Skip to content
Emergency helpGet started
Back to Tools

DNSSEC Checker

Check whether a domain's DNS answers are signed and validate. The checker asks a validating resolver, reads the DS and DNSKEY records and explains what a failure means.
Start a check
  • Non-Intrusive Scan
  • DNS over HTTPS

What is a DNSSEC check?

DNSSEC (DNS Security Extensions) signs DNS records so that resolvers can confirm an answer came from the domain's real zone and was not changed on the way. It works as a chain: the parent zone, for example .com, publishes a DS record that matches one of the domain's DNSKEY records, and the domain's records are signed with those keys.

The checker sends its queries over DNS-over-HTTPS to a public validating resolver: Cloudflare 1.1.1.1, with Google Public DNS as a fallback. If the resolver sets the AD flag, the answer validated. If a query fails with validation on but succeeds with validation off, the chain is broken.

What the DNSSEC checker reports

Each check reads public DNS through a validating resolver. Algorithm advice follows the IANA registries that RFC 9904 made the reference.

AD flag

Set by the validating resolver when every record in the answer was verified with DNSSEC.

DS record

Published in the parent zone through your registrar. Its key tag and algorithm must match a DNSKEY in your zone. IANA recommends SHA-256 (digest type 2) and says SHA-1 must not be used for delegation.

DNSKEY records

Your zone's public keys. Flags 257 sets the Secure Entry Point bit, used for the key-signing key that the DS record points to; 256 is a zone-signing key.

Algorithm

IANA lists algorithms 8 (RSASHA256), 13 (ECDSAP256SHA256) and 15 (ED25519) as recommended for signing, and says algorithms 5 and 7 (RSA with SHA-1) must not be used to sign.

Validation failure

SERVFAIL with validation on, but an answer with validation off. Users of validating resolvers cannot resolve the domain until the DS record and the keys match again.

What the result means

DNSSEC is enabled and validates

A validating resolver authenticated the answer (AD flag set): the zone is signed and its DS record at the parent matches its keys.

DNSSEC is not enabled

The domain has no DS record at its parent and publishes no DNSKEY records, so DNS answers for it cannot be authenticated.

Zone is signed, but the DS record is missing

The zone publishes DNSKEY records, but the parent zone has no DS record for it, so resolvers treat it as unsigned. Add the DS record from your DNS provider at your registrar.

DNSSEC validation fails

Validating resolvers return SERVFAIL for this name, and the answer only comes back with validation turned off. Visitors behind validating resolvers cannot reach it. This usually means the DS record at the registrar no longer matches the zone's keys.

Related checks and next steps

Managed Cloudflare

Keep Cloudflare configured, monitored and improving. Vigilbase handles agreed changes and incident response, with Core, Priority and Critical coverage options.

Explore Managed Cloudflare

Managed SOC

Managed SOC on the security tools you already pay for. The Vigil agent investigates, our analysts handle exceptions, and coverage follows your SLA tier.

Explore Managed SOC
Email a security expert

Sources

Questions

DNSSEC checker FAQ

How do I check if DNSSEC is enabled?

Look up the domain's DS record in the parent zone and its DNSKEY records, then ask a validating resolver for one of its records and check the AD flag. The checker does all three.

How do I enable DNSSEC?

Turn on DNSSEC signing at your DNS provider, which publishes DNSKEY records and gives you a DS record. Add that DS record at your registrar. Resolvers start validating once the parent zone publishes it.

What happens when DNSSEC breaks?

Validating resolvers, including Cloudflare 1.1.1.1 and Google Public DNS, return SERVFAIL, so their users cannot resolve the domain. The usual cause is a DS record that no longer matches the zone's keys after a key change or a move to a new DNS provider.

Which DNSSEC algorithm should I use?

The IANA registry lists algorithms 8 (RSASHA256), 13 (ECDSAP256SHA256) and 15 (ED25519) as recommended for signing. Algorithm 13 produces much smaller signatures than RSA.

Does DNSSEC encrypt DNS?

No. DNSSEC proves that DNS answers are authentic and unchanged; it does not hide them. Encrypted transports such as DNS over HTTPS protect queries in transit.

Is the check stored?

No. Results are not stored. The queries go to the public resolver, which looks the domain up as it would for any visitor.Compare the public security checks