DNSSEC check: test signatures and chain of trust
Check whether your domain is signed with DNSSEC, whether the chain from the registrar to your nameservers holds and when the signatures expire.
Check DNSSEC
Enter the domain, for example your-domain.co.uk.
Lookups run through the Quad9 DNS resolver (Switzerland). We keep the checked domain and an anonymised IP address for no longer than 30 days.
How DNSSEC works
What is DNSSEC?
Without DNSSEC, an attacker can forge DNS answers and quietly redirect visitors to a different server. With DNSSEC, your nameserver signs every answer. A validating resolver – such as your internet provider's or Quad9 – checks the signature and discards forged answers.
The chain of trust
For the signature to mean anything, the resolver has to trust the key. A chain takes care of that: the root zone vouches for the key of the top-level domain, such as .uk, and that in turn vouches for your domain's key with a DS record. You publish the DS with your registrar; your nameserver serves the key itself (DNSKEY) and the signatures (RRSIG).
What the DNSSEC check tests
We ask a validating resolver and read DS, DNSKEY and signatures. If the DS matches no key, signatures have expired or the zone uses outdated algorithms, we tell you what is wrong. When DNSSEC is broken, validating resolvers return no answer at all – the domain is then unreachable for many users even though the nameservers are running.
Common DNSSEC mistakes
Old DS after switching provider
When you move your domain to a new DNS provider, the keys change. If the old DS stays at the registrar, DNSSEC breaks and the domain goes down for many users. Delete the DS before the move or replace it right after.
DS missing at the registrar
Many nameservers sign the zone automatically, but without a DS at the registrar the last link of the chain is missing. The zone then counts as unsigned. Add the DS your DNS provider shows you.
Expired signatures
Signatures are only valid for a few days or weeks and must be renewed regularly. If automatic signing stops, the domain goes down as soon as the last signature expires.
Outdated algorithms
Zones using RSA/SHA-1 (algorithm 5 or 7) should be switched. ECDSA P-256 (13) or RSA/SHA-256 (8) are recommended. For the DS at the registrar: SHA-256 instead of SHA-1.
Frequently asked questions
Enter your domain above. The DNSSEC check shows whether a DS is published at the registrar, which keys the zone has and whether a validating resolver accepts the signatures.
It is not mandatory, and most domains are not signed. But DNSSEC protects against forged DNS answers and is required for techniques such as DANE. If your host offers DNSSEC at the click of a button, it is worth it.
A common cause is broken DNSSEC, for example an old DS after switching provider. Validating resolvers then return no answer, others still do – which is why the domain works for some users and not for others. The DNSSEC check shows the cause.
The key signing key (KSK) only signs the zone's keys; the DS at the registrar points to it. The zone signing key (ZSK) signs all other records. That way the ZSK can be changed without touching the DS at the registrar.
First delete the DS at the registrar and wait until its TTL has expired – usually one to two days. Only then switch off signing with your DNS provider. In the reverse order, the domain is unreachable in the meantime.
ECDSA P-256 with SHA-256 (algorithm 13) is the usual choice today: short keys, small answers. RSA/SHA-256 (8) is secure as well. Algorithms using SHA-1 (5 and 7) should be replaced.
