DNSSEC Checker
Follow the chain of trust from the parent DS record to the zone's DNSKEY and signatures, and see what validating resolvers conclude.
What this tool checks
- Validation outcome from two independent validating resolvers
- DS records published in the parent zone
- DNSKEY records served by the zone, with key tags and roles
- DS digests recomputed and matched against the zone's keys
- Signature presence and validity windows
How to read the results
- Pass
- The check succeeded based on the observed responses.
- Warning
- Works now, but is risky, unusual or worth reviewing.
- Fail
- A problem was observed directly in the responses.
- Inconclusive
- Not enough evidence — for example a server did not respond.
Frequently asked questions
- How do I check if DNSSEC is enabled for a domain?
- Enter the domain above. If the parent zone publishes a DS record and validating resolvers accept the answers, DNSSEC is enabled and working. No DS record means the domain is unsigned, which is common and not an error.
- What does "DNSSEC bogus" mean?
- The domain is signed but resolvers cannot validate it, usually because the DS record at the registrar no longer matches the zone's keys or the signatures have expired. Validating resolvers then return SERVFAIL.
- Why did DNSSEC break after I changed DNS provider?
- The old provider's DS record is still at the registrar, and the new provider signs with different keys or not at all. Update the DS record at your registrar to the new provider's values, or remove it.
- Should I enable DNSSEC?
- It protects visitors from forged DNS answers. Enable it if both your DNS provider and registrar support it, and always deal with the DS record before you change DNS provider.