Skip to content
dnsdon

DNSSEC Chain Validator

Follow the chain of trust from the parent DS record to the zone's DNSKEY and signatures, and see what validating resolvers conclude.

Enter a domain or hostname. Pasted URLs and internationalized names work too.

What this checks

  • Validation outcome from two independent validating resolvers
  • DS records published in the parent zone
  • DNSKEY records served by the zone, with key tags and roles
  • DS digests recomputed and matched against the zone's keys
  • Signature presence and validity windows

How to read the results

Pass
The check succeeded based on the observed responses.
Warning
Works now, but is risky, unusual or worth reviewing.
Fail
A problem was observed directly in the responses.
Inconclusive
Not enough evidence — for example a server did not respond.