Free DNSSEC Checker
See whether a domain is signed and whether resolvers validate it: the DS records at the parent, the keys in the zone, their algorithms, and what to fix when the chain is broken.
Three links in the chain of trust
DNSSEC only works when the parent points at your keys, the keys sign your records, and resolvers can verify the whole chain. The checker reads each link and says which one is missing.
DS record
The link to the parentPublished at your registrar, in the parent zone. It names your key-signing key by its hash so resolvers can trust it. No DS, no validation.
DNSKEY
The keys in the zoneA key-signing key (flags 257) that the DS points at, and a zone-signing key (flags 256) that signs the records. The algorithm number decides how strong they are.
Validation
What a resolver doesA validating resolver checks every signature up to the root and sets the AD flag when the chain holds. A broken chain means SERVFAIL for every visitor behind one.
Know the moment a DNSSEC chain breaks.
FortWatch checks DNSSEC on every domain you own, hour by hour, and alerts you when a DS record disappears, a key roll leaves the chain broken, or a zone that was signed goes unsigned.
- DNSSEC, DNS hygiene and dangling records watched on every domain
- An alert before a broken chain turns into SERVFAIL for your visitors
- The fix written out for each finding, ready for your registrar
Common questions about DNSSEC
What is DNSSEC?
▾
DNSSEC (DNS Security Extensions) signs the records of a DNS zone with a private key and publishes the matching public key as a DNSKEY record. A validating resolver checks each signature against the key, and the key against a DS record held by the parent zone, up to the root. A forged or altered answer fails the check and is thrown away.
What does the DS record do?
▾
The DS (Delegation Signer) record is a hash of your key-signing key, published not in your zone but in the parent zone, through your registrar. It is the link in the chain of trust: without it, resolvers have no way to know your keys are genuine, and your zone counts as unsigned even when DNSKEY records exist.
What does signed but not validated mean?
▾
The zone publishes DNSKEY records, but no DS record exists at the parent, so no resolver checks the signatures. Publish the DS record at your registrar; your DNS host shows the value on its DNSSEC page. Until then the signatures do no work.
Why does a broken DNSSEC chain take a site offline?
▾
A validating resolver that cannot verify a signed answer returns SERVFAIL instead of the record, so the site stops resolving for everyone behind Google, Cloudflare and Quad9 resolvers. The usual cause is a stale DS record after a key roll or a change of DNS host. Replace the DS at the registrar with the value the new keys give.
Which DNSSEC algorithm should I use?
▾
ECDSA P-256 with SHA-256 (algorithm 13) is the common choice today: small keys, small signatures, supported everywhere. Ed25519 (15) is newer and also fine. RSA/SHA-256 (8) still works with larger records. RSA/SHA-1 (5 and 7) is deprecated and resolvers are dropping it, so move off it.
How does this DNSSEC checker work, and is it free?
▾
It asks Cloudflare's public DNS over HTTPS resolver for the domain's A records with validation turned on, and reads whether the resolver validated the answer. It then fetches the DS and DNSKEY records and reads the key tags, flags and algorithms. Everything runs in your browser, nothing is sent to our servers, nothing is logged, and it is free with no signup.
Try another tool
DMARC & SPF Checker
Check any domain's SPF, DMARC, and DKIM records. Catch what spoofers can exploit.
SPF Record Checker
Any domain's SPF record: policy, lookup count against the limit of 10, authorized senders.
DKIM Checker
The DKIM key of any domain at its selector or the common ones, with the public key checked.
DNS Lookup
A, AAAA, MX, NS, TXT, CNAME records for any domain — direct from Cloudflare 1.1.1.1.
Subdomain Finder
Find every subdomain a domain has ever issued a certificate for via Certificate Transparency logs.
Security Headers Checker
Grade any site's HTTP security headers — missing, weak, and what your server leaks.
CAA Record Checker
Which certificate authorities a domain allows to issue its certificates, and what to publish when none is set.
Subdomain Takeover Checker
Subdomains whose CNAME points at a service that no longer answers, the records an attacker can claim.
security.txt Checker
A site's security.txt checked against RFC 9116: contact, expiry, canonical address, signature.