DNSSEC Validator: Free Online DNSSEC Check

A DNSSEC validator checks whether a domain uses DNS Security Extensions and whether its signing records are in place. Enter a domain name and this free tool shows the DNSKEY, DS and RRSIG results plus the Authenticated Data (AD) flag, so site owners and admins can see whether DNS answers for the domain are protected from tampering.

What Is DNSSEC and Why Does It Matter?

DNSSEC (Domain Name System Security Extensions) is a set of standards that adds digital signatures to DNS records, so a resolver can confirm an answer really came from the domain's zone and was not changed on the way. Ordinary DNS has no such check, which is why attackers can try cache poisoning or spoofing to send visitors to a fake server.

DNSSEC does not encrypt anything. It proves authenticity and integrity, not privacy. Visitors still load the same site, but a validating resolver can reject forged answers instead of passing them along.

The four signals this tool reports

• DNSKEY: the public keys published in your domain's zone. Resolvers use them to verify signatures.
• RRSIG: the signature attached to a set of records, such as your A records.
• DS (Delegation Signer): a fingerprint of your key published in the parent zone (for example the .com registry) through your registrar. It links your zone to its parent and forms the chain of trust.
• AD flag: Authenticated Data, a flag a validating resolver sets when it has verified the whole chain for an answer.

All four should line up. Keys with no DS record at the parent, or a DS record with no matching keys, mean the setup is unfinished or broken.

How to Use the DNSSEC Validator

Checking a domain takes one field and one click, and the results appear on the same page.

1. Find the Domain Name field at the top of the tool.
2. Type the domain you want to test, such as cloudflare.com (the example shown in the field). If you paste a full URL, the protocol and any path are ignored and only the domain is checked.
3. Click Validate DNSSEC.
4. Read the status banner, which says either DNSSEC Enabled or DNSSEC Not Detected.
5. Review the four rows beneath it: DNSKEY Records, DS Records (Delegation Signer), RRSIG (Signature Records) and Authenticated Data (AD) Flag.
6. If keys were found, scroll to the DNSKEY Records list to see the published key data.
7. After you change anything at your DNS host or registrar, run the check again to confirm the fix.

Worked Example: Reading a Real Result

Say you manage the domain shop.example and want to confirm DNSSEC after moving to a new DNS host. You type the domain, click Validate DNSSEC and get these rows.

• DNSKEY Records: 2 DNSKEY record(s) found (a common setup with one key-signing key and one zone-signing key).
• DS Records (Delegation Signer): 1 DS record(s) found.
• RRSIG (Signature Records): several RRSIG records returned across the queries.
• Authenticated Data (AD) Flag: AD flag set, meaning the resolver validated the signatures.

That is a healthy result: the zone is signed, the parent points to it and validation succeeded. Now imagine the same domain shows DNSKEY records and signatures but "No DS records (may be at parent zone)" and "AD flag not set by this resolver". The new host signed the zone, but nobody published the DS record at the registrar. The domain still resolves, yet it is not protected, because validating resolvers treat it as unsigned. Add the DS record at the registrar, wait for it to propagate, and run the test again.

How Do You Read and Act on the Results?

The status banner is a quick summary, but the four rows tell you what is actually happening. The banner reads DNSSEC Enabled when the tool finds signs of DNSSEC, such as keys, a DS record or the AD flag, so always check the rows instead of trusting the banner alone.

What each row means

• DNSKEY Records: found means your DNS host publishes signing keys. Not found usually means the zone is unsigned.
• DS Records: found means the parent zone points to your keys. The note "may be at parent zone" reminds you that this record lives with the registry, not your DNS host.
• RRSIG: found means answers carry signatures. Missing signatures on a zone that has keys point to a signing problem at your DNS provider.
• AD Flag: set is the strongest sign of success, since a validating resolver verified the chain. Not set can mean the domain is unsigned, or that the chain is incomplete.

Common result patterns

The last pattern deserves urgency. If the parent publishes a DS record but your zone has no matching keys, validating resolvers may refuse to answer for the domain, and some visitors may not reach your site at all.

Who Should Use a DNSSEC Check?

Anyone responsible for a domain's reliability benefits from a quick DNSSEC test, especially around changes to DNS.

• Site owners confirming that a registrar or host actually turned DNSSEC on after clicking the setting.
• Developers and sysadmins verifying a nameserver migration did not drop signing or leave a stale DS record behind.
• Security reviewers auditing a list of domains for missing DNS protection, one domain at a time.
• SEO and web teams troubleshooting sudden reachability problems that affect only some networks, which a broken DNSSEC chain can cause.

If your problem is not about signatures, other record checks may help more. The DNS lookup shows A, MX, NS, TXT and other records, and the DNS propagation checker compares answers from different resolvers after an update.

Best Practices, Common Mistakes and Troubleshooting

Most DNSSEC problems come from one missing step during a provider or registrar change, so a short checklist prevents nearly all of them.

• Enable signing before adding the DS record. Turn on DNSSEC at your DNS host first, copy the DS details it gives you, then publish them at your registrar. Publishing DS first can break resolution.
• Remove the old DS record before leaving a signing provider. When you move to a host that does not support DNSSEC, a leftover DS record can make the domain fail validation.
• Test the exact domain you care about. DNSKEY and DS records belong to the signed zone, so a subdomain that is not its own zone will often show no keys of its own. Test the main domain.
• Allow time after changes. DS updates at the registry and cached answers can take a while to settle. Rerun the check later instead of changing settings repeatedly.
• If you see "Please enter a domain name." the field was empty. Enter a domain such as example.com without spaces.
• If you see an error message instead of results, check the spelling, try again, or test another domain to rule out a temporary problem.

Cross-checking with dig

If you work from a terminal, you can confirm the same records by running dig example.com DNSKEY +dnssec and dig example.com DS +dnssec. Look for the ad flag in the header of the response. Many registrars and DNS hosts also show a DNSSEC status page, which is worth comparing with this tool's output. DNSSEC answers travel over the normal DNS port 53, so there is no special DNSSEC port to open, although firewalls must allow larger DNS responses.

Once DNSSEC is healthy, you may want to confirm your other records still point where you expect. An A record lookup and a CNAME record lookup are useful follow-ups.

Limitations to Keep in Mind

This tool gives a fast health snapshot, not a full audit of every key and algorithm. It tells you whether keys, a DS record and signatures are present and whether the AD flag was set, but it does not grade key strength, signature expiry dates or whether the DS fingerprint matches a specific key.

The AD flag also depends on the resolver that answers. A not-set flag on a domain with keys and a DS record deserves a retry and a second look with a command-line test. Treat DNSSEC as one layer: it protects DNS answers, not your web server, and it is not a direct Google ranking factor. Its value is trust and reliability, which supports everything else you do for your site.

Ready to see where your domain stands? Enter it above and click Validate DNSSEC, then fix any missing piece and test again. For more checks of this kind, browse the Network and IP tools collection.