DNSSEC Debugger - google.com

22 min read Original article ↗

Verisign Inc | Labs Back to Verisign Labs Tools

Analyzing DNSSEC problems for google.com

  DS=20326/SHA-256 is now in the chain-of-trust
.
  Checking DS between Trust Anchor and .
  . IN DS ( 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d )
  Query to l.root-servers.net for ./DNSKEY
  Received 1414 bytes from 199.7.83.42
  
;; Response received from [199.7.83.42] 1414 octets
;; HEADER SECTION
;;	id = 38857
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 5
;;	nscount = 0	arcount = 1

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	4096,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; .	IN	DNSKEY

;; ANSWER SECTION (5 records)
.	172800	IN	DNSKEY	( 256 3 8
	AwEAAbNTVC2+pry4pc37pZI9Oj6b8FHxT3VGrvSPKLE1Tjyfe2kUZUtVX5xrv6AV4BVO+ygrYjGZ
	MNgEnbLU4zknnlnhI2e0g6iTza1aZh0dRZXGH16C1NUNq1CxBkUhIYQhQDeIOtLacx+RmFTc+hSH
	JJ2MJ79IS00kA7eKi6mofQ7SPJmdJVjI+JAx791y0f5QaB+iHGANU53FwiYXNUQjfAzCrtOaSevG
	sx8SO8BTaXLAjFq5eewOtwScVwfVDhEXlvpE6e+mIncwhNKaMRD9IPuHENqCNPI5MjxfAMVS6cEY
	8eEozIkv/vHc+0Auu3n+Fcx6F2Js4KPXaHEShAXugfU= ) ; keytag 21831
.	172800	IN	DNSKEY	( 256 3 8
	AwEAAeuS7hMRZ7muj1c/ew2DoavxkBw3jUG5R79pKVDI39fxvlD1HfJYGJERnXuV4SrQfUPzWw/l
	t5Axb0EqXL/sQ2ZyntVmwQwoSXi2l9smlIKh2UrkTmmozRCPe7GS4fZTE4Ew7AV4YprTLgVmxiGP
	4unRuXkYOgQJXCIBpVCmEdUli6X2sm0i5ZilU/Q+rX3RDw+eYPP7K0cJnJ+ZnvQDy14+BFtreWl9
	enNQljgGpBp26lEp1z7AbvUfzkQNVCVGaM8jEaCSALXiROlwCQMOdj+tpLXFf99kdJnTQw2cpEr1
	uGs/yENAJpoGhbjZAoIkXzDUBSlfFeYz7FWzH6gIe7M= ) ; keytag 61809
.	172800	IN	DNSKEY	( 257 3 8
	AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE
	xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC
	mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+
	SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX
	GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326
.	172800	IN	DNSKEY	( 257 3 8
	AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF
	2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp
	WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu
	MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev
	YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696
.	172800	IN	RRSIG	( DNSKEY 8 0 172800
	20260110000000 20251220000000 20326 .
	RZO5FQjtg6Yk0Dara521nCUfYnQxCLAVdbC+buKQVAKlHsZ6srxXHNAL8DMoHohT+PyIlPFAQMb5
	fBZatrDaqxpZZ/YbC0A2zxGxOwuOPb1xRbqi6E3zSKfilTRuAux5jN0KYbZZhFxda62e9Hv+2GJs
	MLixTpiV3RVXtxENI2GPRA8mRRJPBDR7XVQF/2Pz+vjcAW07dp27CrNmQPyZtVjSgw49Jz1rSsAm
	+EEKO6C7KLG5hmENQr165D3YjMWCs93YhTY8bhWYVqeDtsB1BwoEWkMqSFs4I4+uMd14BHvO6mlq
	zOZyWC+3kXYTpoAlE0kFhKNv1i54wgHRB+paqw== )

;; AUTHORITY SECTION (0 records)

