What is DNSSEC and why does it matter?

DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records. Without it, attackers can intercept DNS queries and redirect users to malicious servers (DNS spoofing/cache poisoning). DNSSEC ensures the DNS response you receive is authentic.

How does the DNSSEC chain of trust work?

The chain starts at the DNS root servers (trust anchors), passes through the TLD registry (e.g., .com), and ends at your domain. Each level signs the keys of the level below it using DS records. If any link breaks, the entire chain fails.

What is the difference between DNSKEY and DS records?

DNSKEY records contain the actual public keys used to sign DNS records at your domain. DS (Delegation Signer) records are placed at the parent zone (registrar) and contain a hash of your DNSKEY, linking the parent trust chain to your zone.

Should I enable DNSSEC for my domain?

Yes. DNSSEC prevents DNS spoofing and cache poisoning attacks. Most modern registrars support one-click DNSSEC activation. The risk of misconfiguration is low with managed DNS providers like Cloudflare, Route 53, or Google Cloud DNS.

What happens if DNSSEC is misconfigured?

A broken DNSSEC chain (Bogus status) can cause your domain to become completely unreachable for validating resolvers. This is worse than not having DNSSEC at all. Always verify configuration after enabling or during key rollovers.

How do I enable DNSSEC?

For Cloudflare: one-click in DNS settings. For cPanel/BIND: generate keys with dnssec-keygen, sign the zone, then add the DS record at your registrar. For AWS Route 53: enable signing in the hosted zone and add DS at the registrar.

DNSSEC Check

Verify DNSSEC configuration and chain of trust for any domain.

What is DNSSEC?

DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, enabling resolvers to verify the authenticity of DNS responses. It creates a chain of trust from the root zone down to individual domains.

How does it work?

The domain owner signs DNS records with private keys (KSK and ZSK). The corresponding DNSKEY records and DS records create a chain of trust. Resolvers verify RRSIG signatures against published DNSKEY records to ensure data integrity.

Attacks mitigated

DNSSEC protects against DNS cache poisoning, DNS spoofing, and man-in-the-middle attacks. It ensures that the DNS responses you receive are authentic and haven't been tampered with in transit.

Key record types

DNSKEY: Public keys used to sign DNS records (KSK for keys, ZSK for zone data)
DS: Hash of the DNSKEY, published at the parent zone to create chain of trust
RRSIG: Cryptographic signatures over DNS record sets, with inception and expiration dates
NSEC/NSEC3: Proves non-existence of records (NSEC3 adds hashing to prevent zone enumeration)

How to Use This Tool

What to Enter: Enter a domain to verify its DNSSEC configuration and chain of trust.
What You Get: Shows DNSSEC status with security score (0-100), DNSKEY records, DS records, RRSIG validation, chain of trust analysis (Root → TLD → Domain), and algorithm compliance.

How to Interpret Results

A Secure status means DNS responses are cryptographically authenticated end-to-end. Insecure means DNSSEC is not configured. Bogus indicates broken configuration that may cause resolution failures. Check that DS records at the registrar match the DNSKEY at the authoritative server.

Common Issues & Troubleshooting

Missing DS records at the registrar is the most common issue — DNSSEC is signed but the trust chain is broken. Expired RRSIG signatures cause intermittent failures. Algorithm mismatches between DS and DNSKEY prevent validation. Key rollover failures during migration can break resolution for cached resolvers.

Frequently Asked Questions

DNSSEC Validation Failure DNS Cache Poisoning