DNSSEC Check
Validate a domain's DNSSEC chain of trust: DS/DNSKEY/RRSIG, signing algorithms, expiry, and trust status
Usage
• Domain: enter a bare domain without https:// (e.g. cloudflare.com)
• Validates the DNSSEC chain of trust via Cloudflare / Google validating resolvers
• Unsigned is a normal state; bogus means signature validation failed and needs attention
What DNSSEC chain-of-trust validation is for
DNSSEC validation checks whether a domain has enabled DNS Security Extensions and whether the full chain of trust — from the root zone through the TLD to the domain's own DNSKEY — is intact. It returns the trust status (secure, insecure, or bogus), the DS and DNSKEY records, the RRSIG signatures and their expiry, and any warnings about weak algorithms or broken chains.
Common uses include confirming that DNSSEC is correctly configured after enabling it, diagnosing 'bogus' status caused by a broken chain or expired RRSIG, auditing algorithm strength when migrating from RSASHA1 to ECDSAP256SHA256, and verifying that a recently added DS record at the TLD registry has propagated correctly.
Frequently asked questions
What is the difference between secure, insecure, and bogus?
'Secure' means the domain has DNSSEC enabled and the chain of trust validates successfully. 'Insecure' means there is no DNSSEC delegation from the parent zone — the domain is unsigned, which is normal for most domains. 'Bogus' means DNSSEC is configured but validation fails, which is a configuration error that needs fixing.
Does not having DNSSEC mean my domain is unsafe?
Most domains do not use DNSSEC. Without it, DNS responses are not authenticated and could theoretically be spoofed. Whether the risk justifies the operational complexity of DNSSEC depends on your use case.
Which DNSSEC signing algorithms should I use?
Consult the current IANA registry’s separate signing and validation requirements, along with provider and resolver support. An algorithm number identifies a mechanism but does not establish the security of the complete trust chain or deployment.
Does DNSSEC add a fixed amount of lookup latency?
DNSSEC adds signed data and validation work. Latency depends on caches, round trips, response sizes and resolver implementation; there is no fixed millisecond overhead for every network.
References and result limitations
Online results reflect the queried source or probe state at that time. Record the target, time, nodes or data source, and parameters when citing them. A single result does not establish continuous availability everywhere.
These references explain protocol or format rules; they do not endorse results produced by this site.