DNSSEC checker
Check whether a domain's DNS is signed with DNSSEC and whether the signature validates. Reads public DNS only.
Related guides
Guide
Domain and DNS security checklist for small businessesTwelve checks that keep a business's domain, website and email in the right hands, in the order an MSP should work through them.
CAA record explained
CAA records explained: limit who can issue your SSL certificatesA small DNS record that tells certificate authorities who is allowed to issue for a domain, with examples and the one mistake to avoid.
domain expiration grace period
What happens when a domain expires (and how to get it back)Day by day, what happens to a lapsed domain, its website and its email, and the steps to recover it at each stage.
How DNSSEC checking works
DNSSEC is a property of the zone, so the checker reads the DS record that the parent zone publishes and whether a validating resolver accepts it. The name servers are listed because they decide which DNS host must enable signing.
Frequently asked questions
What does DNSSEC protect?
DNSSEC signs DNS answers so resolvers can check that they came from the zone owner and were not changed on the way (RFC 4033 to 4035). It protects the lookup, not the website itself.
Why does my domain show as signed but not validated?
The DS record at the parent does not match the signing key in the zone, or the signature has expired. Validating resolvers then refuse the domain. Fix it at the DNS host before you change anything else.
Is DNSSEC required?
No. It is optional and it is worth turning on when your DNS host supports it, especially for a domain that sends email or hosts sign-in pages.