DNSSEC Checker and Validator
Check whether a domain is signed with DNSSEC and validates from the root: the DS record at the parent, the zone's DNSKEYs, signature expiry and the resolver's verdict.
How it works
How DNSSEC is validated
Chain of trust
The root signs the TLD, the TLD publishes a DS record for your domain, and your zone's DNSKEY must match that DS. Every link has to be valid.
Signatures expire
RRSIG signatures have an expiry date. If the signer stops re-signing, the zone turns bogus when they expire.
Bogus is worse than unsigned
An unsigned domain still resolves. A broken chain makes validating resolvers return SERVFAIL, so the domain disappears for most users.
FAQ
Frequently asked questions
My domain is bogus after moving DNS providers. Why?
The old DS record is still at the registrar but the new provider signs with different keys. Remove the old DS (or replace it with the new one) at your registrar.
How do I turn DNSSEC on?
Enable signing at your DNS provider, then copy the DS record it gives you to your registrar.
Which algorithm should I use?
ECDSA P-256 (algorithm 13) is the common modern choice: small signatures and supported everywhere.
More free tools
All toolsAuthoritative DNS with GeoDNS