.91.164.5] 893 octets ;; HEADER SECTION ;; id = 50953 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 4 ;; nscount = 0 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1452, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; de. IN DNSKEY ;; ANSWER SECTION (4 records) de. 86400 IN DNSKEY ( 256 3 8 AwEAAata8aa1qzM+cs11kGDWDPggJFL0n7AnB1giF1r3TC/E0bNzL12Rhb8W9sdms9BsSCSa/ds+ Y8a041N6lkgAATNZDnzO78ysBKKtZXgnxxveU19ElaaPansC7ndSu+ZrohF91hpyLrQGAd7/aWZx 9RrTVpcbenamUtWn/+rFDBTb ) ; keytag 22128 de. 86400 IN DNSKEY ( 256 3 8 AwEAAa62SR9lXNlgD43jUxXbxioPfCcW7kozLAdIYeugSrIq2GQglEitMJwNfnSnoBv8VhfyP0d9 VO/P11OnaCE8eIOEhEhRaOlfus+UG0z14ubYdBX4djzBUjCsSv1AEHJ0dnOBWkM9d/1yRSH7glGd Fm2e9hx/xqCj0c8sht2KtUOr ) ; keytag 4260 de. 86400 IN DNSKEY ( 257 3 8 AwEAAbWUSd/QN9Ae543xzdiacY6qbjwtZ21QfmdgxRdm4Z7bjjHWy249uqxCyjjjoS4LDoRDKmj7 ElffMKvTWKE1qFKu0p8TUy4wyhX0M+m5FUjvQ3CiZMi+qY7GSHA5B+Zd73cidmnTeb3e8lso6jEs Xg05/VZ2AyAqWF6FexEIFxIqiwwLk4UP0BwZ17Ur3q1qx9VSbPMyHgQ9d6nHUN1EEJsTDA2v0vKu msUyp74ZanRZ/bB/6IzpaaZyr5BLF5pSCNdbRNjVmkwYD0993vm79LueyOeibsoHRc16jhALrIJo u1PFjdq7YQsYN0KtqRiJtaAfPprDBREpeamPuW/MnW0= ) ; keytag 26755 de. 86400 IN RRSIG ( DNSKEY 8 1 86400 20250227191024 20250213174024 26755 de. TKEdtZUcE2Zn3aMJo4ji0Iab9KsVv+17nWna7FF1XdPXnUKFdHtGYMwBmYOH84h6+iyNpIO6udTe 07VXHs5mvGRGVS9iEBHEa2aeBZc/M47LCCFx/uXkqFzR458n75bg5AXdWTrY+dk1XYVOPi605BCw VpvFBcXip0YcGIeGOc1Zr1KZR3XuwqbDPx8q3hcvTBTOw0UlJxyfVnWGuSCLt7SapcfFH9Sqehx8 GlxCtoT96Gwn4iOyh09g6E/oUTOKH6ZR/89sZi21mGCzy0hWiUgbOgY8xpgAUzNbx3mo9pKW4y8C NyvQXxP8+8/8hfechAeA00EoFND7amnabFnO6A== ) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found 3 DNSKEY records for de
	`de. 86400 IN DNSKEY ( 256 3 8 AwEAAata8aa1qzM+cs11kGDWDPggJFL0n7AnB1giF1r3TC/E0bNzL12Rhb8W9sdms9BsSCSa/ds+ Y8a041N6lkgAATNZDnzO78ysBKKtZXgnxxveU19ElaaPansC7ndSu+ZrohF91hpyLrQGAd7/aWZx 9RrTVpcbenamUtWn/+rFDBTb ) ; keytag 22128`
	`de. 86400 IN DNSKEY ( 256 3 8 AwEAAa62SR9lXNlgD43jUxXbxioPfCcW7kozLAdIYeugSrIq2GQglEitMJwNfnSnoBv8VhfyP0d9 VO/P11OnaCE8eIOEhEhRaOlfus+UG0z14ubYdBX4djzBUjCsSv1AEHJ0dnOBWkM9d/1yRSH7glGd Fm2e9hx/xqCj0c8sht2KtUOr ) ; keytag 4260`
	`de. 86400 IN DNSKEY ( 257 3 8 AwEAAbWUSd/QN9Ae543xzdiacY6qbjwtZ21QfmdgxRdm4Z7bjjHWy249uqxCyjjjoS4LDoRDKmj7 ElffMKvTWKE1qFKu0p8TUy4wyhX0M+m5FUjvQ3CiZMi+qY7GSHA5B+Zd73cidmnTeb3e8lso6jEs Xg05/VZ2AyAqWF6FexEIFxIqiwwLk4UP0BwZ17Ur3q1qx9VSbPMyHgQ9d6nHUN1EEJsTDA2v0vKu msUyp74ZanRZ/bB/6IzpaaZyr5BLF5pSCNdbRNjVmkwYD0993vm79LueyOeibsoHRc16jhALrIJo u1PFjdq7YQsYN0KtqRiJtaAfPprDBREpeamPuW/MnW0= ) ; keytag 26755`
	DNSKEY=26755/SEP is now in the chain-of-trust
	DS=26755/SHA-256 verifies DNSKEY=26755/SEP
	Found 1 RRSIGs over DNSKEY RRset
	`de. 86400 IN RRSIG ( DNSKEY 8 1 86400 20250227191024 20250213174024 26755 de. TKEdtZUcE2Zn3aMJo4ji0Iab9KsVv+17nWna7FF1XdPXnUKFdHtGYMwBmYOH84h6+iyNpIO6udTe 07VXHs5mvGRGVS9iEBHEa2aeBZc/M47LCCFx/uXkqFzR458n75bg5AXdWTrY+dk1XYVOPi605BCw VpvFBcXip0YcGIeGOc1Zr1KZR3XuwqbDPx8q3hcvTBTOw0UlJxyfVnWGuSCLt7SapcfFH9Sqehx8 GlxCtoT96Gwn4iOyh09g6E/oUTOKH6ZR/89sZi21mGCzy0hWiUgbOgY8xpgAUzNbx3mo9pKW4y8C NyvQXxP8+8/8hfechAeA00EoFND7amnabFnO6A== )`
