Your files stay on your device

DNSSEC validator

Recompute the DS digest from a domain's published DNSKEY and return a secure, insecure, bogus or unverifiable verdict.

Type a domain and press Validate

The tool recomputes the DS digest from the domain's own DNSKEY records and compares it with what the parent zone publishes.

This tool does not verify RRSIG signatures, so it never proves every record is signed correctly. The AD flag is the resolver's claim, not a proof, and the DS records come from a recursive resolver rather than the parent zone's nameservers directly. An insecure verdict means the domain publishes no DS record, which is legitimate for domains that have not adopted DNSSEC.

Live DNS lookup
DNS explainer

All network tools

Was this tool useful?

DNSSEC validator

More network tools