DNSSEC Checker

How do I check if DNSSEC is working?

Reviewed by Prabath Thalangama · Last updated October 23, 2026

Ask a validating resolver for the domain and see whether it marks the answer as authenticated. This checker queries Cloudflare (1.1.1.1) and Google (8.8.8.8) directly, reads the AD flag on each response, checks for a DS record at the parent, and reports signed, unsigned or failing validation.

DNSSEC signs DNS answers so resolvers can detect forged or tampered responses. It only works when the whole chain of trust is intact: the zone must be signed, and the parent zone must publish a matching DS record.

A bogus result means validating resolvers return SERVFAIL, which makes the domain unreachable for the large share of users behind validating resolvers. That is why a broken DNSSEC setup is worse than none.

How do I test DNSSEC for my domain?

Enter the domain, for example example.com.
Check the overall status, then each resolver's result.
If validation fails, compare the DS record at the registrar with the DNSKEY your DNS provider publishes.

How to read the results

Validated: Each resolver set the AD (Authenticated Data) flag: the chain of trust from the root down to your zone checks out.
Not signed: No DNSSEC on the domain. Reported as information, since DNSSEC is optional.
Validation failed: The zone is signed but resolvers return SERVFAIL. Critical: the domain is unreachable for users of validating resolvers.
DS missing: The zone is signed but the parent has no DS record, so DNSSEC isn't actually in effect.
Resolvers disagree: One resolver validates and the other doesn't, often during a key rollover or a DS change that hasn't reached every cache.

Common DNSSEC failures

SERVFAIL after moving DNS providers

The DS record at the registrar still matches the old provider's key. Replace it with the new provider's DS, or remove it before the move.

Expired signatures

RRSIG records have an expiry date. A self-managed signer that stopped running lets them lapse. Restart re-signing and check its schedule.

dig +dnssec example.com SOA | grep RRSIG

Examples and command-line equivalents

Check validation from the command line

dig @1.1.1.1 example.com A +dnssec   # look for 'ad' in flags
dig @8.8.8.8 example.com A +cd       # +cd skips validation: compare results
delv example.com

Frequently asked questions

Why did my domain break after changing DNS providers?

If DNSSEC was enabled, the old DS record at the registrar no longer matches the new provider's keys. Remove the DS record (or replace it with the new one) at your registrar.

Should I enable DNSSEC?

It protects against forged DNS answers and is required for DANE. Enable it when your DNS provider manages signing for you and your registrar supports DS records; most do.