DNSSEC Checker

About DNSSEC Checker

DNSSEC signs a zone's records so a resolver can prove they came from the zone's owner and were not altered on the way. The proof is a chain: the root vouches for the TLD, the TLD vouches for your domain through the DS record your registrar publishes, and your domain's keys sign its records. When any link is wrong, validating resolvers — Google, Cloudflare, Quad9 and most ISPs — refuse to answer, and the domain disappears for their users.

The verdict comes from a validating resolver, because that is what users actually experience: an answer marked authenticated is secure, and a SERVFAIL that turns into an answer when checking is disabled means the signatures are broken. The explanation is computed here from the records themselves. The DS at the parent is hashed against each of the zone's keys to see whether any matches, algorithms are checked against the deprecations in RFC 8624, and every signature's validity window is compared with the current time.

Those are the causes behind nearly every DNSSEC outage: a DS left pointing at a key that was rolled or at a DNS provider the domain has left, a signer that stopped re-signing, a SHA-1 algorithm validators now reject.

Where it helps

• Gives the verdict validating resolvers give, including the SERVFAIL-versus-CD test that tells a broken zone from an unreachable one.
• Recomputes each DS digest from the zone's keys, so a stale DS after a rollover is named by key tag.
• Flags deprecated algorithms and SHA-1 digests under RFC 8624, short RSA keys, and signatures that are expired, expiring or not yet valid.
• Finds the zone apex for any name inside it, so www.example.com checks example.com's keys.

Limits

• Signatures over individual records are validated by the resolver, not recomputed here. The tool explains a failure through the DS, keys, algorithms and signature dates, which covers the common causes but not a corrupted signature on one record.
• Only the zone itself is inspected in detail. A broken link higher up, in a TLD, shows as bogus without the detail.
• Resolvers cache. A fix made in the last hour may not show until the old records' TTL runs out.

Frequently asked questions

Why does my domain work for some people and not others after enabling DNSSEC?

Because only validating resolvers check the signatures. If the chain is broken, users of Google, Cloudflare and most ISPs get SERVFAIL, while users of a non-validating resolver get an answer. Run the check: a bogus result with a DS that matches no key is the usual cause.

How do I safely move a DNSSEC-signed domain to a new DNS provider?

Either remove the DS at the registrar, wait for its TTL (often a day or two), move, re-enable signing and add the new DS; or, if both providers support it, add the new provider's key to the old zone first. Changing nameservers while the old DS is still published makes the domain bogus.

What is the difference between a KSK and a ZSK?

The key-signing key (flags 257) signs only the DNSKEY set, and the DS at the parent points at it. The zone-signing key (flags 256) signs everything else. Splitting them lets the ZSK be rolled often without touching the registrar. Many providers now use one combined key (a CSK) for both.

Which algorithm should DNSSEC use?

ECDSA P-256 with SHA-256 (algorithm 13) is the widely supported recommendation; Ed25519 (15) is also recommended. RSA/SHA-256 (8) is acceptable. RSA/SHA-1 (5 and 7) is deprecated and increasingly treated as insecure.

Related tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• DNS Propagation Checker — The same name asked of resolvers worldwide, and of the zone's own servers
• WHOIS — Registry records for a domain, an IP address or an AS number
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections

More Network & DNS tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is
• Ping (TCP) — Measure connection latency with repeated TCP probes
• What Is My IP — Your public address, and what a browser reveals about you
• WHOIS — Registry records for a domain, an IP address or an AS number
• DNS Propagation Checker — The same name asked of resolvers worldwide, and of the zone's own servers
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DKIM Lookup — A domain's DKIM keys, for a selector or by trying the common ones, and whether each is worth anything
• DMARC Lookup — A domain's DMARC policy, and what it actually asks receivers to do
• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• IP Blacklist Checker — Whether an address is on the blocklists that actually stop mail
• Reverse IP Lookup — What an address says about itself: its name, its certificate, its network
• Traceroute — Every hop between this server and a host, with the time each one took
• Broadband Speed Test — Download, upload, latency and jitter, measured from this tab
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Redirect Checker — Follow a URL's redirects hop by hop, and flag loops, downgrades and temporary redirects doing a permanent job
• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• MAC Address Lookup — Find the manufacturer behind a MAC address, and see what kind of address it is
• MAC to IP Converter — Build the IPv6 address a MAC forms with SLAAC, recover the MAC from one, or find a MAC's IP in an ARP table
• IP to MAC Lookup — Find the MAC address behind an IP: computed for multicast and EUI-64 addresses, or read from an ARP table