DNSSEC Checker
Check whether a domain is signed with DNSSEC.
Enter a domain to check whether DNSSEC is enabled and validating. DNSSEC signs your DNS answers so resolvers can detect tampering, and it is the foundation that DANE and TLSA records rely on. We read the live records straight from DNS over an encrypted connection. Nothing is stored.
This tool checks whether a domain is signed with DNSSEC (Domain Name System Security Extensions) and whether the chain of trust validates. DNSSEC adds cryptographic signatures to DNS answers so that a resolver can verify the data was not tampered with in transit. Without it, DNS responses are trivial to forge, which undermines anything that relies on a DNS lookup being honest, including DANE/TLSA records for mail.
What the checker looks for
A signed zone publishes DNSKEY records (the public keys) and RRSIG records (the signatures over each record set). The parent zone publishes a DS (Delegation Signer) record, a hash of your key-signing key, which links your zone to the chain of trust rooted at the DNS root. The tool reports whether DNSKEY, RRSIG and DS records are present and whether the DS in the parent matches your published key. A domain can be signed internally yet still fail to validate if the DS record is missing, stale, or uses an algorithm the parent does not list.
How to read the result and fix problems
If the result is secure, the chain validates end to end. If it is insecure, the zone is simply unsigned. Enable DNSSEC in your DNS host's control panel, which usually generates the keys and publishes DNSKEY/RRSIG automatically. The crucial manual step is taking the generated DS record to your domain registrar so the parent zone publishes it; a signed zone with no DS at the registrar will not validate. A bogus result means signatures exist but fail, commonly because of an expired RRSIG, a key rollover that removed the wrong key, or a DS that no longer matches the active KSK. DNSSEC is a prerequisite for trustworthy DANE, and our done-for-you service can set the dependencies up correctly. See more tools.
Frequently asked questions
What is the difference between a domain being signed and being validated?
Signed means your own zone publishes DNSKEY and RRSIG records. Validated means the parent zone holds a matching DS record so the chain of trust reaches your domain. A zone can be signed but still fail validation if the DS record was never submitted to the registrar or no longer matches your active key.
How do I enable DNSSEC?
Turn it on in your DNS provider's dashboard, which generates the keys and publishes the DNSKEY and RRSIG records for you. Then copy the resulting DS record (or its components) into your registrar's DNSSEC settings so the parent zone can complete the chain.
What does a "bogus" or SERVFAIL result mean?
It means signatures are present but validation failed, so a security-aware resolver returns SERVFAIL rather than risk serving forged data. Common causes are an expired RRSIG, a mishandled key rollover, or a DS record that no longer matches your current key-signing key.
Why does DMARC or BIMI not require DNSSEC but DANE does?
DMARC, SPF, DKIM and BIMI verify message authenticity through their own signatures and policy checks, so they work without a signed zone. DANE/TLSA records, by contrast, carry no independent signature; their only protection is the DNSSEC chain, so DANE is meaningless without it.
Will enabling DNSSEC break my email or website?
It should not, provided the keys are published correctly and the DS record at the registrar matches. The usual cause of an outage is an expired signature or a botched key rollover, so use a provider that handles re-signing and rollovers automatically, and verify the chain after any DNS change.
What is a DS record and where does it go?
A DS (Delegation Signer) record is a hash of your zone's key-signing key. It is published in the parent zone via your domain registrar, not in your own zone, and it is what links your domain into the global chain of trust.