;; ADDITIONAL SECTION (1 record)
;; {	"EDNS-VERSION": 0 }
Found 4 DNSKEY records for .
  . 172800 IN DNSKEY ( 256 3 8 AwEAAbNTVC2+pry4pc37pZI9Oj6b8FHxT3VGrvSPKLE1Tjyfe2kUZUtVX5xrv6AV4BVO+ygrYjGZ MNgEnbLU4zknnlnhI2e0g6iTza1aZh0dRZXGH16C1NUNq1CxBkUhIYQhQDeIOtLacx+RmFTc+hSH JJ2MJ79IS00kA7eKi6mofQ7SPJmdJVjI+JAx791y0f5QaB+iHGANU53FwiYXNUQjfAzCrtOaSevG sx8SO8BTaXLAjFq5eewOtwScVwfVDhEXlvpE6e+mIncwhNKaMRD9IPuHENqCNPI5MjxfAMVS6cEY 8eEozIkv/vHc+0Auu3n+Fcx6F2Js4KPXaHEShAXugfU= ) ; keytag 21831
  . 172800 IN DNSKEY ( 256 3 8 AwEAAeuS7hMRZ7muj1c/ew2DoavxkBw3jUG5R79pKVDI39fxvlD1HfJYGJERnXuV4SrQfUPzWw/l t5Axb0EqXL/sQ2ZyntVmwQwoSXi2l9smlIKh2UrkTmmozRCPe7GS4fZTE4Ew7AV4YprTLgVmxiGP 4unRuXkYOgQJXCIBpVCmEdUli6X2sm0i5ZilU/Q+rX3RDw+eYPP7K0cJnJ+ZnvQDy14+BFtreWl9 enNQljgGpBp26lEp1z7AbvUfzkQNVCVGaM8jEaCSALXiROlwCQMOdj+tpLXFf99kdJnTQw2cpEr1 uGs/yENAJpoGhbjZAoIkXzDUBSlfFeYz7FWzH6gIe7M= ) ; keytag 61809
  . 172800 IN DNSKEY ( 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlE xOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgC mr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+ SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnX GXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= ) ; keytag 20326
  . 172800 IN DNSKEY ( 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF 2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdp WWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwu MoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBev YtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= ) ; keytag 38696
  DNSKEY=20326/SEP is now in the chain-of-trust
DS=20326/SHA-256 verifies DNSKEY=20326/SEP
Found 1 RRSIGs over DNSKEY RRset
  . 172800 IN RRSIG ( DNSKEY 8 0 172800 20260110000000 20251220000000 20326 . RZO5FQjtg6Yk0Dara521nCUfYnQxCLAVdbC+buKQVAKlHsZ6srxXHNAL8DMoHohT+PyIlPFAQMb5 fBZatrDaqxpZZ/YbC0A2zxGxOwuOPb1xRbqi6E3zSKfilTRuAux5jN0KYbZZhFxda62e9Hv+2GJs MLixTpiV3RVXtxENI2GPRA8mRRJPBDR7XVQF/2Pz+vjcAW07dp27CrNmQPyZtVjSgw49Jz1rSsAm +EEKO6C7KLG5hmENQr165D3YjMWCs93YhTY8bhWYVqeDtsB1BwoEWkMqSFs4I4+uMd14BHvO6mlq zOZyWC+3kXYTpoAlE0kFhKNv1i54wgHRB+paqw== )
RRSIG=20326 and DNSKEY=20326/SEP verifies the DNSKEY RRset
  DNSKEY=21831 is now in the chain-of-trust
  DNSKEY=61809 is now in the chain-of-trust
  DNSKEY=38696/SEP is now in the chain-of-trust
  Query to b.root-servers.net for google.com/A
  Received 1170 bytes from 170.247.170.2
  
;; Response received from [170.247.170.2] 1170 octets
;; HEADER SECTION
;;	id = 8051
;;	qr = 1	aa = 0	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 0
;;	nscount = 15	arcount = 27

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	1232,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	A

;; ANSWER SECTION (0 records)

;; AUTHORITY SECTION (15 records)
com.	172800	IN	NS	a.gtld-servers.net.
com.	172800	IN	NS	b.gtld-servers.net.
com.	172800	IN	NS	c.gtld-servers.net.
com.	172800	IN	NS	d.gtld-servers.net.
com.	172800	IN	NS	e.gtld-servers.net.
com.	172800	IN	NS	f.gtld-servers.net.
com.	172800	IN	NS	g.gtld-servers.net.
com.	172800	IN	NS	h.gtld-servers.net.
com.	172800	IN	NS	i.gtld-servers.net.
com.	172800	IN	NS	j.gtld-servers.net.
com.	172800	IN	NS	k.gtld-servers.net.
com.	172800	IN	NS	l.gtld-servers.net.
com.	172800	IN	NS	m.gtld-servers.net.
com.	86400	IN	DS	( 19718 13 2
	8acbb0cd28f41250a80a491389424d341522d946b0da0c0291f2d3d771d7805a )
com.	86400	IN	RRSIG	( DS 8 1 86400
	20260103050000 20251221040000 61809 .
	s80mImZ3HJFSCiGAH7n6AR1IuKrVAGIvGY6LVAo29THkBemMbu3y9GoaW7ZP0E4h5N2S8969bCvh
	aWcyXmm5WssVQwBFkeQLqVgN2e/7PBEuBDTK08O0X/52E5ubv2MCg9sUZ0wn/blhCJ8gdMoUWHiq
	DgkVEuPfKer2mmpAOEYYch5Kh4jUmO2moG7tQcdS202LSLYY7nZcfYxua920U4Jtl4TYcuXl6EZc
	cgqP3anxqlmjtA5XRmZ4OxaC2fvVGzNnWJFxTWaaW3leyXOukAIxeqk5ZCKPvg5YRnh9eOmTqWKV
	fCIpU4xREDg+9+mgCi8j4ez/GbTOoeiR4YxYXA== )

