DNSSEC
Enter a domain above to run this check.
DNSSEC
CHECK.
Find out whether the zone is signed, whether the DS is published at the registry and whether the DNSSEC chain validates (AD flag on 1.1.1.1).
Runs only this check. For all 33 checks at once, use the full Domain X-Ray. Public lookups only; nothing is stored on the server.
WAITING
What the check verifies
Checks whether the zone is signed (DNSKEY), whether the DS record was published at the domain registry and whether the 1.1.1.1 resolver validated the chain of trust (AD flag).
Why it matters
DNSSEC stops forged DNS answers from diverting visitors or email. Signing the zone without publishing the DS at the registry protects nothing.
What each result means
- OK
- The DS is published at the registry and the 1.1.1.1 resolver validated the answer (AD flag).
- WARNING
- The DS exists but the answer was not validated; or the zone has DNSKEY keys without a DS at the registry, and then DNSSEC is not active. An obsolete algorithm (RSASHA1) is flagged.
- FAIL
- With a DS published, resolvers that validate DNSSEC answer SERVFAIL: for people who use those resolvers, the domain disappears.
- INFO
- DNSSEC not enabled. It is optional, but it protects against forged DNS answers.
ERROR and TIMEOUT mean the query did not finish (the source was down or slow), not a problem with the domain: run the check again.
How to fix
Turn on signing at the DNS provider and publish at the registrar the DS record it gives you, in the DNSSEC settings of the domain. Before changing DNS provider, remove the DS, or the domain stops resolving. To check:
dig DS example.com +short
dig DNSKEY example.com +short
dig A example.com @1.1.1.1 +dnssec | grep flagsWould rather have someone else do it? Bit Happens can fix this →
More checks in DNS and name servers
Guide: How to troubleshoot DNS →
Full Domain X-Ray: all 33 DNS, email, HTTPS, certificate and reputation checks at once →