DNSSEC Checker

Check whether a domain is signed with DNSSEC and whether the chain of trust actually validates — DS, DNSKEY and the authenticated-data flag, read over secure DNS. Free, nothing stored.

About DNSSEC

Plain DNS has no built-in authentication, so an attacker who can inject responses (cache poisoning) can send visitors to the wrong server. DNSSEC fixes this by signing a zone's records; resolvers follow a chain of trust from the root down to the domain, checking signatures at each step. For it to work the zone must publish its DNSKEYs and the parent must publish a matching DS record — missing either breaks validation. A green result here means a validating resolver confirmed the whole chain verifies.

More PAYATE tools

Margin CalculatorProfit, margin & markup Bcrypt GeneratorBcrypt hash & verify HTTP Status CodesEvery HTTP code explained Meme GeneratorAdd top/bottom text to images

Frequently asked questions

What is DNSSEC?

DNSSEC (DNS Security Extensions) cryptographically signs a domain's DNS records so resolvers can verify they are genuine and were not tampered with in transit. Without it, DNS answers can be spoofed (cache poisoning); with it, forged answers are rejected.

What do DS and DNSKEY mean?

The DNSKEY records are the public keys the domain signs its zone with. The DS (Delegation Signer) record is a fingerprint of the key published at the parent zone (the TLD), which anchors the chain of trust. You need both — keys in the zone and a matching DS at the parent — for DNSSEC to actually validate.

What does "validating" (AD) mean?

When a validating resolver checks the signatures all the way up to the root and they pass, it sets the AD (Authenticated Data) flag. This tool reads that flag from a validating resolver, so a green result means the chain really verifies — not just that keys exist.

My domain shows signed but no DS — is that a problem?

Yes. Keys in the zone with no DS at the parent means the chain of trust is broken — resolvers cannot anchor it, so it is effectively not protected. Add the DS record at your registrar to complete DNSSEC.

Does it store what I check?

No, nothing is stored. For all records use the DNS Lookup, and to see propagation the DNS Propagation Checker.