	RRSIG=26755 and DNSKEY=26755/SEP verifies the DNSKEY RRset
	DNSKEY=22128 is now in the chain-of-trust
	DNSKEY=4260 is now in the chain-of-trust
	Query to l.de.net for www.zgt.de/A
	Received 594 bytes from 77.67.63.105
	;; Response received from [77.67.63.105] 594 octets ;; HEADER SECTION ;; id = 8654 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1452, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.zgt.de. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) zgt.de. 86400 IN NS b.ns14.net. zgt.de. 86400 IN NS c.ns14.net. zgt.de. 86400 IN NS d.ns14.net. tjlb7qbojvmlf1s6gdriru7vsms1lg16.de. 7200 IN NSEC3 ( 1 1 15 ca12b74adb90591a tjlcsjat4ljtvo0tjncrrdf6kf6onefb NS SOA RRSIG DNSKEY NSEC3PARAM ) 5vgaoqg84nhlr38cpigeirrbvuj0908u.de. 7200 IN NSEC3 ( 1 1 15 ca12b74adb90591a 5vgc0a3s62rm1q2ct3hfe3biafjg0ooi A RRSIG ) tjlb7qbojvmlf1s6gdriru7vsms1lg16.de. 7200 IN RRSIG ( NSEC3 8 2 7200 20250227072025 20250213055025 22128 de. VElwcW19z0JTK0XT8Od49eOz/z3WzaJVoibPsn4UHD8SGrJB96srSpvQ3uil8rxta90pViUxLghx ouO170z/x/1HxjHY6+ghtoIv4ozgyL8yALHtpmmggUMvUBPPYY61OY9X586QhQ6JvR8g1XBQ7aGd chLny/wSQ/3FKlxoqV8= ) 5vgaoqg84nhlr38cpigeirrbvuj0908u.de. 7200 IN RRSIG ( NSEC3 8 2 7200 20250301053500 20250215040500 22128 de. iLV46CY83exylX9LJmCFPlakOYkMzfvkGBhd7nJeb91xmrKxXSuwFYYRUaMRlDOdRsrEVLRUlQjN aUIr57zBms2N6B7Me3eLPUMKarCSjsOOr7KNs2d6AJoJEljGLBEB7lsL1bp2/AEav5cgs0uY70f9 0o6ADjI/vOnC5IrH5FU= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Query to n.de.net for zgt.de/DNSKEY
	Received 590 bytes from 194.146.107.6
	;; Response received from [194.146.107.6] 590 octets ;; HEADER SECTION ;; id = 22978 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 7 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 4096, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; zgt.de. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (7 records) zgt.de. 86400 IN NS b.ns14.net. zgt.de. 86400 IN NS c.ns14.net. zgt.de. 86400 IN NS d.ns14.net. tjlb7qbojvmlf1s6gdriru7vsms1lg16.de. 7200 IN NSEC3 ( 1 1 15 ca12b74adb90591a tjlcsjat4ljtvo0tjncrrdf6kf6onefb NS SOA RRSIG DNSKEY NSEC3PARAM ) tjlb7qbojvmlf1s6gdriru7vsms1lg16.de. 7200 IN RRSIG ( NSEC3 8 2 7200 20250227072025 20250213055025 22128 de. VElwcW19z0JTK0XT8Od49eOz/z3WzaJVoibPsn4UHD8SGrJB96srSpvQ3uil8rxta90pViUxLghx ouO170z/x/1HxjHY6+ghtoIv4ozgyL8yALHtpmmggUMvUBPPYY61OY9X586QhQ6JvR8g1XBQ7aGd chLny/wSQ/3FKlxoqV8= ) 5vgaoqg84nhlr38cpigeirrbvuj0908u.de. 7200 IN NSEC3 ( 1 1 15 ca12b74adb90591a 5vgc0a3s62rm1q2ct3hfe3biafjg0ooi A RRSIG ) 5vgaoqg84nhlr38cpigeirrbvuj0908u.de. 7200 IN RRSIG ( NSEC3 8 2 7200 20250301053500 20250215040500 22128 de. iLV46CY83exylX9LJmCFPlakOYkMzfvkGBhd7nJeb91xmrKxXSuwFYYRUaMRlDOdRsrEVLRUlQjN aUIr57zBms2N6B7Me3eLPUMKarCSjsOOr7KNs2d6AJoJEljGLBEB7lsL1bp2/AEav5cgs0uY70f9 0o6ADjI/vOnC5IrH5FU= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	Found child zone zgt.de

