Skip to main content
Free checker - no signup required

Free DNSSEC Checker

Check whether a domain is DNSSEC signed and whether the chain of trust validates. Reports the signing algorithm, DNSKEY and DS summary, RRSIG status, and any chain issues.

Run the check

Enter a domain to check it live against the IntoDNS.ai engine. No signup, no trial gating.

What this DNSSEC checker verifies

This checker inspects DNSKEY, DS and RRSIG records, then combines validating-resolver evidence with local delv validation when available. Publishing a DNSKEY alone does not prove that records are correctly signed. Secure, insecure, bogus and indeterminate outcomes are distinct; a timeout or missing AD flag is not proof of a broken chain.

What DNSSEC is and the problem it solves

Plain DNS has no authentication: a resolver asking for a record simply trusts whatever answer comes back, which makes it possible to forge responses and redirect users to an attacker's server (cache poisoning). DNSSEC fixes this by signing DNS records with public-key cryptography. Each record set is signed (an RRSIG), the signing keys are published (DNSKEY), and the parent zone vouches for the child's key by publishing a hash of it (a DS record). A validating resolver can then verify, mathematically, that an answer really came from the zone's keyholder and was not altered in transit. DNSSEC does not encrypt DNS — it authenticates it, proving the answer is genuine and intact.

The chain of trust and the critical DS record

The trust chain starts with a configured trust anchor. Signed DS records in a parent identify trusted child keys, which authenticate signed data below that delegation. Authenticated absence of a DS record normally creates an insecure delegation, even when the child publishes keys. Missing DS alone does not cause SERVFAIL; an invalid signature under an established trust chain is a different, bogus result.

How to read the result

Secure means the answer validates. Insecure means there is no authenticated chain to the zone; this is not the same as a bogus signature. Bogus means validation failed where signed data was expected. Indeterminate means the checker could not establish a reliable verdict. Inspect the recorded evidence before changing keys or DS records.

Why a broken DNSSEC setup is worse than none

A bogus response can cause validating resolvers to return SERVFAIL. An insecure delegation is different: authenticated absence of DS does not by itself break resolution. Coordinate DS and key changes with your DNS provider, monitor signature renewal, and validate the chain after a rollover.

How to enable DNSSEC for your domain

Enabling DNSSEC takes two parties: whoever runs your DNS signs the zone, and whoever holds your domain registration publishes the DS record at the registry. If your DNS is hosted by a large provider — Cloudflare, Route 53, Google Cloud DNS, Azure DNS, or your registrar's own nameservers — signing is usually a single switch in the DNS panel, after which the provider generates and rotates the keys for you. The step people miss is the second one: signing the zone alone changes nothing until the DS record reaches the parent zone. Some registrars read it from your nameservers automatically (CDS/CDNSKEY); most require you to paste the key tag, algorithm, digest type, and digest into a DNSSEC section of the domain settings. If your registrar and DNS host are the same company, the two halves are often linked and one toggle does both. After you have done it, wait for the parent zone to publish — this can take minutes to a day — and then run this checker: you want DNSKEY records present, a DS record found, and validation confirmed. Only when all three line up is the domain actually protected.

Not every TLD supports DNSSEC, and that is not your fault

Registry and registrar support are separate. .ai supports DNSSEC at registry level, although a particular registrar may not expose DS management. This was rechecked on 10 September 2026 using the signed .ai and nic.ai delegations. A few TLDs still lack a signed public delegation; the scanner uses a dated exception list for those, not a blanket exemption for .ai domains.

How to test DNSSEC yourself from the command line

Use dig +dnssec @1.1.1.1 example.com to inspect resolver validation and dig DS example.com to inspect the parent link. The AD flag on a trusted validating response is useful evidence; its absence alone is inconclusive. BIND delv provides a local validation verdict. Compare the actual DS, DNSKEY and signature evidence rather than assuming every unsigned answer is bogus.

What DNSSEC does not do

DNSSEC authenticates DNS answers; it does not encrypt queries, judge whether a destination is safe, or secure email or web applications on its own. SMTP DANE requires DNSSEC to authenticate TLSA records. MTA-STS does not require DNSSEC: it relies on HTTPS policy retrieval and certificate authorities instead. DNSSEC protection also depends on the resolver performing validation.

