SecDNS
Dashboard/Tools

Security

DNSSEC Validator

Verify a zone is properly signed and validates end-to-end. The check runs through a validating DoH resolver and reports the AD flag, DS presence, and chain status.

DNSSEC verdict

Enter a value above to run a lookup.

What the verdict means

  • Validated — DS at the parent + AD=1 from the validating resolver. Your zone is signed and the chain works.
  • Signed but unvalidated — DS exists but AD=0. Usually a key/algorithm mismatch.
  • Unsigned — No DS at the parent. The zone is not protected by DNSSEC.

Frequently asked questions

What does DNSSEC do?

DNSSEC adds cryptographic signatures (RRSIG) to DNS records and a chain of trust (DS at the parent, DNSKEY at the child) so a validating resolver can refuse forged answers. Without DNSSEC, a man-in-the-middle on the DNS path can swap your A record for a phishing site.

How does the SecDNS DNSSEC validator work?

We send the query through Cloudflare’s validating DoH endpoint with DO=1, then check the AD (Authenticated Data) flag in the response. AD=1 means a validating resolver verified every signature in the chain. We also check whether DS records exist at the parent zone — without DS, the chain is broken regardless of the AD flag.

My zone is signed but AD is 0 — why?

Common causes: (1) DS records were never published at the registrar, (2) the algorithm at the child does not match what the DS announces, (3) the zone is signed but the registrar pushed the wrong key tag. The validator surfaces both signals so you can pinpoint the break.

Should I enable DNSSEC?

For any production domain — yes. DNSSEC prevents cache poisoning and downgrade attacks. Most registrars now offer 1-click DNSSEC; SecDNS hosted zones sign automatically.

Does DNSSEC encrypt my DNS traffic?

No. DNSSEC authenticates answers; it does not hide them. For privacy, use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) — see the DoH Endpoint Tester tool.