DNS & domain lookup

DNSSEC Validator

Validate a domain's DNSSEC: DNSKEY, the DS record at the parent, and the authenticated (AD) flag. Free DNSSEC check over live DNS to confirm the chain of trust.

Validate DNSSEC

Enter a domain to check its DNSSEC chain of trust over live DNS.

What this DNSSEC validator does

Checks for published DNSKEY records
Confirms a DS record at the parent zone
Reads the resolver's authenticated (AD) flag
Detects incomplete or broken chains of trust
Runs live over DNS-over-HTTPS
Explains exactly what to fix

Common use cases

  1. 1Confirming DNSSEC is correctly enabled
  2. 2Diagnosing a broken chain of trust
  3. 3Verifying the DS record after enabling DNSSEC
  4. 4Checking a domain before relying on it
  5. 5Auditing security for a domain you manage
  6. 6Troubleshooting DNSSEC validation failures

Related tools

DNS Health CheckerDNS Record LookupNS Record LookupDNS Propagation CheckerWHOIS LookupSSL Certificate Checker

About DNSSEC

DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS so resolvers can verify that answers are genuine and unmodified, protecting against spoofing and cache poisoning. It relies on a chain of trust: your zone publishes a DNSKEY, and a matching DS record at the parent (your registrar) links it to the root.

This validator checks that both exist and that a validating resolver marks the answer authenticated. If keys are published but the DS record is missing, the chain is incomplete — add the DS record at your registrar to complete it.

More Free Tools Where This Came From

This utility is one of dozens of free, no-login tools for DNS, email, SEO and developers — all instant and private.

See All ToolsTalk to Our Team

HostCloud.in  ·  Pune, India  ·  Serving 34,987+ Websites Since 2020

FREQUENTLY ASKED QUESTIONS

Got Questions? We Have Answers.

What is DNSSEC?

DNSSEC (DNS Security Extensions) cryptographically signs DNS records so resolvers can verify answers are genuine, protecting against spoofing and cache poisoning.

What does the validator check?

It confirms the domain publishes DNSKEY records, has a matching DS record at the parent zone, and that a validating resolver marks the answer authenticated (AD flag).

What is a chain of trust?

DNSSEC links your zone's DNSKEY to the root through a DS record at each parent. If any link is missing, validation fails.

My DNSKEY exists but there is no DS record — why?

You enabled signing but did not publish the DS record at your registrar, so the chain is incomplete. Add the DS record to complete it.

Should I enable DNSSEC?

Yes, where supported. It meaningfully reduces the risk of DNS spoofing, though it requires correct DS records at your registrar to work.

Is the validation live?

Yes. The DNSKEY, DS and authentication checks run in real time over DNS-over-HTTPS with the DNSSEC OK bit set.