Skip to content

DNSSEC Validator Online Free

Browser-side · queries to public APIs
Last verified June 2026 — runs in your browser

About this tool

Enter a domain to check DNSSEC. The tool fetches DNSKEY records at the zone, DS records at the parent, and asks Cloudflare 1.1.1.1 whether the chain validates (AD flag). Detects the three states that actually matter in production: Secure, Bogus (broken signing), and Insecure.

Related:

DNS Lookup Query DNS records for any domain — A, AAAA, MX, CNAME, TXT, NS, SOA CAA Checker Check which Certificate Authorities can issue SSL certificates for a domain SSL Checker Check SSL/TLS certificate status, HSTS, and certificate transparency logs HTTP Headers Inspect HTTP response headers and security header analysis WHOIS Lookup Look up domain registration details, registrar, and nameservers via RDAP Redirect Checker Trace the full redirect chain of any URL with status codes

How to check DNSSEC validation

  1. Enter a domain name.
  2. The tool queries the domain with DNSSEC validation enabled and reports the chain of trust.
  3. Review each step — DS record at the parent, DNSKEY at the zone, and RRSIG signatures on individual records.
  4. A broken chain means clients that validate DNSSEC (some resolvers, Tor) cannot verify the domain's records.

Common use cases

  • Confirming DNSSEC is correctly deployed on a domain after enabling it at the registrar.
  • Troubleshooting resolver errors where some users cannot reach a domain because their resolver validates DNSSEC and the chain is broken.
  • Auditing the DNSSEC posture of dependencies (login providers, APIs) before relying on them for security.
  • Checking that a key rollover did not break the validation chain during the overlap period.

Frequently asked questions

Is DNSSEC worth the complexity?

For high-trust domains (banks, government) DNSSEC is standard. For general sites it is optional but guards against DNS poisoning when paired with validating resolvers. The tradeoff is a small performance cost and operational complexity.

What happens if DNSSEC is broken?

Validating resolvers (Cloudflare's 1.1.1.1, some ISPs, Tor) return SERVFAIL. Non-validating resolvers still resolve normally, masking the issue from most users — until you hit a validating one.

Do I need DNSSEC for a CDN?

CDNs handle DNSSEC differently. Cloudflare provides a simple toggle; others require coordination between registrar and CDN. Check with your provider's docs.

Is my query logged?

No. Validation runs through the browser and results are not stored.

Why DNSSEC matters

DNSSEC cryptographically signs DNS records so resolvers can detect tampering and cache poisoning. The critical failure mode is not missing DNSSEC — it is broken DNSSEC (Bogus), which takes your domain offline for every user whose resolver validates. This tool surfaces that state explicitly instead of just showing DNSKEY presence.

  • DNSKEY records at the apex
  • DS records at the parent zone
  • Resolver validation (AD flag)
  • Bogus (broken signing) detection
  • Algorithm names for DS/DNSKEY entries

Free. No signup. Browser tools (subnet, JWT, password strength) run locally; lookup tools query public APIs (Cloudflare DoH, RDAP, certificate logs). Full per-tool breakdown at /methodology/.

Sources (2)
  • Arends, R., Austein, R., Larson, M., Massey, D., & Rose, S. (2005). Resource Records for the DNS Security Extensions. RFC 4034, IETF.
  • Arends, R., Austein, R., Larson, M., Massey, D., & Rose, S. (2005). Protocol Modifications for the DNS Security Extensions. RFC 4035, IETF.

These are the IETF RFCs, NIST publications, and W3C standards the tool implements or queries. Locate them on the IETF Datatracker (datatracker.ietf.org) or the official standards body.

Related guides

By ·