> (Dammit...no I'm curious about what is actually in those records, because the 'host -t ds' output for all of them is 3 apparently decimal numbers, a long hex

> (Dammit...no I'm curious about what is actually in those records, because the 'host -t ds' output for all of them is 3 apparently decimal numbers, a long hex string, and a short hex strings except for Caltech's, which is missing the final short hex string). Those are DS records, what host(1) prints is their presentation format [1]: > The presentation format of the DS record consists of three numbers (key tag, algorithm, and digest type) followed by the digest itself presented in hex Digest type 1 (as for caltech.edu) is for SHA-1 [2], type 2 (as for stanford.edu) is for SHA-256 [3]. So caltech.edu just uses a shorter hash, and whitespace is allowed in the presentation [4]. FWIW, one can also check and verify that/whether DNSSEC works with delv(1) (similar to dig(1), but with validation). [1] https://datatracker.ietf.org/doc/html/rfc3658#section-2.5 https://datatracker.ietf.org/doc/html/rfc3658#section-2.5 [2] https://datatracker.ietf.org/doc/html/rfc3658#section-5 https://datatracker.ietf.org/doc/html/rfc3658#section-5 [3] https://datatracker.ietf.org/doc/html/rfc4509#section-2.1 https://datatracker.ietf.org/doc/html/rfc4509#section-2.1 [4] https://datatracker.ietf.org/doc/html/rfc4034#section-5.3 https://datatracker.ietf.org/doc/html/rfc4034#section-5.3