DNSSEC checker

What DNSSEC protects against

Plain DNS has no way to prove an answer has not been tampered with in transit or forged by a malicious resolver along the way. DNSSEC adds digital signatures to DNS records, so a validating resolver can cryptographically confirm an answer genuinely came from the domain's own zone rather than being spoofed - the same trust problem TLS solves for the connection itself, applied one layer earlier, to the lookup that finds the server in the first place.

What this checks

• DS record - published in the PARENT zone, this is what tells the world "this domain is signed, and here is the fingerprint to trust." No DS record means DNSSEC is not deployed.
• DNSKEY - the domain's own public keys, published in its own zone.
• RRSIG - signatures attached to signed record sets. Shown here for presence and validity dates only - see the honesty note below.
• Resolver-validated - whether Cloudflare's public resolver reports (via the DNS response's AD bit) that it cryptographically validated the chain itself.

Being honest about what is and is not verified here

This tool does not itself verify RRSIG signatures - doing that correctly requires implementing RFC 4034's canonical record encoding and RSA/ECDSA/EdDSA signature verification for every algorithm in current use. "Resolver-validated" is Cloudflare's own claim, reported as exactly that. For an independent cryptographic check this tool performs itself - matching the DS digest against the published DNSKEY - see the DNSSEC validator.

Related tools

See DNS lookup for the domain's ordinary records, and DNS propagation checker for comparing several resolvers.