;; ADDITIONAL SECTION (27 records)
a.gtld-servers.net.	172800	IN	A	192.5.6.30
a.gtld-servers.net.	172800	IN	AAAA	2001:503:a83e::2:30
b.gtld-servers.net.	172800	IN	A	192.33.14.30
b.gtld-servers.net.	172800	IN	AAAA	2001:503:231d::2:30
c.gtld-servers.net.	172800	IN	A	192.26.92.30
c.gtld-servers.net.	172800	IN	AAAA	2001:503:83eb::30
d.gtld-servers.net.	172800	IN	A	192.31.80.30
d.gtld-servers.net.	172800	IN	AAAA	2001:500:856e::30
e.gtld-servers.net.	172800	IN	A	192.12.94.30
e.gtld-servers.net.	172800	IN	AAAA	2001:502:1ca1::30
f.gtld-servers.net.	172800	IN	A	192.35.51.30
f.gtld-servers.net.	172800	IN	AAAA	2001:503:d414::30
g.gtld-servers.net.	172800	IN	A	192.42.93.30
g.gtld-servers.net.	172800	IN	AAAA	2001:503:eea3::30
h.gtld-servers.net.	172800	IN	A	192.54.112.30
h.gtld-servers.net.	172800	IN	AAAA	2001:502:8cc::30
i.gtld-servers.net.	172800	IN	A	192.43.172.30
i.gtld-servers.net.	172800	IN	AAAA	2001:503:39c1::30
j.gtld-servers.net.	172800	IN	A	192.48.79.30
j.gtld-servers.net.	172800	IN	AAAA	2001:502:7094::30
k.gtld-servers.net.	172800	IN	A	192.52.178.30
k.gtld-servers.net.	172800	IN	AAAA	2001:503:d2d::30
l.gtld-servers.net.	172800	IN	A	192.41.162.30
l.gtld-servers.net.	172800	IN	AAAA	2001:500:d937::30
m.gtld-servers.net.	172800	IN	A	192.55.83.30
m.gtld-servers.net.	172800	IN	AAAA	2001:501:b1f9::30
;; {	"EDNS-VERSION": 0 }
  Query to m.root-servers.net for com/DNSKEY
  Received 1163 bytes from 202.12.27.33
  
;; Response received from [202.12.27.33] 1163 octets
;; HEADER SECTION
;;	id = 31245
;;	qr = 1	aa = 0	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 0
;;	nscount = 15	arcount = 27

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	1232,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; com.	IN	DNSKEY

;; ANSWER SECTION (0 records)

;; AUTHORITY SECTION (15 records)
com.	172800	IN	NS	h.gtld-servers.net.
com.	172800	IN	NS	d.gtld-servers.net.
com.	172800	IN	NS	g.gtld-servers.net.
com.	172800	IN	NS	l.gtld-servers.net.
com.	172800	IN	NS	j.gtld-servers.net.
com.	172800	IN	NS	b.gtld-servers.net.
com.	172800	IN	NS	a.gtld-servers.net.
com.	172800	IN	NS	e.gtld-servers.net.
com.	172800	IN	NS	f.gtld-servers.net.
com.	172800	IN	NS	i.gtld-servers.net.
com.	172800	IN	NS	m.gtld-servers.net.
com.	172800	IN	NS	c.gtld-servers.net.
com.	172800	IN	NS	k.gtld-servers.net.
com.	86400	IN	DS	( 19718 13 2
	8acbb0cd28f41250a80a491389424d341522d946b0da0c0291f2d3d771d7805a )
com.	86400	IN	RRSIG	( DS 8 1 86400
	20260103050000 20251221040000 61809 .
	s80mImZ3HJFSCiGAH7n6AR1IuKrVAGIvGY6LVAo29THkBemMbu3y9GoaW7ZP0E4h5N2S8969bCvh
	aWcyXmm5WssVQwBFkeQLqVgN2e/7PBEuBDTK08O0X/52E5ubv2MCg9sUZ0wn/blhCJ8gdMoUWHiq
	DgkVEuPfKer2mmpAOEYYch5Kh4jUmO2moG7tQcdS202LSLYY7nZcfYxua920U4Jtl4TYcuXl6EZc
	cgqP3anxqlmjtA5XRmZ4OxaC2fvVGzNnWJFxTWaaW3leyXOukAIxeqk5ZCKPvg5YRnh9eOmTqWKV
	fCIpU4xREDg+9+mgCi8j4ez/GbTOoeiR4YxYXA== )

