Your files stay on your device

DNSSEC validator

Recompute the DS digest from a domain's published DNSKEY and return a secure, insecure, bogus or unverifiable verdict.

Type a domain and press Validate
The tool recomputes the DS digest from the domain's own DNSKEY records and compares it with what the parent zone publishes.

This tool does not verify RRSIG signatures, so it never proves every record is signed correctly. The AD flag is the resolver's claim, not a proof, and the DS records come from a recursive resolver rather than the parent zone's nameservers directly. An insecure verdict means the domain publishes no DS record, which is legitimate for domains that have not adopted DNSSEC.
Options

More network tools

- Live DNS lookup (/network/dns)
- DNS explainer (/network/dns-explain)
All network tools (/network)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/network/dnssec-validator
Markdown version: https://nutter.tools/network/dnssec-validator.md
Plain-text version: https://nutter.tools/network/dnssec-validator.txt
Agent index: https://nutter.tools/llms.txt