DNSSEC Checker

Test whether a domain is protected by DNSSEC: we verify the DS record at the parent against the zone's DNSKEYs and check that validating resolvers accept its answers.

Try: cloudflare.com, ietf.org, dnssec-failed.org (deliberately broken), google.com
DNSSEC is enabled and valid for cloudflare.comValidating resolvers authenticate this domain's answers (AD flag set).

DS records (at the parent zone)

Key tagAlgorithmDigestMatches a DNSKEY
2371ECDSA P-256/SHA-256SHA-256
32996839A6D808AFE3EB4A795A0E6A7A39A76FC…		Yes

DNSKEY records (in the zone)

Key tagRoleAlgorithmFlags
34505ZSKECDSA P-256/SHA-256256
2371KSKECDSA P-256/SHA-256257

What is DNSSEC?

DNS was designed without any way to check that an answer is genuine, which makes cache poisoning and spoofing attacks possible. DNSSEC (DNS Security Extensions) adds digital signatures to DNS records. A zone publishes its public keys as DNSKEY records and signs each record set with an RRSIG. The parent zone (for example .com) publishes a DS record containing a hash of the child's key-signing key. Following DS → DNSKEY → RRSIG links all the way up to the root creates a chain of trust that validating resolvers can verify. Read our DNSSEC guide.

What this checker verifies

  1. DS at the parent: whether the registry publishes a DS record for the domain.
  2. DNSKEY in the zone: the published keys, their roles (KSK or ZSK) and algorithms.
  3. DS ↔ DNSKEY match: we recompute each key's tag and digest ourselves and confirm the DS record points at a real key.
  4. Live validation: we ask a validating resolver (Cloudflare 1.1.1.1) for the domain and check the Authenticated Data (AD) flag, plus any extended DNS error explaining a failure.

How to enable DNSSEC

  1. Turn on DNSSEC signing at your DNS host. Most major DNS providers do it with one click.
  2. Copy the DS record they give you (key tag, algorithm, digest type and digest).
  3. Add it in your domain registrar's DNSSEC settings. Some registrars do this automatically when they also host your DNS.
  4. Wait for the parent zone's TTL, then run this check again.
Moving DNS providers? Remove the DS record at the registrar before switching name servers, or the old DS will not match the new provider's keys and your whole domain will stop resolving for users of validating resolvers.

Frequently asked questions

Does DNSSEC encrypt DNS?

No. DNSSEC proves answers are authentic but does not hide them. Encryption comes from DNS-over-HTTPS or DNS-over-TLS.

Which algorithm should I use?

ECDSA P-256 with SHA-256 (algorithm 13) is the modern default: small, fast and widely supported. Ed25519 (algorithm 15) is also good where supported.

Why do some big sites not use DNSSEC?

Operational risk and complexity, especially for large, multi-provider setups. Adoption varies widely by TLD and provider.

Copied to clipboard