Very nice tool from verisign..
http://dnssec-debugger.verisignlabs.com/www.google.co.ke
Checking DS between . and ke
Found 2 DS records for ke in the . zone
Found 1 RRSIGs over DS RRset
ke. 86400 IN RRSIG DS 8 1 86400 (
20150410050000 20150331040000 16665 .
pGena84iSsmrEmsPoY0XtO9IQAetk0zo8ARWYnuY2dKdl/8MxMvEThtQKWB80rZJrtwX/w5F9Njf
1uhvKWYmNDuweTYEnJ62U06M5sdd0pimAEewzVs5Wkqz6AfyH8kRi5ISLpnfk8aO6bCcivW5FR7w
AvHrktR476g51Fv6n4I= )
RRSIG=16665 and DNSKEY=16665 verifies the DS RRset
DS=37471/SHA-1 is now in the chain-of-trust
ke. 86400 IN DS 37471 5 1 05beaca628dc8a283b5c88612a0883ab862d1cbb
ke. 86400 IN DS 37471 5 2 (
502a5d3be6c48572cb22ad5d9008a11fbd1e4eb2458b1d4c630252c42c1ee0aa )
Found 7 DNSKEY records for ke
ke. 14400 IN DNSKEY 256 3 5 (
AwEAAaBkBqtVmts+j332XZswxaz4X6F/JAoFUZ4O/MgGhafh7p1OHVS81BW+V98deLMSRu2/OG/+
m3tOFH2QygqoWUrIOWP1xikPbWgUL9Six9HDnTZNoj3HWuIj/32Gyu85rzpJmdH5wQzQB4NtD6D7
RzzN7tqvRqvX2PiZJxeys2KB ) ; Key ID = 29907
ke. 14400 IN DNSKEY 256 3 7 (
AwEAAbFTgMQWRaurBQ7hjQbBA6/GAmUDuqkQl2N1BOgS9dj9f6nr/Zw4s17vvUFD1vEky42UUlgY
F3TzwphnqKchZt0DFg6ichKU8LbVBqhvDJpFmQt3tMbdec+p2uGk9DVWehpIqcplgQT5DNY0chbS
TxpF/M7JgwN9Lch1+XJHikfcnezla44eraoTym7gKngPbqwd14tKcsT8BqIZmTve2PNpCdblD1LH
bNbBLci2PaEozymzUJJzcNYbrRKm3wGqT0TTxfRI6dmrad0ehMQYPV+uNCA5etEa/f4MbGXqlQWS
z147LHHOuU9F4dGbU+FqhpHoR0FaHA6svDCstSDcs9k= ) ; Key ID = 64547
ke. 14400 IN DNSKEY 256 3 5 (
AwEAAcWsO7Dw0stZXcHqnXAvjH0GnX4914mJMbZ4CHrq7iT+jbf1DCFTThd7oLr9Ps8bWXuRyt3u
dYigFAyTZaljQM5RKV8FM27eceAlT0O0ovVzTWR8ZmmjP7NEtZVacdEpjP6JFCHcjhjN3FxOarLX
AngmOGqzPaVIeivNoXg0/G3v ) ; Key ID = 33705
ke. 14400 IN DNSKEY 385 3 5 (
AwEAAezhOeiD//yvD7lxQm2eAP1g/bremr68AduwIBvYsW7TVRDummRx92s4JWzff/OBARCrbTOG
/T821JbGRBR0gRmk7xP4JRKGDIRV8b+Po8sERTOFzNR/8Py7AEd5RNFB8V+3bMAYQmrRsqV3bnG9
UTmoaxJV5C6YzPJ59yIvq/fQjyzHFSvL66kerDuCuTClZAQ4s2bo0wE1C4yR6LyZLUx0lW77gvRp
qkQC+rvB/jfNMFc5Mzbug4E9iMJSwhnBPz/RO6Rbybp6UksPV5Wvea8lcA+tcp0WMPj+6eFG2uPo
IGudT0LFaqOEzxvohbDK2pIHKkL83O6etq3SvpwwuPk= ) ; Key ID = 37599
ke. 14400 IN DNSKEY 257 3 5 (
AwEAAbR1BbJJYisVbjJ5nvOrGoVdKKkYxJPPOcq6Rbl13Fbr0s3JR3L838i+s38gpzJTCqabeDK7
97S+BUOl2GRClUL6oWo+1WnkUQlSniur3jILB+zdX4cr2oF43ufky3r7Aa91jlb/qgJX+9shmZu7
2hNc+z7ENTpsaShnbG3VD2IGXHCrCLEgFMDx3JRSSpwmiJLr3ZSEk4OFU1vyPzoZr+Y8Pl17MgDp
JmiM+zF8Bf5AfryDaI3lFF0bVj/ZdSqc4wgQ9NOQQYpNUMnY6gwqf+3MFQukhRwKqE214x9cThEr
VF3HMfOrvdLbMNhlYb0Jhua9lx509FmUp9JvDmkV6+8= ) ; Key ID = 30031
ke. 14400 IN DNSKEY 256 3 5 (
AwEAAb71Aap+lr6LRcmuFplBUN6yJNJo+WcQQAvUE3wkW78MXm/UtnmnytXoK52ye8LJXV0kpFsP
JUfP5+8nmcZrZYDcE1osQNQR16rs1N0Co7WcMAwK8Yrwdlhuc647FXCKNOVsVjbG0jPr/FoxznSb
4kmbvvbeM4VSV1ahwqYA5s5b ) ; Key ID = 49221
ke. 14400 IN DNSKEY 256 3 5 (
AwEAAdL6pxvxBUVncIevh7A0ryubVfUKaJPhwOBvmvuTbeayAadKSUKWVsPG8xB6lK+RkOv4Rc6/
wAtsarlfnn91HtcOA73VmrD1ow/WAVA7AA27WCufkBN8z2jkc5M4nM6LeEy6NLcAAgfa+rlxtiiX
psdQQBZDZHJAevkSF3c6h70n ) ; Key ID = 22836
DS=37471/SHA-1 is published, but a corresponding DNSKEY is not
None of the 7 DNSKEY records could be validated by any of the 2 DS records
DNSKEY=37599/SEP is revoked
Found 6 RRSIGs over DNSKEY RRset
ke. 14400 IN RRSIG DNSKEY 5 1 14400 (
20150430060002 20150331050002 22836 ke.
