DNSSEC Validator

DNSSEC validation

Is this domain's DNS signed, and does the chain of trust validate?

How this check works

DNSSEC adds signatures to DNS records so that a validating resolver can prove an answer hasn't been altered. The chain of trust runs from the DNS root through the top-level domain to your zone: the parent zone publishes a DS record that vouches for your zone's DNSKEY, and your DNSKEY signs your records.

The check looks up the domain's DS and DNSKEY records, then asks Cloudflare's validating resolver for the domain with DNSSEC checking on. If the resolver validates the answer, it sets the AD ("authenticated data") flag. If validation fails, it returns SERVFAIL; the check then repeats the query with checking disabled to confirm that the failure is caused by DNSSEC rather than a broken zone.

How to read the results

  • Secure: DS at the parent, DNSKEY in the zone, and the resolver validated the answer. Everything is working.
  • Unsigned: no DS and no DNSKEY. The zone doesn't use DNSSEC. That's still the most common state, and it's not an error.
  • Signed but not delegated: DNSKEY records exist but the parent has no DS record, so resolvers treat the zone as unsigned. Add the DS record at your registrar to finish the setup.
  • Bogus (broken): the resolver couldn't validate the chain, usually because the DS at the registrar doesn't match the current key, or signatures have expired. Validating resolvers return SERVFAIL, so the domain disappears for a large share of users. Fix this first.

Before you move DNS providers

Moving a signed zone to a new provider without planning breaks validation. Either remove the DS record and wait for it to expire before the move, or use a provider-supported key rollover. See changing nameservers without downtime.

Updated 26 October 2026

Related checks

  • Whois Search

    Who is this domain registered with, when does it expire, and is it locked?

  • Nameserver Lookup

    Which nameservers are authoritative for this domain, and which DNS provider runs them?

  • DNS Name Lookup

    What does DNS return for this name right now?

  • DNS Propagation Checker

    What does each public resolver return for this record right now?

FAQ

What does Secure mean here?

A validating resolver returned the zone's signed records with the authenticated-data flag set, so the chain of trust from the root validated. Both a DS record at the parent and a DNSKEY at the zone are needed for that.

What is the difference between Unsigned and Signed but not delegated?

Unsigned means no DNSSEC records at all. Signed but not delegated means the zone publishes DNSKEY records but the parent has no DS record for them, so validation stops one step short and resolvers treat the zone as unsigned.

What does Bogus mean?

The signatures are published but do not validate. A resolver that checks DNSSEC will return SERVFAIL, which looks like the domain does not exist for anyone who validates: browsers and mail servers included. A stale DS record after a key roll is the usual cause.