DNSSEC validator

What makes this "deeper" than the checker

The DNSSEC checker reports whether DS/DNSKEY/RRSIG records exist and what the resolver claims. This page adds the one piece of independent cryptographic verification this tool performs itself: recomputing the DS record's digest directly from the published DNSKEY's raw bytes (per RFC 4034 5.1.4 - hash the zone's canonical owner name concatenated with the DNSKEY record data) and checking it matches what the parent zone actually published.

The states, and what each one actually means

• Secure - this tool confirmed a DS digest matches a published DNSKEY, and the recursive resolver separately reports it validated the full signature chain.
• Insecure - no DS record exists. A legitimate, unsigned domain - not an error.
• Bogus - either this tool's own digest comparison found no match, or the resolver returned SERVFAIL when asked to validate - both are strong, specific signals something in the chain is broken.
• Unable to validate - used when neither a positive nor negative determination can honestly be made, most often because every published DS record uses a digest algorithm this tool does not implement. Never silently reported as invalid.

What is still not verified

RRSIG signatures themselves - the actual public-key cryptography proving a record set was signed by the corresponding private key - are not verified by this tool. That is the resolver's job, reported via the AD bit and labeled as the resolver's claim throughout.

Related tools

See DNSSEC checker for the quicker presence-only view, and DNS lookup for the domain's ordinary records.