Free account
DNSSEC check
Check whether your domain's DNS answers are signed and whether the chain of trust from the parent zone is intact.
DNSSEC is part of the advanced check: free with an account, on domains you verify, 5 checks a day.
Create a free accountWhat DNSSEC is and why it matters
DNSSEC signs your DNS records. Resolvers check the signature against a key published in the parent zone (for example .com), so they can tell real answers from forged ones.
Without DNSSEC, an attacker who can tamper with DNS answers can send your visitors and your email to their own servers. DNSSEC is also required for DANE, which protects email in transit.
example.com. 3600 IN DS 2371 13 2 1F987CC6583E92DF0890718C42…The DS record links your zone's key to the parent zone. Your registrar publishes it.
Common problems we find
Not signed
The most common case. Many DNS providers support DNSSEC but leave it off.
Broken chain
A DS record that does not match your key makes resolvers reject your domain.
Weak algorithm
Old RSA/SHA-1 algorithms should be replaced with ECDSA (13).
How to fix it
- 01Turn on DNSSEC at your DNS provider.
- 02Add the DS record it gives you at your registrar (often automatic).
- 03Check again after the parent zone has published the DS record.
Questions
Why is DNSSEC not in the free anonymous check?
The anonymous check focuses on email security, which most domains get wrong. DNSSEC and the other advanced checks come with a free account, for domains you have verified as yours.
More checks: DMARC · SPF · DKIM · All DNS checks
Check the whole domain, not just one record
The free check covers SPF, DKIM, DMARC and MX in one go.