DNSSEC Checker
This free DNSSEC checker tells you whether a domain is signed, whether its signatures validate from the registry down, and whether a broken DS record is making it unreachable.
What is DNSSEC?
DNSSEC adds digital signatures to DNS records, so resolvers can prove an answer really came from the domain's DNS host and wasn't forged on the way.
It works as a chain: your DNS host signs the zone and publishes its keys (DNSKEY records), and the registry publishes a DS record that vouches for the key. Both halves have to match.
How we check it
We ask Cloudflare's public resolver, which validates DNSSEC, for the DS and DNSKEY records. If it marks the answer as validated (the AD flag), the chain of trust checks out.
If it fails with SERVFAIL but answers when validation is switched off, DNSSEC is broken (bogus): validating resolvers refuse the domain, so its website and email stop working for their users. That's the most important thing this tool catches.
Should you switch DNSSEC on?
Switching it on stops forged DNS answers (cache poisoning), and some security standards, like DANE for email, need it.
The risk is that if the DS at the registry and the keys at your DNS host ever get out of step, after a key change or a move to another DNS host, the domain goes dark for validating resolvers. Turn it on where your DNS host manages the keys for you, and remove the DS before you move your DNS.
Frequently asked questions
What does "bogus" mean?
The domain says it's signed (there's a DS record at the registry), but the signatures don't check out. Validating resolvers then refuse to answer for it at all, which looks like the domain is down.
I moved my DNS and now my site is down for some people. Why?
Most likely the registry still has a DS record for your old DNS host's keys. Remove or update the DS at your registrar, and the site comes back as caches expire.
What do the algorithm numbers mean?
They're the signing method: 8 is RSASHA256, 13 is ECDSAP256SHA256 and 15 is Ed25519, all fine to use. 5 and 7 (RSASHA1) and the other old ones are deprecated, so roll over to 13 or 15.
Where do I add the DS record?
At your domain registrar, usually under DNSSEC in the domain's settings. Your DNS host gives you the values: key tag, algorithm, digest type and digest.
Does DNSSEC encrypt my DNS?
No. It signs answers so they can't be forged, but anyone on the path can still see them. Encrypted DNS is a separate thing (DNS over HTTPS or over TLS).