DNSSEC Checker

Check whether a domain is protected by DNSSEC: DS records, DNSKEYs, algorithms and validation status.

How do I check if DNSSEC is enabled?

Enter the domain; the checker queries Google Public DNS, a validating resolver, for the SOA with the DNSSEC-OK flag, and reads the DS records at the parent zone and the DNSKEYs. Validated answers carry the AD flag; a signed zone without DS, or a mismatch (bogus), is reported.

Statuses

Signed and validated — the chain of trust from the root to your zone works.
Signed, no DS — add the DS record at your registrar.
Bogus — validation fails and many users cannot reach the domain; usually an old DS after changing DNS provider.

Frequently asked questions

Does DNSSEC encrypt DNS?

No, it signs answers so they cannot be forged; DNS over HTTPS/TLS handles encryption.

Which algorithm is best?

ECDSA P-256 (13) or Ed25519 (15) — small and fast.

Is it free?

Yes.