DNSSEC Check

Run this tool

Input or start condition: Enter the labeled value and submit it. The lookup is idle without a valid query parameter.

Accepted input or signal: Domain name, Submitted public lookup target.

Possible output: DS records published through the parent zone for the entered domain.; DNSKEY records published by the domain's zone and authenticated-data status from a validating query.

Key limitation: A DS record that no longer matches an active DNSKEY can make otherwise correct DNS data fail validation.

What this checks

• DS records published through the parent zone for the entered domain.
• DNSKEY records published by the domain's zone and authenticated-data status from a validating query.
• A combined state: signed and validating, signed but not validated, unsigned, or indeterminate.

How to interpret results

• Signed and validating means the resolver authenticated the response through an intact chain of trust.
• Signed but not validated means signing records exist but the validation signal was absent, so delegation and key matching need review.
• Unsigned can be intentional; it means DNSSEC authentication is not available for the checked domain.

Common issues

• A DS record that no longer matches an active DNSKEY can make otherwise correct DNS data fail validation.
• Key rollovers and registrar delegation updates must be sequenced carefully because caches can retain old DS or DNSKEY data.

Reading DS, DNSKEY, and validation together

DNSKEY records are the zone's public signing keys. A DS record in the parent zone links that delegation to a matching key, while a validating resolver follows the chain and sets authenticated data only when the cryptographic checks succeed.

That is why the presence of a DNSKEY alone is not enough. A useful check considers the parent DS, child DNSKEY, and live validation result as one chain.

Troubleshooting a broken DNSSEC chain

Compare the DS key tag, algorithm, and digest with the intended DNSKEY, then check whether a rollover recently added or removed keys. Confirm the registrar published the expected DS and that every authoritative server serves the same signed zone.

During a planned rollover, allow the relevant TTLs to expire before removing old material. An invalid chain can make a domain unreachable for users behind validating resolvers even while non-validating queries appear normal.

Privacy note

The entered domain is sent to the site's server solely to query public DS, DNSKEY, and validation data. DNSSEC results are not intended for user profiling.

Frequently Asked Questions

What does a DNSSEC check verify?

It checks for parent-published DS records, zone DNSKEY records, and authenticated-data status from a validating DNS query, then summarizes whether the domain appears signed and validating.

What is the difference between signed and validating?

A zone can publish DNSKEY records without a working parent-to-child chain of trust. Validating means a resolver could authenticate the response through DS and DNSKEY records, not merely that signing material exists.

Why can a DNSSEC result be indeterminate?

Temporary resolver failures, incomplete records, unsupported algorithms, delegation changes, or a broken chain can prevent a conclusive signed-validating or unsigned result.