zgt.de

	Checking DS between de and zgt.de
	Query to z.nic.de for zgt.de/DS
	Received 763 bytes from 194.246.96.1
	;; Response received from [194.246.96.1] 763 octets ;; HEADER SECTION ;; id = 2117 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 6 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1452, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; zgt.de. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (6 records) tjlb7qbojvmlf1s6gdriru7vsms1lg16.de. 7200 IN NSEC3 ( 1 1 15 ca12b74adb90591a tjlcsjat4ljtvo0tjncrrdf6kf6onefb NS SOA RRSIG DNSKEY NSEC3PARAM ) tjlb7qbojvmlf1s6gdriru7vsms1lg16.de. 7200 IN RRSIG ( NSEC3 8 2 7200 20250227072025 20250213055025 22128 de. VElwcW19z0JTK0XT8Od49eOz/z3WzaJVoibPsn4UHD8SGrJB96srSpvQ3uil8rxta90pViUxLghx ouO170z/x/1HxjHY6+ghtoIv4ozgyL8yALHtpmmggUMvUBPPYY61OY9X586QhQ6JvR8g1XBQ7aGd chLny/wSQ/3FKlxoqV8= ) de. 7200 IN SOA ( f.nic.de. dns-operations.denic.de. 1739611950 ;serial 7200 ;refresh 7200 ;retry 3600000 ;expire 7200 ;minimum ) de. 7200 IN RRSIG ( SOA 8 1 86400 20250301093210 20250215080210 22128 de. fytrSDwr5aFQW/MhnlFcq/Y2YOAYElnxPUTtGEGUKJeRYjZhwsYsGjobCNBRTxBwx1uoxbSNe/T3 01mLVmhivA5/NkkXmGbpRFURTfw2XHw8LNZ+pLBYimk7rSHtr9E+MfavVyTZFR8MP40xukrGV7vt cDkeqsotrDrZobixtFI= ) 5vgaoqg84nhlr38cpigeirrbvuj0908u.de. 7200 IN NSEC3 ( 1 1 15 ca12b74adb90591a 5vgc0a3s62rm1q2ct3hfe3biafjg0ooi A RRSIG ) 5vgaoqg84nhlr38cpigeirrbvuj0908u.de. 7200 IN RRSIG ( NSEC3 8 2 7200 20250301053500 20250215040500 22128 de. iLV46CY83exylX9LJmCFPlakOYkMzfvkGBhd7nJeb91xmrKxXSuwFYYRUaMRlDOdRsrEVLRUlQjN aUIr57zBms2N6B7Me3eLPUMKarCSjsOOr7KNs2d6AJoJEljGLBEB7lsL1bp2/AEav5cgs0uY70f9 0o6ADjI/vOnC5IrH5FU= ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DS records found for zgt.de in the de zone
	Query to b.ns14.net for zgt.de/DNSKEY
	Received 111 bytes from 217.160.113.32
	;; Response received from [217.160.113.32] 111 octets ;; HEADER SECTION ;; id = 23300 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 1 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; zgt.de. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) zgt.de. 86400 IN SOA ( hidden-dns2.waz-mediengruppe.de. hostmaster.waz-mediengruppe.de. 2024090601 ;serial 86400 ;refresh 21600 ;retry 604800 ;expire 86400 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DNSKEY records found
	Query to d.ns14.net for www.zgt.de/A
	Received 165 bytes from 74.208.254.231
	;; Response received from [74.208.254.231] 165 octets ;; HEADER SECTION ;; id = 60999 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 3 arcount = 4 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.zgt.de. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (3 records) www.zgt.de. 600 IN NS hosting-lc1.zgt.de. www.zgt.de. 600 IN NS hosting-lc2.zgt.de. www.zgt.de. 600 IN NS hosting-lc3.zgt.de. ;; ADDITIONAL SECTION (4 records) hosting-lc3.zgt.de. 600 IN A 89.246.87.100 hosting-lc2.zgt.de. 600 IN A 134.91.235.100 hosting-lc1.zgt.de. 600 IN A 82.145.6.100 ;; { "EDNS-VERSION": 0 }
	Query to c.ns14.net for www.zgt.de/DNSKEY
	Received 165 bytes from 89.146.248.231
	;; Response received from [89.146.248.231] 165 octets ;; HEADER SECTION ;; id = 27504 ;; qr = 1 aa = 0 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 3 arcount = 4 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.zgt.de. IN DNSKEY ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (3 records) www.zgt.de. 600 IN NS hosting-lc1.zgt.de. www.zgt.de. 600 IN NS hosting-lc2.zgt.de. www.zgt.de. 600 IN NS hosting-lc3.zgt.de. ;; ADDITIONAL SECTION (4 records) hosting-lc3.zgt.de. 600 IN A 89.246.87.100 hosting-lc2.zgt.de. 600 IN A 134.91.235.100 hosting-lc1.zgt.de. 600 IN A 82.145.6.100 ;; { "EDNS-VERSION": 0 }
	Found child zone www.zgt.de