;; ADDITIONAL SECTION (27 records)
m.gtld-servers.net.	172800	IN	A	192.55.83.30
l.gtld-servers.net.	172800	IN	A	192.41.162.30
k.gtld-servers.net.	172800	IN	A	192.52.178.30
j.gtld-servers.net.	172800	IN	A	192.48.79.30
i.gtld-servers.net.	172800	IN	A	192.43.172.30
h.gtld-servers.net.	172800	IN	A	192.54.112.30
g.gtld-servers.net.	172800	IN	A	192.42.93.30
f.gtld-servers.net.	172800	IN	A	192.35.51.30
e.gtld-servers.net.	172800	IN	A	192.12.94.30
d.gtld-servers.net.	172800	IN	A	192.31.80.30
c.gtld-servers.net.	172800	IN	A	192.26.92.30
b.gtld-servers.net.	172800	IN	A	192.33.14.30
a.gtld-servers.net.	172800	IN	A	192.5.6.30
m.gtld-servers.net.	172800	IN	AAAA	2001:501:b1f9::30
l.gtld-servers.net.	172800	IN	AAAA	2001:500:d937::30
k.gtld-servers.net.	172800	IN	AAAA	2001:503:d2d::30
j.gtld-servers.net.	172800	IN	AAAA	2001:502:7094::30
i.gtld-servers.net.	172800	IN	AAAA	2001:503:39c1::30
h.gtld-servers.net.	172800	IN	AAAA	2001:502:8cc::30
g.gtld-servers.net.	172800	IN	AAAA	2001:503:eea3::30
f.gtld-servers.net.	172800	IN	AAAA	2001:503:d414::30
e.gtld-servers.net.	172800	IN	AAAA	2001:502:1ca1::30
d.gtld-servers.net.	172800	IN	AAAA	2001:500:856e::30
c.gtld-servers.net.	172800	IN	AAAA	2001:503:83eb::30
b.gtld-servers.net.	172800	IN	AAAA	2001:503:231d::2:30
a.gtld-servers.net.	172800	IN	AAAA	2001:503:a83e::2:30
;; {	"EDNS-VERSION": 0 }
  Found child zone com
com
  Checking DS between . and com
  Query to c.root-servers.net for com/DS
  Received 367 bytes from 192.33.4.12
  
;; Response received from [192.33.4.12] 367 octets
;; HEADER SECTION
;;	id = 34335
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 2
;;	nscount = 0	arcount = 1

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	1232,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; com.	IN	DS

;; ANSWER SECTION (2 records)
com.	86400	IN	DS	( 19718 13 2
	8acbb0cd28f41250a80a491389424d341522d946b0da0c0291f2d3d771d7805a )
com.	86400	IN	RRSIG	( DS 8 1 86400
	20260103050000 20251221040000 61809 .
	s80mImZ3HJFSCiGAH7n6AR1IuKrVAGIvGY6LVAo29THkBemMbu3y9GoaW7ZP0E4h5N2S8969bCvh
	aWcyXmm5WssVQwBFkeQLqVgN2e/7PBEuBDTK08O0X/52E5ubv2MCg9sUZ0wn/blhCJ8gdMoUWHiq
	DgkVEuPfKer2mmpAOEYYch5Kh4jUmO2moG7tQcdS202LSLYY7nZcfYxua920U4Jtl4TYcuXl6EZc
	cgqP3anxqlmjtA5XRmZ4OxaC2fvVGzNnWJFxTWaaW3leyXOukAIxeqk5ZCKPvg5YRnh9eOmTqWKV
	fCIpU4xREDg+9+mgCi8j4ez/GbTOoeiR4YxYXA== )

;; AUTHORITY SECTION (0 records)

;; ADDITIONAL SECTION (1 record)
;; {	"EDNS-VERSION": 0 }
Found 1 DS records for com in the . zone
DS=19718/SHA-256 has algorithm ECDSAP256SHA256
Found 1 RRSIGs over DS RRset
  com. 86400 IN RRSIG ( DS 8 1 86400 20260103050000 20251221040000 61809 . s80mImZ3HJFSCiGAH7n6AR1IuKrVAGIvGY6LVAo29THkBemMbu3y9GoaW7ZP0E4h5N2S8969bCvh aWcyXmm5WssVQwBFkeQLqVgN2e/7PBEuBDTK08O0X/52E5ubv2MCg9sUZ0wn/blhCJ8gdMoUWHiq DgkVEuPfKer2mmpAOEYYch5Kh4jUmO2moG7tQcdS202LSLYY7nZcfYxua920U4Jtl4TYcuXl6EZc cgqP3anxqlmjtA5XRmZ4OxaC2fvVGzNnWJFxTWaaW3leyXOukAIxeqk5ZCKPvg5YRnh9eOmTqWKV fCIpU4xREDg+9+mgCi8j4ez/GbTOoeiR4YxYXA== )
RRSIG=61809 and DNSKEY=61809 verifies the DS RRset
  DS=19718/SHA-256 is now in the chain-of-trust
  com. 86400 IN DS ( 19718 13 2 8acbb0cd28f41250a80a491389424d341522d946b0da0c0291f2d3d771d7805a )
  Query to d.gtld-servers.net for com/DNSKEY
  Received 291 bytes from 192.31.80.30
  
;; Response received from [192.31.80.30] 291 octets
;; HEADER SECTION
;;	id = 49134
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 3
;;	nscount = 0	arcount = 1

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	4096,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; com.	IN	DNSKEY

;; ANSWER SECTION (3 records)
com.	86400	IN	DNSKEY	( 256 3 13
	DlR2Hg7gaFa3QrV+6wv2miYtrBDVD6maxc/us4r02T1p/PCAGk+TPlmtiam1QvGYS1/g2IAi6UV0
	nZkLOb+OyA== ) ; keytag 46539
com.	86400	IN	DNSKEY	( 257 3 13
	tx8EZRAd2+K/DJRV0S+hbBzaRPS/G6JVNBitHzqpsGlz8huE61Ms9ANe6NSDLKJtiTBqfTJWDAyw
	Ep1FCsEINQ== ) ; keytag 19718
com.	86400	IN	RRSIG	( DNSKEY 13 1 86400
	20260102150235 20251218145735 19718 com.
	RvGecIF/dvOGx7REWBHtHEwY4pJITy2hLYraJiXWmQvq0BUuE5c78PA0b9ShvHLS5lr/qVvUr0+F
	mdaBYkaL+w== )

