Check a domain’s DNSSEC configuration

Features

• Compares the parent’s DS records with the zone’s DNSKEY records and gives five distinct verdicts
• Computes each DNSKEY’s key tag (RFC 4034) and matches it against the DS records one by one
• Tells five states apart: enabled, not enabled, zone missing DNSKEY, parent missing DS, key tags do not match
• Separates "not in effect" (wasted signing) from "incomplete" (the domain is currently failing to resolve)
• Splits every DS / DNSKEY field: algorithm numbers resolved to names, KSK and ZSK labelled, public key shown as-is
• Resolves to the zone apex automatically and says when it did
• Shows the resolver’s AD bit as evidence the chain was validated
• Switch between DNS services; falls back automatically when the primary one does not respond

How to use

1. Enter a domain — a subdomain works too, it is resolved to the apex for you
2. Press Check
3. Read the verdict, then the DS and DNSKEY detail below it
4. If the verdict is a problem, use the explanation to fill in the missing half at your registrar or DNS provider

FAQ

Why does it look up example.com when I typed www.example.com?

DNSSEC keys and signatures exist only at the zone apex — the name `example.com` itself. There is no DS and no DNSKEY at `www`. Querying the name as typed would produce a "not enabled" verdict, and that verdict would be wrong — so the tool resolves to the apex and tells you it did so.

What does "Not in effect: the parent has no DS" mean?

It means DNSSEC is switched on at your DNS provider and the zone publishes a DNSKEY, but no DS record was ever added at the registrar. A resolver only learns that it should validate by reading the DS from the parent zone (`.com`, for `example.com`) — with no DS, nothing tells it to, so the signing is wasted. Add the DS record at your registrar; your DNS provider’s console will show the value to paste.

Can "Incomplete: the zone has no DNSKEY" take my site down?

Yes. In that state a resolver believes the domain should be signed but cannot obtain the public key, so it returns SERVFAIL — the domain behaves as if it were offline. It is a completely different situation from "not enabled": this one needs fixing quickly, the other needs nothing at all.

What is a key tag, and why compute it?

A key tag is a 16-bit checksum over a DNSKEY (RFC 4034, Appendix B). It works like a short serial number for the key, letting a DS record say which DNSKEY it refers to. The tool computes it from the public key and compares it with the DS so that "the keys were rotated but the DS was not updated" — a problem invisible in the records themselves — gets caught.

Does this replace a DNSSEC validator?

No, and that is not what it is for. It checks whether the configuration is coherent (do the DS and DNSKEY line up, are both halves present); it does not verify signatures. Verifying a signature means checking RRSIG records against the public key, which is the resolver’s job. So a verdict of "enabled" does not rule out other problems on the chain, such as an expired signature.