Free DNSSEC Checker
Validate DNSSEC from the root trust anchor to a domain, distinguish secure, unsigned, and broken configurations, and inspect the DS, DNSKEY, algorithm, and signature details behind the result.
Common use cases
- Confirm DNSSEC still validates after changing DNS providers or nameservers.
- Find stale or mismatched DS records that cause validating resolvers to return failures.
- Review DNSKEY algorithms, key tags, and signature validity during a DNSSEC rollover.
Frequently asked questions
Is finding a DS record enough to prove DNSSEC works?
No. A DS record can be stale or point to the wrong key. NerdTools validates the complete chain of trust and reports broken configurations separately.
What does an unsigned result mean?
The domain still has valid DNS, but its responses are not authenticated by a DNSSEC chain of trust.