www.zgt.de

	Checking DS between zgt.de and www.zgt.de
	Query to c.ns14.net for www.zgt.de/DS
	Received 115 bytes from 89.146.248.231
	;; Response received from [89.146.248.231] 115 octets ;; HEADER SECTION ;; id = 42812 ;; qr = 1 aa = 1 tc = 0 rd = 0 opcode = QUERY ;; ra = 0 z = 0 ad = 0 cd = 0 rcode = NOERROR ;; do = 1 co = 0 ;; qdcount = 1 ancount = 0 ;; nscount = 1 arcount = 1 ;; { "EDNS-VERSION": 0, ;; "FLAGS": "8000", ;; "RCODE": 0, ;; "UDPSIZE": 1232, ;; "OPTIONS": [ ] ;; } ;; QUESTION SECTION (1 record) ;; www.zgt.de. IN DS ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (1 record) zgt.de. 86400 IN SOA ( hidden-dns2.waz-mediengruppe.de. hostmaster.waz-mediengruppe.de. 2024090601 ;serial 86400 ;refresh 21600 ;retry 604800 ;expire 86400 ;minimum ) ;; ADDITIONAL SECTION (1 record) ;; { "EDNS-VERSION": 0 }
	No DS records found for www.zgt.de in the zgt.de zone
	Query to hosting-lc3.zgt.de for www.zgt.de/DNSKEY
	Timeout querying hosting-lc3.zgt.de/89.246.87.100 for www.zgt.de/DNSKEY
	All Queries to hosting-lc3.zgt.de for www.zgt.de/DNSKEY timed out or failed
	Query to hosting-lc1.zgt.de for www.zgt.de/DNSKEY
	Timeout querying hosting-lc1.zgt.de/82.145.6.100 for www.zgt.de/DNSKEY
	All Queries to hosting-lc1.zgt.de for www.zgt.de/DNSKEY timed out or failed
	Query to hosting-lc2.zgt.de for www.zgt.de/DNSKEY
	Timeout querying hosting-lc2.zgt.de/134.91.235.100 for www.zgt.de/DNSKEY
	All Queries to hosting-lc2.zgt.de for www.zgt.de/DNSKEY timed out or failed
	Failed to get DNSKEY RR set for zone www.zgt.de
	No response from www.zgt.de nameservers

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test www.zgt.de at dnsviz.net.

DNSSEC Debugger

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers: