Last updated September 27, 2026 · Report an error
DNSSEC cryptographically signs DNS records so resolvers can detect tampering or spoofing. This tool checks a domain's DNSSEC status by asking Google Public DNS — a resolver that performs full DNSSEC validation — for its DNSKEY record and reading whether that resolver authenticated it.
How it works
Enter a plain domain. Since PHP has no built-in way to query DNSKEY/DS/RRSIG record types at all, this tool asks Google Public DNS's DNS-over-HTTPS API for the domain's DNSKEY record and reads the "AD" (Authenticated Data) flag in the response — a genuine signal that the resolver itself cryptographically verified the domain's signature chain, not merely that a key exists somewhere.
- Enter domain.
- Click Calculate to see your results.
Examples
A domain with DNSSEC enabled and validating
cloudflare.com returns a DNSKEY record and Google's resolver reports AD=true, meaning the full chain of trust validated correctly.
Who should use it
- Verifying DNSSEC is still validating correctly after a DNS or registrar change.
- Quick pre-flight check before troubleshooting deeper DNSSEC issues.
Industry applications
- IT security and network administration
- DNS and hosting/DevOps operations
Advantages
- Reports a genuine, resolver-verified authentication signal (the AD flag), not just record presence.
- No local cryptography required — leverages an existing trusted DNSSEC-validating resolver.
Limitations
- Depends on Google Public DNS's availability and doesn't perform independent local verification.
Common mistakes to avoid
- Assuming any DNSKEY record presence alone means DNSSEC is "working" — the AD flag (actual authentication) is the more meaningful signal.
- Expecting this tool to catch every possible DNSSEC misconfiguration — it reports one resolver's validation outcome, not a full diagnostic trace.
Best practices
- Treat a failed AD flag as a signal to dig deeper with a dedicated DNSSEC debugging tool (e.g. Verisign's DNSSEC Debugger) rather than this quick check alone.
- Re-check after any DNS provider migration, since DNSSEC chains commonly break during transfers.
Tips
- Combine with the CNAME, MX, TXT, and DNS Lookup tools for a fuller domain health check.