DNSSEC checker
DNSSEC adds cryptographic signatures to DNS. A secure delegation normally connects a DS record in the parent zone to DNSKEY material in the child zone.
Enter a root domain or subdomain—no protocol or path needed.
What a healthy DNSSEC chain requires
The domain’s authoritative servers sign relevant record sets, the zone publishes DNSKEY records, and the parent publishes a matching DS record. Validating resolvers can then reject altered or incorrectly signed answers.
A DNSKEY without a DS record does not create a chain of trust from the parent. A stale DS record is more serious: it can make the entire domain fail validation.
Safe migration checklist
- Confirm the new DNS provider is serving the intended DNSKEY.
- Update or remove the DS record through the registrar at the correct stage.
- Allow old signatures and cached data to expire.
- Test with more than one validating resolver.
- Treat SERVFAIL after a DNS change as a possible DNSSEC problem.
Quick answers
Frequently asked questions
Does DNSSEC encrypt DNS queries?
No. DNSSEC authenticates DNS data. DNS over HTTPS and DNS over TLS encrypt transport between a client and resolver.
Is DNSSEC required for HTTPS?
No. HTTPS and DNSSEC solve different problems, though they can complement each other.