;; AUTHORITY SECTION (0 records)

;; ADDITIONAL SECTION (1 record)
;; {	"EDNS-VERSION": 0 }
Found 2 DNSKEY records for com
  com. 86400 IN DNSKEY ( 256 3 13 DlR2Hg7gaFa3QrV+6wv2miYtrBDVD6maxc/us4r02T1p/PCAGk+TPlmtiam1QvGYS1/g2IAi6UV0 nZkLOb+OyA== ) ; keytag 46539
  com. 86400 IN DNSKEY ( 257 3 13 tx8EZRAd2+K/DJRV0S+hbBzaRPS/G6JVNBitHzqpsGlz8huE61Ms9ANe6NSDLKJtiTBqfTJWDAyw Ep1FCsEINQ== ) ; keytag 19718
  DNSKEY=19718/SEP is now in the chain-of-trust
DS=19718/SHA-256 verifies DNSKEY=19718/SEP
Found 1 RRSIGs over DNSKEY RRset
  com. 86400 IN RRSIG ( DNSKEY 13 1 86400 20260102150235 20251218145735 19718 com. RvGecIF/dvOGx7REWBHtHEwY4pJITy2hLYraJiXWmQvq0BUuE5c78PA0b9ShvHLS5lr/qVvUr0+F mdaBYkaL+w== )
RRSIG=19718 and DNSKEY=19718/SEP verifies the DNSKEY RRset
  DNSKEY=46539 is now in the chain-of-trust
  Query to m.gtld-servers.net for google.com/A
  Received 644 bytes from 192.55.83.30
  
;; Response received from [192.55.83.30] 644 octets
;; HEADER SECTION
;;	id = 14396
;;	qr = 1	aa = 0	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 0
;;	nscount = 8	arcount = 9

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	4096,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	A

;; ANSWER SECTION (0 records)

;; AUTHORITY SECTION (8 records)
google.com.	172800	IN	NS	ns2.google.com.
google.com.	172800	IN	NS	ns1.google.com.
google.com.	172800	IN	NS	ns3.google.com.
google.com.	172800	IN	NS	ns4.google.com.
CK0POJMG874LJREF7EFN8430QVIT8BSM.com.	900	IN	NSEC3	( 1 1 0 -
	ck0q3udg8cekkae7rukpgct1dvssh8ll NS SOA RRSIG DNSKEY NSEC3PARAM )
CK0POJMG874LJREF7EFN8430QVIT8BSM.com.	900	IN	RRSIG	( NSEC3 13 2 900
	20251225002706 20251217231706 46539 com.
	gmHVJS+WmLxYXTQMDYmfFRMcTSDHtHHXgSTWPo3FbOjYVV6GmpBv4Rd3q91lGtsv8vkur4/nrD7L
	olMHJ4gpqw== )
S84BOR4DK28HNHPLC218O483VOOOD5D8.com.	900	IN	NSEC3	( 1 1 0 -
	s84br9cib2a20l3etr1m2415enpp99l8 NS DS RRSIG )
S84BOR4DK28HNHPLC218O483VOOOD5D8.com.	900	IN	RRSIG	( NSEC3 13 2 900
	20251226013215 20251219002215 46539 com.
	j/xKx8Zd2F/CzIi0hUHseztp78uLoBQmtfrH8OjiWwRjVkmKi3prwQE7BWXEIq2/Ds3kTkuhJDkq
	TKppKC1bpA== )

;; ADDITIONAL SECTION (9 records)
ns2.google.com.	172800	IN	AAAA	2001:4860:4802:34::a
ns2.google.com.	172800	IN	A	216.239.34.10
ns1.google.com.	172800	IN	AAAA	2001:4860:4802:32::a
ns1.google.com.	172800	IN	A	216.239.32.10
ns3.google.com.	172800	IN	AAAA	2001:4860:4802:36::a
ns3.google.com.	172800	IN	A	216.239.36.10
ns4.google.com.	172800	IN	AAAA	2001:4860:4802:38::a
ns4.google.com.	172800	IN	A	216.239.38.10
;; {	"EDNS-VERSION": 0 }
  Query to g.gtld-servers.net for google.com/DNSKEY
  Received 644 bytes from 192.42.93.30
  
;; Response received from [192.42.93.30] 644 octets
;; HEADER SECTION
;;	id = 21196
;;	qr = 1	aa = 0	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 0
;;	nscount = 8	arcount = 9

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	4096,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	DNSKEY

;; ANSWER SECTION (0 records)

