DNSSEC Checker
Is the domain signed, and does it validate?
DNSSEC signs your DNS records so a resolver can tell a genuine answer from a forged one. This checks that the parent zone publishes a DS record, that your zone publishes keys, and — the part that actually matters — whether a validating resolver accepts the chain. A domain that is signed but does not validate is worse off than one with no DNSSEC at all.
Frequently asked questions
What does DNSSEC actually protect against?
Forged DNS answers. Without it, anyone able to intercept or poison a resolver can point your domain at their server, and nothing in the protocol would notice.
My domain says "broken". What now?
Almost always the DS record at your registrar no longer matches the key your zone is signed with — usually after a nameserver move or a key rollover. Until it is fixed, everyone using a validating resolver cannot reach your domain at all.
Should I turn DNSSEC on?
It is worth it if your registrar and DNS host both support it and can rotate keys automatically. Enabled and unattended is the risky combination, because an expired signature takes the domain offline.