DNSSEC checker
Check whether a domain is signed with DNSSEC and whether validating resolvers accept it.
Choosing a check opens its page. With the keyboard, use the arrow keys, then press Enter.
What we check
We find the DNS zone the name belongs to and ask a validating resolver whether its answers validate with DNSSEC. We show the DS records held by the parent zone, the zone's DNSKEY records, and the dates its signatures expire, and point out outdated algorithms, DS records that match no key, and signatures close to expiry.
Reading the result
- Signed and valid: validating resolvers accept the domain's answers.
- Not signed: DNSSEC isn't turned on. The domain works normally.
- Signed, but not validated: the setup is incomplete, usually a missing DS record at the registrar.
- Bogus: validation fails, and many people can't reach the domain. Fix this first.
Frequently asked questions
What is DNSSEC?
DNSSEC adds digital signatures to DNS answers, so a resolver can check that an answer really came from the domain's owner and wasn't changed on the way.
What does "bogus" mean?
The domain publishes DNSSEC data, but the signatures don't check out, for example because they expired or the DS record at the registry doesn't match the keys. Validating resolvers then refuse to answer, so many people can't reach the domain at all.
Is it a problem if a domain isn't signed?
Not in itself: most domains aren't signed, and they work normally. DNSSEC adds protection against forged DNS answers, and is needed for some features such as DANE.
What are DS and DNSKEY records?
DNSKEY records hold the domain's public keys. The DS record, published by the registry for the parent zone (for example .com), vouches for one of those keys. Together they link the domain into the chain of trust from the DNS root.
How do you check the signatures?
We ask Quad9, a public resolver that validates DNSSEC, and report its verdict. We show the keys and signature dates it returned, but we don't repeat the cryptographic checks ourselves.
Related tools
-
DNS Lookup
Look up the DNS records published for a domain, one type or all common types at once, or the reverse DNS name of an IP address.
-
CAA Checker
See which certificate authorities a domain allows to issue its certificates.
-
Website Health Check
Run the main website, DNS and email checks on one site at once and get a short report, area by area, with links to the full results.