DNSSEC validator
DS, DNSKEY and authentication status — secure posture of your zone.
How this tool works
DNSSEC (DNS Security Extensions) cryptographically signs DNS answers, making cache poisoning and on-path manipulation impossible. For DNSSEC to actually take effect three things must align: the domain must publish DNSKEY records (at least KSK + ZSK), the parent zone (e.g. .de at DENIC) must have a DS record as trust anchor, and the querying resolver must validate. This validator checks all three: it queries Cloudflare DoH with the DO bit set, reads the AD bit (authenticated data) of the answer, and lists DNSKEY + DS records including algorithm and key role (KSK/ZSK).
Typical use cases
- Verify trust-chain status before and after enabling DNSSEC
- Narrow down "SERVFAIL" errors in some networks (often a DNSSEC failure)
- Check algorithm migration — RSASHA1 (old) → ECDSAP256 (modern)
- Validate KSK rollover (key change) without service disruption
Frequently asked questions
Why is DNSSEC "unverified" even though present?
If DNSKEY exists but no DS record is set in the parent zone, the trust anchor is missing — resolvers cannot verify the signature. The DS must be configured at your registrar, not in your zone.
Which DNSSEC algorithm is currently recommended?
ECDSAP256SHA256 (algorithm 13) — compact, fast, widely supported. RSASHA256 (8) is still fine but RSA keys are longer. RSASHA1 (5/7) is deprecated and should be migrated.
What is the difference between KSK and ZSK?
KSK (Key-Signing Key, flags=257) only signs DNSKEY records. ZSK (Zone-Signing Key, flags=256) signs all other records. KSK is rolled rarely (12-24 months), ZSK more often (3-6 months).
We enabled DNSSEC — why is the AD bit "false"?
The AD bit is set by the resolver when it could successfully validate. With wrong KSK/ZSK configuration, mismatched DS, or expired signatures the bit stays off. Check DS at the parent zone and whether your signatures are current.
Do I need DNSSEC for mail server authentication?
Highly recommended for DANE (DNS-based authentication of named entities) and MTA-STS lookups. Without DNSSEC, TLSA records (DANE) are ineffective. Plain SPF/DKIM/DMARC work without DNSSEC.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.