DomainDNSCheck

DNSSEC Checker

Enter a domain to see its DNSSEC state as validating resolvers experience it: secure, unsigned, or broken in a way that stops the domain from resolving.

  • DNS
  • Live check
  • Free, no sign-up
  • Results are not published

For example example.com — URLs and email addresses are accepted too.

At a glance

What it checks
Check whether a domain is DNSSEC-signed, whether its DS and DNSKEY records match and whether it validates.
Data source
DS, DNSKEY and validation flags from validating public resolvers.
Freshness
Live check; results are cached for up to 15 minutes
Limits
Validation is reported as the resolvers see it; it is not a full offline chain audit of every key. Methodology
Cost
Free, no account needed

Understanding the result

How the check works

DNSSEC links a chain of signatures from the root zone down to your domain. The key link is the DS record at the parent (for example in .com), which must match one of the DNSKEY records published in your own zone. The checker queries the DS, DNSKEY and SOA records of the registrable domain through a validating public resolver and reads the resolver's "authenticated data" flag.

If the SOA or DNSKEY query fails with SERVFAIL, the tool repeats it with validation disabled. When the unchecked query succeeds, the failure is caused by DNSSEC, not by an unreachable server. For an introduction to the mechanism, read What is DNSSEC?

The possible states

  • Secure (PASS): DS and DNSKEY records exist and the resolver validated the answer.
  • Unsigned (WARNING): no DS and no DNSKEY. The domain works, but answers are not protected against forgery.
  • Signed but not validated (WARNING): both record types exist, but the resolver did not mark the answer as authenticated.
  • Island of security (WARNING): DNSKEY records exist but no DS was published at the parent, so the signatures are never used.
  • DS without keys (FAIL): the parent points to keys that the zone does not publish. Validating resolvers will refuse to resolve the domain.
  • Bogus (FAIL): validation fails, and the domain is unreachable for everyone using a validating resolver.

Additional findings flag a DS set whose key tags do not match any DNSKEY, deprecated algorithms such as RSASHA1, and DS records that use only the SHA-1 digest.

Fixing a broken chain

Most DNSSEC outages happen during a change of DNS provider or a key rollover. If the result is bogus or DS without keys, the fastest fix is usually to remove the DS record at your registrar, wait for the parent's DS TTL to expire and then set DNSSEC up again with the new provider. Always publish the new DNSKEY before adding its DS, and remove the old DS before the old key disappears.

For new deployments, ECDSAP256SHA256 (algorithm 13) and ED25519 (algorithm 15) are widely recommended because they produce small, fast signatures. Use SHA-256 for DS digests.

Scope of the check

The checker evaluates the registrable domain, not every subdomain, and it reports what public validating resolvers see. It does not audit signature expiry dates on individual records or NSEC/NSEC3 configuration. The registry's copy of your DS data is also listed in the RDAP / WHOIS Lookup, which is useful when you need to confirm what the registrar actually submitted.

Frequently asked questions

Is an unsigned domain a problem?

It is not an error, and a large share of domains are unsigned. DNSSEC protects against forged DNS answers, so it is most valuable for domains that handle sensitive traffic or email. It also requires some operational care, particularly when changing DNS providers.

My domain is bogus. Why does it still load for me?

Your own resolver may not validate DNSSEC, or it may still have a cached answer. Users of validating resolvers such as 1.1.1.1 or 8.8.8.8 will be unable to reach the domain, so treat a bogus result as an outage.

Where do I add a DS record?

At your registrar, not in your DNS zone. Your DNS provider generates the values (key tag, algorithm, digest type and digest), and the registrar passes them to the registry.

Does DNSSEC encrypt DNS traffic?

No. It signs answers so they can be verified, but does not hide them. Encryption between you and your resolver is provided by protocols such as DNS-over-HTTPS.