Free · live registry data · no login

DNSSEC Validator

Is DNSSEC enabled and is the chain valid?

How it works

Is DNSSEC on for this domain, and does the chain validate?

DNSSEC signs your DNS answers so resolvers can detect forged records. It only works when three things line up: the registry holds a DS record for your domain, your zone publishes the matching DNSKEY, and the signatures validate. We check all three live: DS records from the parent zone, DNSKEY records from your nameservers, the registrar's RDAP 'delegation signed' flag, and finally whether Cloudflare's validating resolver returns the authenticated-data flag or a SERVFAIL, which means the chain is broken and the domain is unreachable for many users.

Results appear here after you click Validate DNSSEC.

How this works

1
DS from the parent
We query the DS records the registry publishes for the domain, which anchor the chain of trust.
2
DNSKEY from the zone
The zone's own key-signing and zone-signing keys are fetched and their algorithms decoded.
3
Ask a validating resolver
Cloudflare is queried with DNSSEC requested; an AD flag means validated, SERVFAIL means the chain is broken.

Frequently asked questions

What is DNSSEC?: DNS Security Extensions add digital signatures to DNS records so a resolver can prove an answer really came from the domain's zone and was not altered. It protects against cache poisoning and some phishing attacks. It does not encrypt DNS traffic or secure your website; that is what HTTPS does.
How do I enable DNSSEC?: Turn on signing at your DNS host, which generates the keys and signs the zone. The host then shows you a DS record; paste it into your registrar's DNSSEC settings. The chain is complete once the registry publishes the DS, usually within an hour.
Why did my domain go offline after changing nameservers?: Almost certainly a stale DS record. The old DNS host signed the zone and the registry still holds its DS, but the new host's zone is unsigned or uses different keys. Validating resolvers return SERVFAIL. Delete the DS at the registrar and the domain recovers within the parent TTL.
Should I turn DNSSEC on?: Yes if your DNS host and registrar both support it with one-click setup, because it prevents a whole class of attacks for free. Be aware of the one operational rule: always remove the DS record before changing DNS providers or nameservers, then re-enable afterwards.
What do the key tag and algorithm numbers mean?: The key tag is a short checksum identifying which DNSKEY a DS refers to. The algorithm number names the signing scheme: 13 is ECDSA P-256, the modern default; 8 is RSA/SHA-256, also fine; 5 and 7 are SHA-1 variants being retired. The digest type should be 2 (SHA-256).

Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.