;; AUTHORITY SECTION (8 records)
google.com.	172800	IN	NS	ns2.google.com.
google.com.	172800	IN	NS	ns1.google.com.
google.com.	172800	IN	NS	ns3.google.com.
google.com.	172800	IN	NS	ns4.google.com.
CK0POJMG874LJREF7EFN8430QVIT8BSM.com.	900	IN	NSEC3	( 1 1 0 -
	ck0q3udg8cekkae7rukpgct1dvssh8ll NS SOA RRSIG DNSKEY NSEC3PARAM )
CK0POJMG874LJREF7EFN8430QVIT8BSM.com.	900	IN	RRSIG	( NSEC3 13 2 900
	20251225002706 20251217231706 46539 com.
	gmHVJS+WmLxYXTQMDYmfFRMcTSDHtHHXgSTWPo3FbOjYVV6GmpBv4Rd3q91lGtsv8vkur4/nrD7L
	olMHJ4gpqw== )
S84BOR4DK28HNHPLC218O483VOOOD5D8.com.	900	IN	NSEC3	( 1 1 0 -
	s84br9cib2a20l3etr1m2415enpp99l8 NS DS RRSIG )
S84BOR4DK28HNHPLC218O483VOOOD5D8.com.	900	IN	RRSIG	( NSEC3 13 2 900
	20251226013215 20251219002215 46539 com.
	j/xKx8Zd2F/CzIi0hUHseztp78uLoBQmtfrH8OjiWwRjVkmKi3prwQE7BWXEIq2/Ds3kTkuhJDkq
	TKppKC1bpA== )

;; ADDITIONAL SECTION (9 records)
ns2.google.com.	172800	IN	AAAA	2001:4860:4802:34::a
ns2.google.com.	172800	IN	A	216.239.34.10
ns1.google.com.	172800	IN	AAAA	2001:4860:4802:32::a
ns1.google.com.	172800	IN	A	216.239.32.10
ns3.google.com.	172800	IN	AAAA	2001:4860:4802:36::a
ns3.google.com.	172800	IN	A	216.239.36.10
ns4.google.com.	172800	IN	AAAA	2001:4860:4802:38::a
ns4.google.com.	172800	IN	A	216.239.38.10
;; {	"EDNS-VERSION": 0 }
  Found child zone google.com
google.com
  Checking DS between com and google.com
  Query to g.gtld-servers.net for google.com/DS
  Received 568 bytes from 192.42.93.30
  
;; Response received from [192.42.93.30] 568 octets
;; HEADER SECTION
;;	id = 16279
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 0
;;	nscount = 6	arcount = 1

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	4096,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	DS

;; ANSWER SECTION (0 records)

;; AUTHORITY SECTION (6 records)
CK0POJMG874LJREF7EFN8430QVIT8BSM.com.	900	IN	NSEC3	( 1 1 0 -
	ck0q3udg8cekkae7rukpgct1dvssh8ll NS SOA RRSIG DNSKEY NSEC3PARAM )
CK0POJMG874LJREF7EFN8430QVIT8BSM.com.	900	IN	RRSIG	( NSEC3 13 2 900
	20251225002706 20251217231706 46539 com.
	gmHVJS+WmLxYXTQMDYmfFRMcTSDHtHHXgSTWPo3FbOjYVV6GmpBv4Rd3q91lGtsv8vkur4/nrD7L
	olMHJ4gpqw== )
com.	900	IN	SOA	( a.gtld-servers.net. nstld.verisign-grs.com.
				1766317729	;serial
				1800		;refresh
				900		;retry
				604800		;expire
				900		;minimum
	)
com.	900	IN	RRSIG	( SOA 13 1 900
	20251228114849 20251221103849 46539 com.
	6/bQwVmz81RZ/eeRpBDPnaz4mUmE11Mipatl2+ZK+EeE07ekLHXU/PdmCwXERqGkLH9TUcZx42Ab
	Au8u+b2+WA== )
S84BOR4DK28HNHPLC218O483VOOOD5D8.com.	900	IN	NSEC3	( 1 1 0 -
	s84br9cib2a20l3etr1m2415enpp99l8 NS DS RRSIG )
S84BOR4DK28HNHPLC218O483VOOOD5D8.com.	900	IN	RRSIG	( NSEC3 13 2 900
	20251226013215 20251219002215 46539 com.
	j/xKx8Zd2F/CzIi0hUHseztp78uLoBQmtfrH8OjiWwRjVkmKi3prwQE7BWXEIq2/Ds3kTkuhJDkq
	TKppKC1bpA== )

;; ADDITIONAL SECTION (1 record)
;; {	"EDNS-VERSION": 0 }
No DS records found for google.com in the com zone
  Query to ns3.google.com for google.com/DNSKEY
  Received 89 bytes from 216.239.36.10
  
;; Response received from [216.239.36.10] 89 octets
;; HEADER SECTION
;;	id = 28693
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 0
;;	nscount = 1	arcount = 1

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	0,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	DNSKEY

;; ANSWER SECTION (0 records)

;; AUTHORITY SECTION (1 record)
google.com.	60	IN	SOA	( ns1.google.com. dns-admin.google.com.
				847066381	;serial
				900		;refresh
				900		;retry
				1800		;expire
				60		;minimum
	)