krzTEFK2itp2g9MWZiCXRobRuSKwB7PBLNhlZgIyIrcBQG1Z8XRoZhuvHcnnktk4LinOiWi9l073
6qiRs9SPL9NUlUC64+ajlovSRgUumiTVyolqqDgtkCUKEwCORQYfYWoZtUFYKgKkXDsq4EeXB1Fl
p3nJMN3UvaOxn9nJEPs= )
ke. 14400 IN RRSIG DNSKEY 5 1 14400 (
20150430060002 20150331050002 29907 ke.
E/6FsdCWNxoTcMjM0G5fxAmkZj5nwebBYDw3tnDLwMj/AgKCFI0L8/1hJfyTOgzQBWR/Y1FTtwI7
lIZE13jkipjR2Se8QnsOlk3G1NTzbS7YfdTQuy5ULGKr6OTTZv2p8CjKmfbrcZcDFcjMBao+ess0
f2TO8g+aP+II9aM9F5I= )
ke. 14400 IN RRSIG DNSKEY 5 1 14400 (
20150430060002 20150331050002 30031 ke.
cnvxfnmu6g9XDb1HVJBwVFipwdmKUZ/uIw5Zg5LnvCm2WWU5leWH/Ub9PY+R7QP4xNabyuklP0KO
Mh5biRlMrNpYezlt7CXqHTgSAlipsNxhF8dzPggjTIpRGu+w6w86cXTe5w87yijcIvpSeDKZq8Uh
dW+D4EPav661NIqLTf6NqN4aC4x5GL+rIj9ISluDcoZwOAXLRxxMWsaXYNColL9C9v2GFdNZ0Wfx
FdOqO8n0G04eBFrc3zy00rn8QCIhuvb8ZdGoSTIrbB83/BJS+HEa/+toNqCT4GuGpyJFZSMqDAOj
DSO0tXSoYTpFIJmX055rTDanjuWvPKxcHO9R0Q== )
ke. 14400 IN RRSIG DNSKEY 5 1 14400 (
20150430060002 20150331050002 33705 ke.
GMlaiNjk4eInXlimIqywp4Nsvtx4VHc75hBgG/6NikIaucFgPEgY+w0v4/OJGYsFPy9y+M6vGN4k
kcRpUaKTifay5QzojZ99ny8CW1rBveUF9Bo+uhXR+xQi1hpvSwiKL7hgX11Bj85bl8vbRaA6qSHT
/Vz8tZEUsM6b9WPxE9o= )
ke. 14400 IN RRSIG DNSKEY 5 1 14400 (
20150430060002 20150331050002 49221 ke.
KbHw/MtPTtvdX+fzlrGecA6r9iBeyGhjXj/F5vsUIcMMUdyRmnnu1qU3TCZEypSgECewJAWzRYh/
yOlbiW39XB6JoXb3gCJLQghGILGc4efU+8Arj1g81CnMOxHL+fkzKjpDzSMatxa1X1YSa8ehB4uR
Mo9290bJj2sbsyLebdo= )
ke. 14400 IN RRSIG DNSKEY 7 1 14400 (
20150430060002 20150331050002 64547 ke.
dsIiYDXgmzRZ64NmrlN4irnCZqyambu3uiVKdYcuiUguYgFT41QA1t1XSgluK3Ktj/emLvvLJ/qW
f7drGTqy9SNyuIjJTb3H0LCk3r9WkA8rinc40cajdf6zPcen44GFO0FsZhRMNMEXETJyHVgaemgj
9rjD8y9qtuPkEAlgzAtGcSu+4bAWTSR0OmktQ392KEa+j5MN1BPqug2GVZ8O9u1BnbXDI0unurby
LTB/tsuUe2r4pFPhRLVq2iSkBKvZYONBNDb+JGpfdijHjI7LYujhvhVeeOfxUeFWC4uprBD0ffDI
JVRH3qgusSbg9HYHyY/pMBnkQNBmGEA43qBp7w== )
RRSIG=22836 and DNSKEY=22836 verifies the DNSKEY RRset
RRSIG=29907 and DNSKEY=29907 verifies the DNSKEY RRset
RRSIG=30031 and DNSKEY=30031/SEP verifies the DNSKEY RRset
RRSIG=33705 and DNSKEY=33705 verifies the DNSKEY RRset
RRSIG=49221 and DNSKEY=49221 verifies the DNSKEY RRset
RRSIG=64547 and DNSKEY=64547 verifies the DNSKEY RRset
The DNSKEY RRset was not signed by any keys in the chain-of-trust
Found child zone co.ke
Attempting to learn nameservers for co.ke
Found co.ke nameservers: ns-ke.afrinic.net, ns1.coza.net.za, mzizi.kenic.or.ke, ns.anycast.kenic.or.ke