Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

DNSSEC check

Tells you whether the zone is signed, whether the chain of trust reaches it, and whether a validating resolver actually accepts the answers.

Judged against RFC 4033, RFC 4034 and RFC 4035

Free, instant, no signup. This test reads your live DNS the way a receiving server does.

Symptoms

DNSSEC has exactly two states worth talking about, and neither produces a symptom you would notice in an inbox. Either it is absent, which is the common case and a quiet risk, or it is half configured, which is a risk that eventually becomes an outage.

Diagnosis

Every email security record you publish is only as trustworthy as the DNS that carries it. SPF, DKIM and DMARC all assume a receiver reads the real record. DNSSEC signs your zone so a resolver can prove it did.

The three outcomes

  • Unsigned. No keys published. Nothing is broken, and nothing is verifiable either.
  • Signed and validating. Keys published, the DS record at your registrar links them to the chain, and a validating resolver confirms it. This is the goal.
  • Signed but not validating. Keys exist, the chain does not reach them. Usually a missing DS record; sometimes a key rotated on one side only, which is the state that takes the domain offline.

Cure

  1. To enable it: turn DNSSEC on at your DNS host, then publish the DS record it gives you at your registrar. Both steps, or neither. The first alone achieves nothing.
  2. If it is signed with no DS: copy the DS record from your DNS host into the registrar's control panel. This is a one-time step that is very easy to forget.
  3. If validation is failing: treat it as urgent. Check that the DS at your registrar still matches the key at your DNS host, and if you cannot fix it quickly, disable DNSSEC at the registrar to restore resolution while you sort it out.

Questions people actually ask

Does DNSSEC affect email deliverability?

Not directly, no receiver scores your mail on it. What it protects is the DNS your email security depends on: without it, an attacker who can poison a resolver can replace your MX, SPF and DMARC records and redirect mail without ever touching your account.

What does "signed but no DS record" mean?

Your DNS host has signed the zone, but the matching DS record was never published at your registrar. The chain of trust is broken at the top, so validating resolvers treat the zone as unsigned. You have all of the cost and none of the protection.

What happens if DNSSEC validation fails?

The domain stops resolving for a large part of the internet. Google, Cloudflare and most large mail providers validate, and a bogus signature makes them refuse the answer entirely rather than fall back. It is one of the few DNS mistakes that takes a domain fully offline.

Is DNSSEC risky to enable?

The enabling is safe; the rotating is where people get hurt. Change the key at your DNS host without updating the DS at your registrar and the domain goes dark. Let your provider manage both ends if it offers to.

Related tests

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.