DNSSEC Checker — Free & Instant

About this tool. DNSSEC signs your DNS answers so a resolver can prove nobody tampered with them on the way. This checks the two records that make it work, the DS record at your parent and the DNSKEY in your zone, and then asks a validating resolver whether the chain actually holds, which is the part records alone cannot tell you.

Ten signals decide whether your mail arrives. You just checked one.

DNSSEC proves your DNS answers were not tampered with. It says nothing about whether the mail leaving your domain is authenticated, and that is the check receiving servers actually run.

SPF, DKIM, DMARC, MX and blocklist status, graded A to F in one pass
Every problem written out in plain English, with the record to publish
Saved under Reports, so you can re-run it and see what changed
One domain watched against the blocklists daily

Run the full checkup free

No card, and nothing to cancel.

How to read your DNSSEC results

DNSSEC signs your DNS answers so a resolver can prove nobody altered them in transit. It protects the integrity of the lookup, not the privacy of it.
Two records make it work and both are needed. The DNSKEY lives in your zone and does the signing; the DS lives at your parent, usually your registrar, and vouches for that key.
Either one alone is worse than neither. A DNSKEY with no DS means you are signing answers nobody validates. A DS with no DNSKEY tells resolvers to expect signatures that are not there, and strict resolvers will refuse to answer for your domain at all.
The last line is the one records cannot tell you. We ask a validating resolver whether it accepted the chain, because a DS and DNSKEY that do not match look perfectly healthy in a record listing and fail every validation.

Common problems and how to fix them

Signed, but a resolver did not validate it

The DS at your registrar no longer matches the DNSKEY in your zone. This normally follows a key rollover or a DNS host migration. Regenerate the DS from the current key and update it at the registrar.

The zone is signed but there is no DS record

Half the job is done. Your DNS host has the DS value ready to copy; it goes to the registrar, not into the zone.

A DS exists but the zone has no DNSKEY

This is the dangerous one. Resolvers are being told your zone is signed while it is not, and strict resolvers will fail your domain entirely. Remove the DS at the registrar, or re-enable signing at the DNS host, quickly.

You want to turn DNSSEC on

It is a switch at your DNS host, followed by pasting the DS value it gives you into your registrar. Do them in that order, and never move DNS hosts with DNSSEC still enabled without turning it off first.

CAA Lookup MX Lookup A Record AAAA Record Full email checkup

Common questions.

What is DNSSEC?

A set of DNS records that cryptographically sign your zone, so a resolver can prove the answer it received is the answer you published and not something injected along the way.

Do I need DNSSEC?

It is optional and most domains do not use it. It does not affect email deliverability and its absence is not a security failure. It matters most where a forged DNS answer would be valuable to somebody.

What is the difference between DS and DNSKEY?

The DNSKEY is in your zone and signs your records. The DS is at your parent, usually held by your registrar, and vouches for that key. The chain only holds when both exist and match.

Why does my domain say signed but not validated?

Almost always a mismatch between the DS at the registrar and the current DNSKEY, left behind by a key rollover or a change of DNS provider. The records look fine individually and the chain is broken.

Does DNSSEC encrypt my DNS queries?

No. It proves answers are authentic; it does not hide them. Encrypting the query itself is what DNS over HTTPS and DNS over TLS do, and they are unrelated.