What is DNSSEC Verification
DNSSEC Verification checks whether a domain's DNS resolution chain is cryptographically protected and trustworthy. It evaluates DNSKEY, DS, and RRSIG records to produce a validation verdict, which is useful for security audits and DNS incident diagnostics.
Key Features
- Validate DNSSEC status and return a clear verdict.
- Switch DoH resolvers for cross-checking.
- Display key DNSKEY, RRSIG, and DS fields with algorithm details.
- Provide raw JSON output for deeper analysis.
Steps
- Enter the domain to verify.
- Select a DoH resolver.
- Click Verify and complete captcha verification.
- Review verdict, explanation, and record details.
FAQ
Is “signed” the same as “validated”?
Not always. A domain can publish signatures, but validation may still fail if the trust chain is broken, inconsistent, or expired.
Why can different DoH resolvers show different results?
Resolver caches, recursive paths, and synchronization timing can vary, so short-term differences are possible.
When should DNSSEC issues be treated as high priority?
If you observe DNS poisoning, suspicious resolution behavior, or increased hijacking risk, DNSSEC validation should be part of immediate investigation.