DNS Tools

DNSSEC Checker

Check whether a domain's DNS is protected with DNSSEC signatures.

Not sure what to enter? Try an example: cloudflare.com

Free & instant No signup How to use FAQ

Enter a domain to see whether it publishes DNSKEY records and has a DS record at its registry - the two halves of a working DNSSEC setup.

What is DNSSEC?

DNSSEC adds cryptographic signatures to DNS records so resolvers can verify that answers really come from the domain's owner and were not forged on the way. This checker looks for the DNSKEY records in the zone and the DS record at the parent that together turn DNSSEC on.

How to check whether DNSSEC is enabled

Enter the domain in the box above.
Click Check DNSSEC.
If both DNSKEY and DS records are found, DNSSEC is enabled.
If only DNSKEY is present, add the DS record at your registrar; if neither is present, enable DNSSEC at your DNS provider first.

Related checks

To see which nameservers serve the zone, use the NS Record Lookup.
To find where the DS record must be added, use the Registrar Lookup.

JustChecker tracks your DNS and security posture continuously.

Frequently Asked Questions

Forged DNS answers. With DNSSEC, validating resolvers can tell whether a reply really came from your DNS provider, which blocks attacks that redirect visitors to a fake copy of your site.

The DS record also has to be added at your domain registrar. Until the registry publishes it, the chain of trust is incomplete and DNSSEC isn't active.

Only if it is set up wrongly - for example an old DS record left at the registrar after moving DNS hosts. Validating resolvers then refuse to answer, so remove or update DS records before changing DNS providers.

Share this tool:

Need a website for your business? Only $599