DNSSEC Validation Check
Check DNSSEC properly — including the broken-signature case a single query cannot see.
How this lookup works
The domain is queried twice: once normally, and once with checking disabled. That pair is what makes the answer meaningful. A single query returning the Authenticated Data flag tells you the resolver validated the chain — but its absence is ambiguous, because a non-validating resolver never sets it regardless of how well signed the domain is. Worse, the failure that actually matters is invisible in one query: when a domain is signed and its signatures have broken, a validating resolver returns SERVFAIL and the name is simply unreachable for everyone using one. Resolving with checking disabled and failing without it is exactly that case, and it is the outcome worth acting on immediately.
What the results mean
- Secure
- The AD flag was set — the resolver followed the chain from the root and every signature checked out.
- Bogus
- Resolves only with validation disabled. The domain is signed and broken, and unreachable for anyone using a validating resolver.
- Insecure
- Resolves, no AD flag. Most likely unsigned, but strictly this is ambiguous.
- AD flag
- Means this resolver validated. Its absence is not proof of anything on its own.
Common problems and fixes
- Some people cannot reach my domain and others can
- Check for the bogus state. A broken DNSSEC chain fails only for people using a validating resolver, which now includes Google, Cloudflare and most ISPs — so it looks intermittent and is not.
- My domain shows as insecure but I enabled DNSSEC
- The DS record at the registrar may not match the key at the DNS host. Both sides have to agree, and enabling it in one place alone leaves the domain unsigned.
- Does DNSSEC encrypt my DNS queries?
- No, and this is the common confusion. It signs answers so they cannot be forged. Encrypting the query is what DNS-over-HTTPS and DNS-over-TLS do.
Frequently asked questions
What does the AD flag actually mean?
That the resolver answering you validated the DNSSEC chain itself. It says nothing about the path between you and that resolver, and it is absent from any resolver that does not validate — which is why a single query cannot distinguish unsigned from unvalidated.
What happens if DNSSEC breaks?
The domain becomes unreachable for everyone using a validating resolver, which is now most people. It is one of the few DNS misconfigurations that takes a domain offline completely rather than degrading it.
Is DNSSEC the same as DNS-over-HTTPS?
No. DNSSEC signs the answer so it cannot be forged between the authoritative servers and the resolver. DNS-over-HTTPS encrypts the query between you and the resolver. Different threats, and you can have either without the other.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/dnssec-check/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="DNSSEC Validation Check" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/dnssec-check/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.