How do I check if DNSSEC is working for my domain?

Enter your domain in the DNSSEC Checker to validate the DS, DNSKEY, and signature chain of trust.

Why is my domain failing DNSSEC validation?

Common causes are a missing or wrong DS record at the registrar, expired RRSIG signatures, or DNSKEY/DS algorithm mismatches. The checker identifies the broken link.

DNSSEC is recommended for security-sensitive domains like banks, government, and email infrastructure. It complements but does not replace HTTPS and email authentication.

DNS & NETWORK TOOLS · FREE ONLINE TOOL

DNSSEC Checker

Check if a domain is signed with DNSSEC and validate the chainDNS answers can be forged on the path between your resolver and the nameserver. DNSSEC is the cryptographic answer, and this checker validates whether a domain's DNSSEC chain actually holds together.

✓ Free to use✓ No sign-up✓ Ready in your browser

// DNSSEC CHECKER · GET STARTED

Use DNSSEC Checker

Check if a domain is signed with DNSSEC and validate the chain

// DNSSEC CHECKER · AT A GLANCE

DNSSEC Checker: what to know first.

Check if a domain is signed with DNSSEC and validate the chain

01
Standard DNS has no built-in authentication: any on-path attacker can forge answers and send your visitors to a lookalike site. DNSSEC fixes this by signing every record set, so resolvers can cryptographically prove the data is genuine. The DNSSEC Checker queries your live DNSKEY records and the parent-zone DS record to show whether that protection is actually in place.
02
For signed zones the tool reports each key algorithm by name, computes the RFC 4034 key tag from the key bytes, and identifies KSK and ZSK roles from the flags. It also calls out the most common misconfiguration, a signed zone with no DS record at the parent, and tells you exactly where to fix it.

// DNSSEC CHECKER · HOW IT WORKS

How to use the DNSSEC Checker

Enter domain

Enter the domain you want to check (e.g. example.com).

Run the check

Click "Check DNSSEC" to query the live DNSKEY and DS records.

Review the chain

Review the signed status, key algorithms, key tags, and chain of trust.

// DNSSEC CHECKER · ABOUT THIS TOOL

About the DNSSEC Checker

Standard DNS has no authentication, so an attacker can forge answers and redirect visitors. DNSSEC fixes this by signing every record set, and this checker confirms the protection is in place. It reports key algorithms and KSK/ZSK roles, and flags the common misconfiguration: a signed zone with no DS record at the parent.

Where it helps most

Where a broken chain hurts.

After enabling DNSSEC

Enabling DNSSEC at the registrar and provider is only half the job; this catches chains broken by key rollovers.

Security audits

Banking, email infrastructure and government sites belong in the audit routine for any domain that matters.

Registrar checks

A missing DS record at the registrar is one of the most common ways the chain breaks silently.

Resolution failures

When DNSSEC breaks, legitimate resolution can fail too, not just spoofed answers getting through to users.

What gets checked

How the validation works.

Parent delegation

The checker walks the delegation from the parent zone and confirms the DS record exists where it should.

DNSKEY records

It retrieves the DNSKEY records holding the zone's public keys so signatures can be verified.

Signature verification

Record signatures are checked against the keys, with the failing link identified: missing DS, broken rollover, or invalid signatures.

DNSSEC Checker: built for trust

A clear pass or fail with the failing link identified, from public DNS data. No signup needed.

// DNSSEC CHECKER · COMMON QUESTIONS

DNSSEC Checker FAQs

What is DNSSEC?

DNSSEC adds cryptographic signatures to DNS records so resolvers can verify answers are authentic and unmodified. It protects against DNS spoofing and cache poisoning attacks.

How do I enable DNSSEC for my domain?

What happens if DNSSEC is misconfigured?

Does DNSSEC encrypt my DNS queries?

Why does my domain fail DNSSEC validation?

tools-guide

Security Headers Checker: Grade Your Site's Defenses

Free security headers checker. Instantly scan HSTS, CSP, X-Frame-Options and more on any site, get an A to F grade and clear steps to fix every website gap.

Read article →