DNSSEC Checker
Checks whether a domain is signed with DNSSEC and whether its trust chain validates.
Frequently Asked Questions
What is DNSSEC and why does it matter?
DNSSEC digitally signs DNS records to guarantee the answer you receive has not been forged or tampered with; it prevents attacks such as DNS cache poisoning.
What are DS and DNSKEY records?
DNSKEY is the public key published at the domain, and DS is a fingerprint of that key held at the parent registry to complete the chain of trust.
What does the AD flag in the result mean?
AD (Authenticated Data) means a validating resolver checked the signature chain and found it valid; it indicates your DNSSEC setup is healthy.