DNSSEC Checker: Test DS, DNSKEY and DNS Security Validation
A DNSSEC checker helps determine whether a domain publishes DNS Security Extensions data and whether validating resolvers can build a trusted chain from the parent zone to the domain.
Broken DNSSEC can make a correctly hosted website appear offline because validating resolvers may return SERVFAIL rather than the destination address.
Check DS, DNSKEY and DNSSEC-related results with DNSCheckers.com.
What Is DNSSEC?
DNSSEC adds cryptographic signatures to DNS data so resolvers can detect forged or modified signed responses. It validates origin and integrity; it does not encrypt DNS traffic.
Important DNSSEC Records
DNSKEY
Publishes public keys used to validate signatures in the zone.
DS
Published in the parent zone and references a child-zone DNSKEY, linking the chain of trust.
RRSIG
Contains signatures for DNS record sets.
NSEC and NSEC3
Support authenticated denial of existence.
What a DNSSEC Checker Tests
- Whether DS records exist
- Whether DNSKEY records exist
- Whether DS matches an active key
- Whether signatures validate
- Whether the chain of trust is complete
- Whether normal queries return SERVFAIL
- Whether disabling validation changes the answer
What Is DNSSEC SERVFAIL?
SERVFAIL means the resolver could not successfully complete the query. In a signed domain, causes can include an invalid or expired signature, a missing key, an incorrect DS record, an unsupported algorithm, or unavailable authoritative servers.
Common Causes of Broken DNSSEC
Nameserver Change Without Updating DS
The registrar still publishes a DS record for the previous DNS provider.
Key Rotation Error
A key was removed before the parent DS or cached data was updated.
Expired Signatures
Signing automation failed and RRSIG validity ended.
Unsigned Zone with Active DS
The parent says the zone is signed, but the child no longer provides valid signatures.
Incorrect Algorithm or Digest
The DS references the wrong key or digest.
How to Check DNSSEC
- Query DS records.
- Query DNSKEY records.
- Test a normal validating lookup.
- Compare the result with checking disabled when a CD Flag is available.
- Review authoritative nameservers.
- Review the registrar's DS configuration.
- Retest through several validating resolvers.
What Is the CD Flag?
The Checking Disabled flag asks a recursive resolver not to reject an answer solely because validation fails. It helps diagnose whether DNSSEC is the reason for SERVFAIL.
A successful answer with CD enabled does not repair DNSSEC. It only isolates the likely cause.
Troubleshooting Workflow
- Confirm the authoritative nameservers.
- Determine whether the zone should be signed.
- Retrieve parent DS records.
- Retrieve child DNSKEY records.
- Verify that DS references an active key.
- Check signature validity periods.
- Review DNS-provider signing status.
- Review registrar DS data.
- Make a controlled correction.
- Wait for relevant TTLs and retest.
DNSSEC During Provider Migration
A nameserver migration requires coordination between the old provider, new provider, and registrar. Depending on provider support, the safe process may involve overlapping keys, transferring signing data, updating DS records in sequence, or temporarily removing the DS before migration.
DNSSEC vs HTTPS
| Technology | Protects |
|---|---|
| DNSSEC | Authenticity and integrity of signed DNS data |
| HTTPS | The application connection between client and server |
Frequently Asked Questions
Does DNSSEC encrypt DNS?
No. It validates signed data but does not provide confidentiality by itself.
Can broken DNSSEC take a website offline?
Yes. Validating resolvers may return SERVFAIL even when the web server is healthy.
Where is the DS record managed?
It is generally submitted through the registrar and published in the parent zone.
Does the CD Flag fix DNSSEC?
No. It is a diagnostic bypass for the test query.
Conclusion
A DNSSEC checker helps diagnose missing DS records, mismatched keys, expired signatures, broken chains of trust, and validation-related SERVFAIL errors.
Use the DNSCheckers.com DNS Checker to query DS and DNSKEY records and compare normal validation with the CD Flag.