DNSSEC Checker
Check whether a domain is signed with DNSSEC, whether the chain of trust is complete, and whether anything is broken. Plain English results, no signup.
Enter a domain name without http:// or www
Enter a domain name above and click Check DNSSEC to see whether it is signed and validating.
A DNSSEC check tells you whether a domain’s DNS records are cryptographically signed, and whether the chain of trust from the internet’s root down to that domain is complete. When it is, resolvers that check signatures can prove a DNS answer is authentic and hasn’t been forged along the way.
This tool runs the same checks a validating resolver does, then explains the result in plain English. Use it to confirm DNSSEC is working after you turn it on, to diagnose a domain that has stopped resolving, or to check a domain before you move it to a new host.
What the Results Mean
Every check ends in one of five results. The colored banner at the top of your results shows which one applies.
Protected
The domain is signed, the registry has a matching DS record, and a validating resolver accepted the full chain. There’s nothing to fix. Just remember to remove the DS record at your registrar before you ever change DNS provider.
Signed With Warnings
DNSSEC works, but something needs a look. The most common causes are a leftover DS record from an old provider that no longer matches any key, or an outdated signing algorithm. The amber items in the checks list explain what to do.
Not Signed
DNSSEC isn’t enabled. The domain works normally, but its DNS answers aren’t verified. This is the most common result, and it isn’t an error. Whether it’s worth switching on depends on your site and your DNS provider.
Incomplete Setup
Your DNS provider is signing the zone, but the registrar hasn’t published a DS record yet. Resolvers ignore the signatures until that link exists. If you’ve only just added the DS record, give it a few hours. If not, add it in your registrar’s DNSSEC settings.
Broken
The registry and your DNS provider disagree about the keys. Resolvers that check DNSSEC will refuse to answer for the domain, so some visitors can’t reach your site or send you email. Fix this as soon as possible. The steps are below.
What This Tool Checks
DS Record
The DS (Delegation Signer) record sits at the registry for your domain extension, such as .com or .no. It holds a fingerprint of your signing key and connects your domain to the chain of trust. You add it through your registrar, not your DNS provider.
DNSKEY Records
DNSKEY records hold the public keys your DNS provider uses to sign your records. Most setups publish two: a key signing key, which the DS record points at, and a zone signing key, which signs your everyday records like A, MX and TXT.
Key Tag and Digest Match
The tool calculates the key tag and digest of each published key and compares them with the DS record. If they match, the registry and your DNS provider agree. If they don’t, you’ll see exactly which key tag the registry expects and which ones your provider publishes.
Signing Algorithm
Older algorithms like RSASHA1 are deprecated and may stop validating in future. Algorithm 13 (ECDSAP256SHA256) is the modern default and what most providers use today, including Cloudflare.
Live Validation
Finally, the tool asks a validating resolver for the domain twice: once normally, and once with validation switched off. If the normal lookup fails but the unvalidated one works, DNSSEC is definitely the cause of the problem.
How to Use This Tool
Enter a domain name in the field above without http://, https:// or www, and click Check DNSSEC. Results appear in a few seconds. If you enter a subdomain, the tool finds and checks the zone it belongs to, since DNSSEC is set up per zone rather than per subdomain.
Queries go through Google Public DNS over HTTPS, with Cloudflare as a fallback. Both validate DNSSEC, so the result reflects what real visitors’ resolvers see. You can also share a result directly: the page address updates with the domain you checked.
Fixing Common DNSSEC Problems
Incomplete after turning DNSSEC on. You’ve enabled signing at your DNS provider but haven’t added the DS record at your registrar, or the registry hasn’t published it yet. Add the values your DNS provider gives you. Some registrars ask for the DS digest, others for the DNSKEY public key, flags and algorithm. Both lead to the same result.
Broken after changing hosts or DNS provider. This is the classic stale DS record. The registry still points at your old provider’s key, but the new provider signs with a different one, or doesn’t sign at all. Remove the DS record at your registrar right away, then set DNSSEC up again with the new provider once things are working. Resolvers may cache the old answer for a while, so recovery isn’t instant. Our guide on moving a WordPress site to a new host covers the safe order for next time.
Key tag doesn’t match. If you just entered the DS or DNSKEY values by hand, a character may have been lost when copying. Use the copy button in your DNS provider’s dashboard rather than selecting the text, and run the check again.
Extension doesn’t support DNSSEC. A few country domains still aren’t signed at the registry level. There’s nothing you can switch on until the registry adds support.
Still not resolving after a fix. DNS answers are cached for the length of their TTL, and DS records at the registry often stay cached for a day or more. Check your other records with our DNS Lookup tool, and give DNS propagation time to catch up before changing anything else.