DNSSEC check

Set up correctly, DNSSEC protects against forged DNS answers; set up wrongly, it makes the domain unreachable for validating resolvers. The tool reads DS and DNSKEY records, computes key tags in the browser to match them and compares validating and non-validating queries to detect a bogus state.

How to use it

1. Enter the domain whose DNSSEC status you want to know.
2. Press the run button. Results are listed separately as definite problems, possible issues, unverifiable and passed; each finding shows what was found, what it means, the fix and the limits of the check.
3. Apply the suggested fix and run the tool again to confirm. Use “Copy result” to add the report to a support ticket.

Example

If an old DS stayed at the registrar after a name server change, the tool reports that validating queries return SERVFAIL and the chain is broken. The “Example” button in the form fills in a scenario like this and shows the result immediately.

Scope and limits

The result falls into one of three states: validated (AD), bogus (SERVFAIL with validation, an answer without) or unverifiable. Key tags are computed in your browser per RFC 4034.

Your inputs are not added to the address bar or passed to analytics, and result pages are not indexed by search engines.

Related guides

• Change name servers without losing email
• DNS records explained: A, AAAA, CNAME, MX, TXT
• Domain search and prices

More tools

• Why isn't my domain loading?
• DNS change dry-run
• DNS record diff
• Name server change checklist
• All tools →