DNSSEC Checker
Check whether a domain is DNSSEC-signed, chained to its parent, and validated by resolvers.
Frequently asked questions
What is DNSSEC?
DNSSEC signs DNS records cryptographically so resolvers can verify they have not been tampered with in transit, protecting against cache poisoning and spoofing.
What do these results mean?
"Signed" means the zone publishes DNSKEY records. "DS at parent" means the chain of trust is established with the parent zone. "Validated" means a validating resolver authenticated the answer (the AD flag).
Is this a full DNSSEC validation?
No — this is a status check. It reports whether signing and the DS chain are present and whether a validating resolver authenticated the response, not a full local chain-of-trust proof.
Want these records watched around the clock?
Monitor your DNS automatically →