;; ADDITIONAL SECTION (1 record)
;; {	"EDNS-VERSION": 0 }
No DNSKEY records found
  Query to ns1.google.com for google.com/A
  Received 55 bytes from 216.239.32.10
  
;; Response received from [216.239.32.10] 55 octets
;; HEADER SECTION
;;	id = 23033
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 1
;;	nscount = 0	arcount = 1

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	0,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	A

;; ANSWER SECTION (1 record)
google.com.	300	IN	A	142.250.69.174

;; AUTHORITY SECTION (0 records)

;; ADDITIONAL SECTION (1 record)
;; {	"EDNS-VERSION": 0 }
ns1.google.com is authoritative for google.com
  Query to ns2.google.com for google.com/SOA
  Received 333 bytes from 216.239.34.10
  
;; Response received from [216.239.34.10] 333 octets
;; HEADER SECTION
;;	id = 47068
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 1
;;	nscount = 4	arcount = 9

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	0,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	SOA

;; ANSWER SECTION (1 record)
google.com.	60	IN	SOA	( ns1.google.com. dns-admin.google.com.
				847066381	;serial
				900		;refresh
				900		;retry
				1800		;expire
				60		;minimum
	)

;; AUTHORITY SECTION (4 records)
google.com.	345600	IN	NS	ns3.google.com.
google.com.	345600	IN	NS	ns2.google.com.
google.com.	345600	IN	NS	ns1.google.com.
google.com.	345600	IN	NS	ns4.google.com.

;; ADDITIONAL SECTION (9 records)
ns3.google.com.	345600	IN	A	216.239.36.10
ns3.google.com.	345600	IN	AAAA	2001:4860:4802:36::a
ns2.google.com.	345600	IN	A	216.239.34.10
ns2.google.com.	345600	IN	AAAA	2001:4860:4802:34::a
ns1.google.com.	345600	IN	A	216.239.32.10
ns1.google.com.	345600	IN	AAAA	2001:4860:4802:32::a
ns4.google.com.	345600	IN	A	216.239.38.10
ns4.google.com.	345600	IN	AAAA	2001:4860:4802:38::a
;; {	"EDNS-VERSION": 0 }
  Query to ns4.google.com for google.com/SOA
  Received 333 bytes from 216.239.38.10
  
;; Response received from [216.239.38.10] 333 octets
;; HEADER SECTION
;;	id = 27910
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 1
;;	nscount = 4	arcount = 9

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	0,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	SOA

;; ANSWER SECTION (1 record)
google.com.	60	IN	SOA	( ns1.google.com. dns-admin.google.com.
				847066381	;serial
				900		;refresh
				900		;retry
				1800		;expire
				60		;minimum
	)

;; AUTHORITY SECTION (4 records)
google.com.	345600	IN	NS	ns4.google.com.
google.com.	345600	IN	NS	ns2.google.com.
google.com.	345600	IN	NS	ns1.google.com.
google.com.	345600	IN	NS	ns3.google.com.

;; ADDITIONAL SECTION (9 records)
ns4.google.com.	345600	IN	A	216.239.38.10
ns4.google.com.	345600	IN	AAAA	2001:4860:4802:38::a
ns2.google.com.	345600	IN	A	216.239.34.10
ns2.google.com.	345600	IN	AAAA	2001:4860:4802:34::a
ns1.google.com.	345600	IN	A	216.239.32.10
ns1.google.com.	345600	IN	AAAA	2001:4860:4802:32::a
ns3.google.com.	345600	IN	A	216.239.36.10
ns3.google.com.	345600	IN	AAAA	2001:4860:4802:36::a
;; {	"EDNS-VERSION": 0 }
  Query to ns3.google.com for google.com/SOA
  Received 333 bytes from 216.239.36.10
  
;; Response received from [216.239.36.10] 333 octets
;; HEADER SECTION
;;	id = 9675
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 1
;;	nscount = 4	arcount = 9

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	0,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	SOA

;; ANSWER SECTION (1 record)
google.com.	60	IN	SOA	( ns1.google.com. dns-admin.google.com.
				847066381	;serial
				900		;refresh
				900		;retry
				1800		;expire
				60		;minimum
	)

;; AUTHORITY SECTION (4 records)
google.com.	345600	IN	NS	ns4.google.com.
google.com.	345600	IN	NS	ns1.google.com.
google.com.	345600	IN	NS	ns3.google.com.
google.com.	345600	IN	NS	ns2.google.com.

