DNSSEC Checker

Walks the DNSSEC chain of trust for a domain from the root down through each delegation, verifying that DS and DNSKEY records match at every level and that signatures are valid and unexpired. DNSSEC failures are notoriously hard to debug by hand because a broken link anywhere in the chain causes validating resolvers to silently refuse to resolve the domain at all, with no obvious error message. Worth running after rotating DNSSEC keys, changing registrars, or when a domain mysteriously stops resolving for some users but not others.

Because this walks the chain the same way a public validating resolver would, it can catch a break that checking your own authoritative server config alone would miss — the two aren't always testing the same thing.

📖 Read more in our Knowledge Base →