DNSSEC Checker
Check whether a domain is protected by DNSSEC. The check follows the delegation chain through DS, DNSKEY and RRSIG records and reads the resolver's AD bit.
Check
Result
Enter a domain and click Check DNSSEC
What the states mean
- Secure — a DS record delegates the zone, DNSKEY and RRSIG records are present, and the validating resolver set the AD bit.
- Insecure — no DS record exists at the delegation, so the zone is not signed. This is normal for many domains and is not an error.
- Bogus — DNSSEC is deployed but validation failed: the resolver returned SERVFAIL, or DS exists while DNSKEY/RRSIG data is missing or not trusted.
- Indeterminate — not enough data was available to classify the chain, usually because a DoH query failed.
The check uses public DNS-over-HTTPS resolvers through the OrbitNet Worker. It is an indicative validation result, not a replacement for a full DNSSEC debugger such as DNSViz or Verisign's tool. The local Unbound instance is not used.