DNSSEC Validation
Enter a domain to check its DNSSEC: whether the zone is signed, whether the chain of trust validates end-to-end, which algorithms it uses, and whether the parent publishes a DS record. We query a validating resolver and read the authenticated-data result — so you see what real resolvers see, including the dangerous 'signed but broken' (bogus) state that makes a domain unresolvable.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Whether the domain publishes DNSKEY records (is signed)
- Whether the chain of trust validates (the AD / authenticated-data result)
- Whether the parent zone publishes a DS record (anchors the chain)
- The signing algorithms in use (ECDSAP256SHA256, RSASHA256, Ed25519, ...)
- Broken/bogus DNSSEC — signed zones whose validation fails (SERVFAIL)
How to read the result
- OK means signed AND validates AND a DS exists at the parent — DNSSEC fully works.
- Fail (BOGUS) means the zone is signed but validation fails (SERVFAIL) — validating resolvers REFUSE to resolve the domain. Usually a stale DS after a key rollover or expired signatures. Fix urgently.
- Warn 'island of security' means DNSKEYs exist but there's no DS at the parent, so trust isn't anchored — publish the DS at your registrar.
- Warn 'not signed' means DNSSEC isn't enabled — optional but recommended against spoofing and cache poisoning.
Frequently asked questions
What is DNSSEC?
DNSSEC adds cryptographic signatures to DNS so resolvers can verify answers weren't forged or tampered with, protecting against cache poisoning and spoofing, via a chain of trust from the root down to your zone.
What's the difference between signed, validates, and DS present?
'Signed' = your zone publishes DNSKEYs. 'Validates' = a validating resolver verified the signatures (AD flag). 'DS present' = the parent publishes a Delegation Signer record anchoring your zone into the global chain. You need all three.
It says BOGUS — what happened?
Your zone is signed but validation fails, so DNSSEC-validating resolvers return SERVFAIL and the domain is unresolvable for many users. Usually a stale DS at the registrar after a key rollover, or expired RRSIGs. Re-publish the correct DS and re-sign.
Do I need DNSSEC?
Not mandatory, but recommended where DNS integrity matters (mail, banking, security-sensitive sites). It also unlocks DANE/TLSA. The main risk is misconfiguration, which this tool helps you catch.
How do you validate DNSSEC without a local resolver?
We query a public validating resolver with DNSSEC enabled and read the Authenticated Data (AD) flag plus the DNSKEY and DS records, reporting what real validating resolvers conclude.