Check a domain’s DNSSEC

What DNSSEC is, how it cryptographically signs your DNS zone to stop cache poisoning and spoofing, how to check whether a domain has it active, and the essential warning: a botched activation — a DS record that doesn’t match your key — leaves the domain unreachable with SERVFAIL. With a step-by-step explanation.

FREE TOOL · NO SIGN-UP

Check your domain’s email security

Our free analyser reviews your domain’s email authentication (SPF, DKIM, DMARC and MX) in seconds — the foundation that stops your brand being spoofed by email. DNSSEC operates on a different layer, the signing of the DNS zone, and is validated differently, with a dig +dnssec query or a specialised validator, as we explain below. Sign up if you want continuous monitoring of your DNS and email surface.

What is DNSSEC?

DNSSEC (DNS Security Extensions, defined in RFC 4033, 4034 and 4035) is a set of extensions that add cryptographic signatures to DNS records. Classic DNS answers with no proof of authenticity: a resolver cannot tell whether the answer it receives really comes from the legitimate zone or whether someone tampered with it along the way. DNSSEC fixes this by signing each set of records with a private key and publishing the public key in DNS itself, so a validating resolver can mathematically verify that the answer is authentic and unaltered. To do so it introduces several new record types: DNSKEY (the public keys), RRSIG (the signature over each record set), DS (the chain-of-trust link to the parent zone) and NSEC/NSEC3 (authenticated proof that a name does not exist).

Why it matters: it stops DNS poisoning and spoofing

Without DNSSEC, DNS is vulnerable to cache poisoning and to man-in-the-middle attacks that inject forged answers: an attacker can make yourdomain.com resolve to their server and redirect your users to a fraudulent site, intercept mail or steal credentials without the victim noticing anything. The classic Kaminsky attack (2008) proved how practical this is. With DNSSEC, any tampered answer fails signature validation and the resolver discards it. An important nuance: DNSSEC guarantees authenticity and integrity (that the answer is the real one and unchanged), but not confidentiality: it does not encrypt your DNS queries. To encrypt DNS traffic you use other technologies (DNS over HTTPS or DNS over TLS), which are complementary to DNSSEC.

The chain of trust: DS, DNSKEY and RRSIG

DNSSEC works as a chain that starts at the DNS root and goes down to your domain. Each zone signs its records with its private key; the public key travels in the DNSKEY record (there is usually a KSK, the key-signing key, and a ZSK, the zone-signing key) and each record set carries its signature in an RRSIG. The link that ties your zone to its parent (the TLD, for example .com) is the DS record: it is a digest (hash) of your key, and it is published in the parent zone through your domain registrar, not in your own DNS. That way the root vouches for the TLD, the TLD vouches for your domain via the DS, and your domain vouches for its records. An example DS record:

example.com. 3600 IN DS 12345 13 2 A1B2C3D4E5F6...

How to check whether a domain has DNSSEC

You can query it directly with dig. The DS record at the parent and the DNSKEY in your zone confirm the keys are published:

dig DS example.com +short
dig DNSKEY example.com +short

To know whether validation actually works end to end, query a validating resolver (such as 1.1.1.1 or 8.8.8.8) and look for the ad (Authenticated Data) flag in the answer’s flags:

dig +dnssec example.com
;; flags: qr rd ra ad;   ("ad" flag = validated answer)

For a visual diagnosis of the whole chain of trust a specialised validator such as DNSViz or the Verisign DNSSEC debugger is ideal. Note: our free email analyser covers SPF, DKIM, DMARC and MX; DNSSEC is checked with these DNS queries, not from that scanner.

⚠️ Warning: enabling it wrong can take your domain down

DNSSEC is one of the few DNS configurations that, done wrong, leaves your domain completely unreachable. If you publish a DS record at the registrar that does not match your zone’s real DNSKEY — through a badly coordinated key rotation, or by migrating DNS provider without first removing the DS — every validating resolver (Google, Cloudflare, many ISPs) will return SERVFAIL and your users will stop resolving the domain: website and email down, with no prior warning. That is why we treat it as a one-way door: enable it with caution, coordinate any key change (rollover) respecting its overlap period, never migrate DNS with DNSSEC active without disabling it first (remove the DS, wait for the TTL to expire, migrate and re-sign), and always validate the result with a tool like DNSViz before considering it done. Have a rollback plan ready.

Frequently asked questions about DNSSEC

What is DNSSEC and what is it for?

DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records so a resolver can verify that an answer is authentic and has not been tampered with. It serves to stop cache poisoning and DNS spoofing, which would otherwise let attackers redirect your users to fraudulent servers.

Does DNSSEC encrypt my DNS queries?

No. DNSSEC guarantees authenticity and integrity (that the answer is the legitimate one and unchanged), but not confidentiality: it does not hide or encrypt the content of your queries. To encrypt DNS traffic you use DNS over HTTPS (DoH) or DNS over TLS (DoT), which are complementary to DNSSEC.

How do I know if my domain has DNSSEC enabled?

Check whether a DS record exists at the parent domain and a DNSKEY in your zone (for example with dig DS yourdomain.com and dig DNSKEY yourdomain.com). To confirm that validation works, run a dig +dnssec query against a validating resolver and check that the "ad" flag appears. A validator such as DNSViz shows you the whole chain of trust.

Can DNSSEC make my domain unreachable?

Yes. If the registrar’s DS record does not match your zone’s DNSKEY — through a botched key rotation or by migrating DNS provider without removing the DS — validating resolvers return SERVFAIL and the domain stops resolving, taking website and email down. That is why it should be enabled with caution and a rollback plan.

Sources and references

Updated: July 2026 · Informational content; not professional advice.

Keep learning

Monitor your DNS and email surface continuously

Sign up free at OCIRIA Security and get alerts when your DNS, DNSSEC or email authentication configuration changes and stops protecting your domain.

Sign up free Talk to us