Your files stay on your device

DNSSEC checker

Check whether a domain has DNSSEC deployed by looking for DS, DNSKEY and RRSIG records and the resolver's validation claim.

Type a domain and press Check DNSSEC
The tool looks for DS, DNSKEY, and RRSIG records and reads the resolver's validation claim, with the limits of each finding stated beside it.

This is a presence check. It never verifies RRSIG signatures, so nothing here proves the cryptography holds; the DS digest recomputation lives in the sibling DNSSEC validator. The AD flag is the resolver's claim, not a proof, and an empty RRSIG answer is weak evidence because resolvers only hand out signatures when the query asks for DNSSEC data. An unsigned domain is a normal state, not a fault.
Options

More network tools

- Live DNS lookup (/network/dns)
- DNS explainer (/network/dns-explain)
All network tools (/network)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/network/dnssec-checker
Markdown version: https://nutter.tools/network/dnssec-checker.md
Plain-text version: https://nutter.tools/network/dnssec-checker.txt
Agent index: https://nutter.tools/llms.txt