;; ADDITIONAL SECTION (9 records)
ns4.google.com.	345600	IN	A	216.239.38.10
ns4.google.com.	345600	IN	AAAA	2001:4860:4802:38::a
ns1.google.com.	345600	IN	A	216.239.32.10
ns1.google.com.	345600	IN	AAAA	2001:4860:4802:32::a
ns3.google.com.	345600	IN	A	216.239.36.10
ns3.google.com.	345600	IN	AAAA	2001:4860:4802:36::a
ns2.google.com.	345600	IN	A	216.239.34.10
ns2.google.com.	345600	IN	AAAA	2001:4860:4802:34::a
;; {	"EDNS-VERSION": 0 }
  Query to ns1.google.com for google.com/A
  Received 55 bytes from 216.239.32.10
  
;; Response received from [216.239.32.10] 55 octets
;; HEADER SECTION
;;	id = 20530
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 1
;;	nscount = 0	arcount = 1

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	0,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	A

;; ANSWER SECTION (1 record)
google.com.	300	IN	A	142.250.69.174

;; AUTHORITY SECTION (0 records)

;; ADDITIONAL SECTION (1 record)
;; {	"EDNS-VERSION": 0 }
google.com A RR has value 142.250.69.174
No RRSIGs found
google.com
  Query to ns3.google.com for google.com/A
  Received 55 bytes from 216.239.36.10
  
;; Response received from [216.239.36.10] 55 octets
;; HEADER SECTION
;;	id = 26124
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 1
;;	nscount = 0	arcount = 1

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	0,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	A

;; ANSWER SECTION (1 record)
google.com.	300	IN	A	142.250.69.174

;; AUTHORITY SECTION (0 records)

;; ADDITIONAL SECTION (1 record)
;; {	"EDNS-VERSION": 0 }
ns3.google.com is authoritative for google.com
  Query to ns3.google.com for google.com/A
  Received 55 bytes from 216.239.36.10
  
;; Response received from [216.239.36.10] 55 octets
;; HEADER SECTION
;;	id = 21996
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 1
;;	nscount = 0	arcount = 1

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	0,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	A

;; ANSWER SECTION (1 record)
google.com.	300	IN	A	142.250.69.174

;; AUTHORITY SECTION (0 records)

;; ADDITIONAL SECTION (1 record)
;; {	"EDNS-VERSION": 0 }
google.com A RR has value 142.250.69.174
No RRSIGs found
google.com
  Query to ns4.google.com for google.com/A
  Received 55 bytes from 216.239.38.10
  
;; Response received from [216.239.38.10] 55 octets
;; HEADER SECTION
;;	id = 23248
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 1
;;	nscount = 0	arcount = 1

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	0,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	A

;; ANSWER SECTION (1 record)
google.com.	300	IN	A	142.250.69.174

;; AUTHORITY SECTION (0 records)

;; ADDITIONAL SECTION (1 record)
;; {	"EDNS-VERSION": 0 }
ns4.google.com is authoritative for google.com
  Query to ns4.google.com for google.com/A
  Received 55 bytes from 216.239.38.10
  
;; Response received from [216.239.38.10] 55 octets
;; HEADER SECTION
;;	id = 36187
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 1
;;	nscount = 0	arcount = 1

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	0,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	A

;; ANSWER SECTION (1 record)
google.com.	300	IN	A	142.250.69.174

;; AUTHORITY SECTION (0 records)

;; ADDITIONAL SECTION (1 record)
;; {	"EDNS-VERSION": 0 }
google.com A RR has value 142.250.69.174
No RRSIGs found
google.com
  Query to ns2.google.com for google.com/A
  Received 55 bytes from 216.239.34.10
  
;; Response received from [216.239.34.10] 55 octets
;; HEADER SECTION
;;	id = 32418
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 1
;;	nscount = 0	arcount = 1

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	0,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	A

;; ANSWER SECTION (1 record)
google.com.	300	IN	A	142.250.69.174

;; AUTHORITY SECTION (0 records)

;; ADDITIONAL SECTION (1 record)
;; {	"EDNS-VERSION": 0 }
ns2.google.com is authoritative for google.com
  Query to ns2.google.com for google.com/A
  Received 55 bytes from 216.239.34.10
  
;; Response received from [216.239.34.10] 55 octets
;; HEADER SECTION
;;	id = 45293
;;	qr = 1	aa = 1	tc = 0	rd = 0	opcode = QUERY
;;	ra = 0	z  = 0	ad = 0	cd = 0	rcode  = NOERROR
;;	do = 1	co = 0
;;	qdcount = 1	ancount = 1
;;	nscount = 0	arcount = 1

;; {	"EDNS-VERSION":	0,
;;	"FLAGS":	"8000",
;;	"RCODE":	0,
;;	"UDPSIZE":	0,
;;	"OPTIONS":	[ ]
;;	}

;; QUESTION SECTION (1 record)
;; google.com.	IN	A

;; ANSWER SECTION (1 record)
google.com.	300	IN	A	142.250.69.174

;; AUTHORITY SECTION (0 records)

;; ADDITIONAL SECTION (1 record)
;; {	"EDNS-VERSION": 0 }
google.com A RR has value 142.250.69.174
No RRSIGs found

Move your mouse over any or symbols for remediation hints.

Want a second opinion? Test google.com at dnsviz.net.

↓ Advanced options ↑ Advanced options

Trust Anchor:
Name Servers:

Paste a DS or DNSKEY record into the field above to use a Trust Anchor that is not published in the DNS. Validation will begin at the owner name of the DS/DNSKEY record.

You may also supply alternative starting name servers, separated by whitespace or commas. The given name servers must be authoritative for the same zone as the Trust Anchor.