How to use this tool
Displays DNSSEC validation results from the DNS intelligence provider and supporting DS/DNSKEY records. Record presence alone does not establish a valid chain of trust.
Enter the target, complete any relevant options and choose Check. Review the requested records, query outcomes and diagnostic findings. Copy Report saves the visible report.
Reading the results
No matching records and an unavailable query are different outcomes. TTLs are displayed in seconds; zero is a valid TTL. A completed request does not mean a domain passed its health checks. Only the submitted DNS owner and explicitly listed checks are inspected.
Frequently Asked Questions
Where is the enabled or disabled DNSSEC status?
The current implementation does not generate a DNSSEC status field. It only renders generic DNS record rows.
Does the page validate the DNSSEC chain of trust?
No. The code does not request and cryptographically validate DS, DNSKEY, and RRSIG records from the delegation chain.
Can normal DNS records prove DNSSEC is working?
No. A domain can return address, mail, and nameserver records whether DNSSEC is valid, absent, or broken.
Why are no DS or DNSKEY rows visible?
The browser fallback requests A, AAAA, MX, TXT, NS, and SOA records only. The server uses a general DNS request and does not guarantee DNSSEC record types.
Can the output detect a broken signature?
No. No signature verification result appears in the interface, so a broken DNSSEC signature cannot be diagnosed from this table.
What should I use the copied result for?
Use it as basic domain context alongside a validator that explicitly reports delegation, keys, signatures, and chain status.