DNSSEC Checker

About the dnssec checker

DNSSEC adds cryptographic signatures to DNS records so a validating resolver can detect whether an answer was tampered with in transit. A zone signs its records with a private key, publishes the matching public key as a DNSKEY record, and a hash of that key, called a DS record, is published in the parent zone to link the child's signatures back to a chain of trust rooted at the DNS root.

This tool walks that chain: it fetches the DS record at the parent zone, the DNSKEY records at your zone, and the RRSIG signatures over your records, then checks that each link matches and that no signature has expired. A break at any point, not just at your own zone, causes validation to fail for anyone using a validating resolver.

The most common failure is a DS record at the registrar that no longer matches the current DNSKEY, which typically happens after switching DNS providers or rotating keys without updating the DS record at the registrar afterward. Expired signatures, usually from an automation that stopped running, are the second most common cause, and we warn while signatures are within a week of expiring rather than waiting for the outage.

An unsigned zone is reported here as information and deducts nothing from the domain's score. That is deliberate: DNSSEC is a real improvement for a domain where impersonation or cache poisoning is a concern, and it is a prerequisite for DANE, but it is not a baseline every domain is failing without. A broken chain is the opposite — it is graded severely, because it takes the domain offline for every validating resolver, which is a worse outcome than never having signed at all. If a chain is broken and you need resolution back immediately, removing the DS record at the registrar restores it unsigned within that record's TTL.

Common questions

What is DNSSEC?

A set of cryptographic signatures on DNS records so validating resolvers can detect tampering or spoofed answers, chained from the DNS root down to an individual zone.

My zone is signed but validation fails, why?

Usually the DS record published at the registrar does not match the zone's current DNSKEY, often after changing DNS hosts or rotating keys without updating the DS record afterward.

Is DNSSEC required?

No. We report an unsigned zone as information and deduct nothing for it. It is a genuine improvement where impersonation is a concern, and a prerequisite for DANE-based protections such as TLSA records, but it is not a baseline failure.

How do I get my domain back if DNSSEC breaks it?

Remove the DS record at your registrar. That takes the zone out of the chain of trust, and validating resolvers go back to treating it as unsigned once the old DS record's TTL expires. Fix the mismatch, then republish the DS.

Can DNSSEC break my domain if misconfigured?

Yes. A mismatched or expired DS/DNSKEY pair causes every validating resolver to treat the entire zone as unreachable, which is why changes should be tested before the DS record is published.