DNSSEC Checker

The DNSSEC Checker inspects whether a domain is signed with DNSSEC and whether the resulting chain of trust actually validates end-to-end. We query DS records at the parent zone, DNSKEY records at the zone itself, and issue lookups against Cloudflare 1.1.1.1 with the DO (DNSSEC OK) bit set — then report the AD (Authenticated Data) flag returned for A, SOA, DS and DNSKEY queries. AD=true means a validating resolver has cryptographically verified the answer.

DNSSEC prevents cache poisoning and DNS spoofing by adding digital signatures to DNS records. A zone is 'signed' when its DNSKEY records exist and the parent zone publishes a matching DS record. It is 'validating' when a resolver walks that chain — root → TLD → your DS → your DNSKEY → your RRSIG on the record — and every signature verifies. Signed-but-not-validating usually means a missing or mismatched DS at the registrar, an expired signature, or an algorithm the resolver doesn't support.

Use DNSSEC Checker before enabling MTA-STS or DANE (both benefit from DNSSEC-signed zones), before migrating registrars (DS records break during transfer if you don't republish them), and when hardening high-value zones like your primary brand, email, or payment domains. Pair with SOA Lookup to see the current serial and with the Propagation Checker to confirm DNSKEY changes have replicated.