DNSSEC Checker
Enter a domain and Nivaronix looks up its DS record at the parent zone to report whether DNSSEC is enabled, not enabled, or — the case that matters most — signed but currently failing to resolve.
What this checker reports
- DNSSEC enabled — a DS record is published at the parent zone, so responses for the domain are signed.
- DNSSEC not enabled — no DS record is published, so answers are unsigned and a validating resolver cannot detect tampering.
- Signed but unresolved — a DS record exists but the domain failed to resolve during the scan, which is the signature of a stale or mismatched DS record breaking resolution for everyone behind a validating resolver.
- Status could not be verified— the DS lookup itself timed out or failed; this is reported as inconclusive, never as "not enabled."
What this check does not do
Nivaronix checks whether DNSSEC is enabled — specifically, whether a DS record is published at the parent zone, and whether our resolver's response carried the authenticated-data (AD) flag for that lookup. This is a presence-and-signature-status check, not full chain-of-trust validation from the root down through every intermediate zone. For an independent, full-chain validation view, use a dedicated tool such as dnsviz.net.
Learn more
Check your domain's DNSSEC status
Free, no signup for a single scan. DNSSEC is part of every full Nivaronix scan alongside SPF, DMARC, CAA, headers, and TLS.
Scan your domain freeDS records can go stale or get dropped during a registrar or DNS provider change, and a signed-but-unresolved zone can go unnoticed for days. Nivaronix's platform checks DNSSEC status on a schedule and alerts you if it breaks.
FAQ
What does a DS record have to do with DNSSEC?
A DS (Delegation Signer) record sits at the parent zone — for example, .com for a .com domain — and points to the key your domain uses to sign its own DNS records. Its presence at the parent is what lets a validating resolver build a chain of trust from the root down to your domain; no DS record at the parent means no chain, regardless of what your own zone signs.
What does 'signed but unresolved' mean, and why is it worse than not enabled?
It means a DS record exists at the parent zone, but the domain failed to resolve during the check — the signature of a stale or mismatched DS record, which breaks resolution for every visitor behind a validating resolver, not just some. A domain with no DNSSEC at all still resolves normally; a domain with a broken DS record can go fully unreachable for a meaningful share of users without any other symptom.
Does this checker validate the full DNSSEC chain of trust?
Nivaronix checks whether DNSSEC is enabled — specifically, whether a DS record is published at the parent zone, and whether our resolver's response carried the authenticated-data (AD) flag for that lookup. This is a presence-and-signature-status check, not full chain-of-trust validation from the root down through every intermediate zone. For an independent, full-chain validation view, use a dedicated tool such as dnsviz.net.
How do I fix a stale DS record?
Compare the DS record published at your registrar against the current DNSKEY your DNS provider is signing with — a mismatch usually follows a DNS provider migration or a key rollover where the old DS record was never updated. Most registrars let you update the DS record directly in their DNSSEC settings once the correct key data is confirmed.