What This Checks

  • DNSKEY presence — whether the zone is DNSSEC signed
  • Chain-of-trust validation via the resolver AD flag
  • Signing algorithm and key-signing key identification
  • DNSKEY and DS record summary linking the zone to its parent
  • RRSIG signature presence and expiry warnings

Common Fix Path

  • Enable DNSSEC at your DNS host to start signing the zone
  • Publish the matching DS record at your registrar to complete the chain
  • Update the DS record during key rollovers before retiring the old key
  • Rely on automatic RRSIG re-signing and re-check the AD flag after changes

Frequently Asked Questions

What does DNSSEC do?
DNSSEC adds cryptographic signatures to DNS so resolvers can verify that an answer genuinely came from the zone owner and was not forged or tampered with in transit. It defends against cache poisoning and DNS spoofing. It authenticates DNS rather than encrypting it — the records are still public, but their integrity and origin are now provable.
How do I turn on DNSSEC for my domain?
Two steps with two parties. Your DNS host signs the zone — usually one switch in the DNS panel at Cloudflare, Route 53, Google Cloud DNS, Azure DNS, or your registrar's nameservers, after which the provider manages the keys. Then your registrar publishes the DS record at the registry, either automatically via CDS/CDNSKEY or by you pasting the key tag, algorithm, digest type, and digest into the domain settings. Signing without the DS record protects nothing. Wait for the parent zone to publish, then re-run this checker and confirm DNSKEY present, DS found, and validation confirmed.
Is DNSSEC enough to secure my domain?
No. DNSSEC authenticates DNS answers, but does not encrypt queries, judge destination safety, or secure email and web applications by itself. SMTP DANE requires DNSSEC to authenticate TLSA records. MTA-STS does not require DNSSEC; it relies on HTTPS policy retrieval and certificate authorities.
How do I know if my domain has DNSSEC enabled?
DNSKEY records show published keys, not successful validation. Check signatures, parent DS records and a trusted validating response. A missing DS normally leaves an insecure delegation; a mismatched supported DS can produce a bogus result.
How do I test DNSSEC for a domain?
Run `dig +dnssec @1.1.1.1 example.com` and look at the flags line in the answer. If `ad` appears there, a validating resolver verified the chain of trust from the root down to that domain — the DNSSEC test passed. Add `dig DNSKEY example.com +short` to test whether the zone is signed at all, and `dig DS example.com +short` to test whether the parent publishes the link to your key. This checker runs the same three questions and reports them together, which is faster when you want the answer rather than the practice.
How do I validate the DNSSEC chain of trust?
The chain validates when every link resolves: the root vouches for the TLD, the TLD publishes a DS record hashing your key-signing key, and your zone signs its records with the matching key. To validate it in one command, use `delv example.com` from BIND's tools — it walks the whole chain and prints "fully validated" or the precise link that failed. Without delv, `dig +dnssec @1.1.1.1 example.com` and the presence of the `ad` flag is the same verdict in shorter form. If validation fails on a zone that is signed, compare `dig DS example.com` against your active DNSKEY: a mismatch there is the most common cause.
What is a DS record and why does it matter?
A DS record in the parent identifies a child signing key. Authenticated absence of a DS record normally makes the delegation insecure; this alone does not require SERVFAIL. A DS pointing to an unusable or incorrect key is a different validation failure.
Why would a signed domain still fail DNSSEC validation?
A mismatched supported DS or invalid signature can produce a bogus response and SERVFAIL at validating resolvers. Authenticated absence of DS instead creates an insecure delegation. Timeouts and unavailable evidence must remain indeterminate rather than being labelled a cryptographic failure.
Can DNSSEC break my website?
Yes: an invalid trust chain or expired signatures can prevent validating resolvers from answering. An authenticated insecure delegation is not the same failure. Coordinate key rollovers and check validation after changes.
Does every TLD support DNSSEC?
No. DNSSEC needs the registry running your TLD to accept a DS record for your domain, and a small number of registries still do not offer that. Most TLDs — including .com, .net, .org and ccTLDs such as .nl, .de, .uk, .dk and .se — support it. Where the registry does not, this checker reports DNSSEC as not applicable rather than as a failure, because there is no configuration change that would fix it.
Does DNSSEC encrypt my DNS queries?
No. DNSSEC authenticates DNS — it proves answers are genuine and unaltered — but it does not hide them; queries and responses remain visible on the wire. Encrypting the transport is a separate concern handled by DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT). The two are complementary: DNSSEC for integrity and origin authenticity, DoH/DoT for privacy of the lookup itself.

Machine-Readable Evidence

AI assistants and automation can cite the stable explanation page, then fetch the live check result for a specific domain.

GET https://intodns.ai/api/dns/dnssec?domain=example.com

Related Tools and Citations

DNSSEC GuideHow to enable DNSSEC at your registrarDANE/TLSA CheckerDNS LookupRun the full domain scan

Guides on this topic

SPF, DKIM, DMARC & DNSSEC in One Scan: The Unified Security CheckWhat 6,302 Domain Scans Reveal: Most Fail DNS & Email SecurityThe Complete DNS and Email Security Audit Toolkit for 2026