DNS

DNSSEC Validator

DNSSEC Chain

Validate DNSSEC

Enter your domain name to validate DNSSEC configuration and check DNSKEY, DS, and RRSIG records.

Tool features

Comprehensive DNSSEC validation and analysis
4 checks

DNSSEC Validation

Complete DNSSEC chain of trust validation

Record Analysis

Check DNSKEY, DS, and RRSIG records

Security Assessment

Detailed DNSSEC configuration analysis

Chain Verification

Verify complete DNSSEC chain of trust

What is DNSSEC & how it works

How DNS records are cryptographically signed

DNSSEC (DNS Security Extensions) adds a cryptographic layer to DNS. It signs each record so resolvers can verify the answer really came from the authoritative zone and wasn't forged or tampered with in transit — closing the door on cache-poisoning and spoofing attacks that plain DNS is vulnerable to.

Trust flows down a chain: your zone signs its records with a key published in a DNSKEY record, and the parent zone vouches for that key with a DS record. This validator checks the DNSKEY, DS and RRSIG records and confirms the chain of trust links all the way to the root.

DNSKEY
The public key a zone uses to sign its records.
DS record
Published at the parent zone to vouch for your DNSKEY, linking the chain.
RRSIG
The cryptographic signature attached to each signed record set.

How to use this tool

Validate a domain's DNSSEC in four steps
1
Enter a domain
Type a domain, e.g. example.com — validation runs against the live zone.
2
Run the validation
Click Validate DNSSEC to fetch the DNSKEY, DS and RRSIG records and verify the chain of trust.
3
Read the status
See whether DNSSEC is Valid, Partial, Incomplete or Disabled, with the record counts.
4
Inspect the records
Expand the DNSKEY and DS tables to review key tags, algorithms and digests, and any warnings.

Related tools

Keep debugging with tools from the same suite
4 tools
DNS Lookup
Perform DNS queries for A, AAAA, MX, TXT, CNAME, and other DNS record types
All DNS Records
Check all DNS records for a domain in one comprehensive scan including all record types
SOA Lookup
Check Start of Authority (SOA) records for domain authority and DNS zone information
Nameserver Health Check
Check your domain's own nameservers for responsiveness, DNSSEC status, and latency

Frequently asked questions

Common questions about DNSSEC
5 Q&A

DNSSEC (DNS Security Extensions) is a set of protocols that cryptographically sign DNS records, letting resolvers verify that answers are authentic and unmodified. It protects against DNS spoofing and cache poisoning.

Each zone signs its records with a key in a DNSKEY record, and its parent publishes a matching DS record that vouches for that key. This links every zone up to the signed root, forming an unbroken chain of trust.

Partial means the zone is signed (it has DNSKEY and RRSIG records) but the parent is missing the corresponding DS record, so the chain of trust is broken. Add the DS record at your registrar to complete it.

DNSKEY holds a zone’s public signing key, RRSIG is the signature over a record set, and DS is the digest of a DNSKEY published in the parent zone to link the chain. All three are needed for validation.

Turn on DNSSEC signing at your DNS host, which generates the keys and RRSIG signatures, then copy the resulting DS record into your domain registrar. Once the parent publishes the DS record, validation should show Valid.