Check DNSSEC signature

With Check DNSSEC signature, site owners and system administrators can check DNSSEC after enabling it or changing domain records. See whether DNSSEC validation succeeds, is absent or returns an error.

See whether DNSSEC validation succeeds, is absent or returns an error. Use it free in your browser with no account required.

How to use

Enter the domain whose DNSSEC signature you want to check.
Start the verification and wait for the verdict to appear in your browser.
Read the status you get: successful validation, missing signature or reported error.
If an error is reported, note the detail shown and compare it with the records you have just published.
Run the check again after each correction to follow how the status evolves.

Example

You have just enabled DNSSEC at your registrar and want to know whether everything is in place. The check reports whether validation succeeds, whether no signature is published, or whether an error persists, which tells you if more work is needed.

Limits and formats

A domain that is deliberately unsigned is a normal case; the absence of DNSSEC is not a fault by itself.
The outcome depends on the state of the zone at the time of the check, so allow some delay after an edit before concluding.
This check does not replace your registrar's own tools or your provider's logs when you need to understand a signing error.

Where processing happens

The whole check runs in your browser, on your own device, and nothing is sent out by the tool. No sign-up is required, and the outcome stays on the page for you to read or copy.

Frequently asked questions

What does a DNSSEC validation error mean?

It means the chain of trust is broken: a signature is missing, does not match, or is not recognised. Resolvers that validate DNSSEC may then refuse to answer for that domain.

My domain is not signed, is that a problem?

Not necessarily, since many domains run without DNSSEC. The check simply reports the real state, and it is up to you to decide whether to enable signing at your registrar.

Why does the status change between two checks?

A zone being updated can publish an incomplete signature for a while. Wait for the changes to spread, then run the check again before treating it as a lasting problem.