DNSSEC Validator
Verify a domain’s DNSSEC chain of trust from the root down, and get a plain English explanation of any break.
About the DNSSEC Validator
DNSSEC adds digital signatures to DNS so a resolver can prove an answer really came from the domain's owner and was not altered on the way. It works as a chain: the root zone vouches for the top level domain, the top level domain vouches for your domain, and each link is a DS record in the parent that points to a key in the child. If any link is wrong, validating resolvers refuse to answer and your site or mail goes dark for everyone using them.
This tool performs the same verification a validating resolver does. It starts from the IANA root trust anchor, checks the cryptographic signature on each zone's DS record and key set, confirms that the parent's DS record matches a key the zone really publishes, and reports each link with the algorithm used and when its signature expires. When something is broken it says what, in plain language, and what to change: a stale DS record after a provider move, a DS left behind after DNSSEC was switched off, or a signature that was never renewed.
The check covers the chain of trust and the zone's key signatures. It does not verify the signature on every individual record or the proofs that a name does not exist. Not using DNSSEC at all is reported as unprotected rather than as an error. For the rest of a domain's setup, see Domain X-ray and the DNS Lookup.
Reach the developers and engineers who use these tools every day.
Frequently asked questions
What does it mean when a domain is bogus?
The domain advertises DNSSEC, but the chain does not verify, so validating resolvers will refuse to resolve it and return SERVFAIL. Visitors on networks that validate, such as most large public resolvers, cannot reach the site. The explanation names the broken link.
My domain is flagged as signed but not connected. What do I do?
Your DNS host is publishing keys but the parent zone has no DS record pointing to them, so DNSSEC is not protecting anything. Copy the DS record from your DNS host and add it at your domain registrar. Until then nothing breaks, but nothing is protected either.
I turned DNSSEC off and my domain stopped working. Why?
Turning it off at the DNS host removes the keys, but the DS record at the registrar remains and still tells resolvers to expect signatures. Remove the DS record at the registrar first, wait for it to expire from caches, and only then disable signing at the host.
Why does the report show when a signature expires?
DNSSEC signatures are valid for a limited time and must be renewed. If the signing system stops, the signatures lapse and the domain breaks without warning. The expiry date tells you how much time you have.
Which algorithms are supported?
RSA with SHA-1, SHA-256 and SHA-512, ECDSA P-256 and P-384, and Ed25519. SHA-1 based algorithms are flagged as deprecated. Zones using other algorithms are reported as not fully checkable.