DNSSEC Checker
Check whether a domain’s DNS answers are cryptographically signed — and, more importantly, whether that signing is working. A broken DNSSEC setup does not degrade gracefully. It makes the domain unreachable for everyone behind a validating resolver, while continuing to work perfectly for the owner, who is usually the last to find out.
Queried against Google and Cloudflare over DNS-over-HTTPS. Both validate, so the result below is their verdict rather than ours. Nothing is sent to our servers.
What DNSSEC actually does
Ordinary DNS answers arrive unsigned. Nothing in the protocol proves the address you were given is the one the domain’s owner published, which is what makes cache poisoning possible: convince a resolver to remember a wrong answer and everyone using it goes to the wrong server, with a valid padlock, because the certificate was issued to whoever controlled the domain at that moment.
DNSSEC signs the answers. Each zone signs its records, the parent zone signs a fingerprint of the child’s key, and the chain runs up to the root. A validating resolver walks that chain and refuses anything that does not verify.
It does not encrypt anything. DNSSEC proves an answer is authentic; it does not hide the question. Anyone watching your traffic still sees which domains you look up. Hiding the question is what DNS over HTTPS does, and the two solve genuinely different problems.
Why a broken setup is worse than none
This is the result worth caring about. When signing is misconfigured — a key rotated without updating the DS record at the registrar is the classic cause — validating resolvers do not fall back to the unsigned answer. They refuse to answer at all, returning SERVFAIL.
So the domain vanishes for everyone using Google, Cloudflare, Quad9 or any ISP resolver that validates, and keeps working for everyone else. The owner tests it, sees it load, and concludes the reports are wrong. The check above settles it by asking twice: once normally, once with validation disabled. If the first fails and the second succeeds, DNSSEC is the reason.
Reading the result
| Result | What it means |
|---|---|
| Signed and valid | A DS record exists at the parent, the zone publishes keys, and both resolvers validated the chain. |
| Broken | Validation fails. The domain is unreachable behind validating resolvers. Urgent. |
| Not signed | No DNSSEC. Completely normal — most domains are unsigned, including
google.com. |
| Keys but no DS | The zone is signed but the parent was never told, so nothing validates it. The signing is doing no work at all. |
| DS but no keys | The parent vouches for a key the zone no longer publishes. This breaks the domain. |
What this can’t tell you
- Whether your own resolver validates. This asks Google and Cloudflare. If your ISP’s resolver does not validate, a broken domain will still load for you — which is exactly how these faults go unnoticed for weeks.
- Which link in the chain broke. It reports that validation failed, not whether the fault is at the registrar, the DNS host or the signing software.
- Anything about the website. DNSSEC secures the lookup. A perfectly signed domain can serve a phishing page.
- Whether signing is worth it for you. That is a judgement, and reasonable people disagree — the majority of large sites have chosen not to.
If yours is broken
| Cause | Fix |
|---|---|
| Key rotated, DS not updated | Copy the current DS record from your DNS host into your registrar. The most common cause by a distance. |
| Moved DNS hosts with DNSSEC on | Turn DNSSEC off at the registrar first, move, then re-enable. Migrating with it live breaks the chain mid-move. |
| Signatures expired | Signatures have lifetimes. If re-signing stopped running, they lapse and everything fails at once. |
| Need it working now | Removing the DS record at the registrar disables validation and restores reachability within the DS record’s TTL. Not a fix, but it stops the outage. |
DNSSEC is one part of a domain’s DNS health.
DNS Checker DNS Propagation DMARC CheckerFrequently asked questions
Should I enable DNSSEC?
If your registrar and DNS host both support it and can rotate keys automatically, it is a reasonable thing to switch on. If key management would be manual, weigh it carefully: a lapsed signature takes your domain off the internet for a large share of users, and that risk is real in a way cache poisoning mostly is not for a small site.
Why do so few big sites use it?
Because the failure mode is catastrophic and the threat it addresses is largely handled by HTTPS, which authenticates the server after the lookup. Reasonable engineers have looked at that trade and declined. It is genuinely a judgement call rather than negligence.
Does DNSSEC make my site faster or slower?
Marginally slower — more records, more to verify. Not enough to notice.
Does it replace HTTPS?
No, and neither replaces the other. DNSSEC proves you were given the right address. HTTPS proves the server at that address is who it claims and encrypts what you send it.