Part of MikeNetworks®

Free tool

Is this domain signed, and does the chain hold?

A broken DNSSEC chain makes a domain disappear for everyone behind a validating resolver, which today is most of the internet. This check reads the DS record at the parent, the DNSKEY records in the zone, verifies that they match and asks a validating resolver for its verdict.

What this checks

DS, DNSKEY and the AD flag

DNSSEC signs a zone with keys published as DNSKEY records. The parent zone (the registry) publishes a DS record, a hash of the key-signing key, which links the zone into the chain of trust that starts at the root. A validating resolver follows that chain; when any link is missing or wrong it refuses the whole domain. The DS is published through your registrar, the DNSKEY by your DNS host, which is why moves between DNS providers break DNSSEC so often.

Related tools

More in this set

  • DNS lookup Any record type of any name, with TTLs.
  • DNS propagation Has your change reached the public resolvers yet?
  • Nameserver check Do all nameservers answer, authoritatively, with the same serial?
  • Reverse DNS check PTR record of an address and whether it confirms forward.
  • Domain info Registrar, expiry date, status and nameservers from the registry.

All tools Glossary

Domains and DNS

Domains with DNS hosting included

Register or transfer .lu, .eu, .be, .com and more; the DNS editor, DNSSEC and the records these tools check are in the client area.

See domains