DNS Tools

DNSSEC Checker

Check whether a domain has DNSSEC enabled - DNSKEY and DS records present.

Enter a domain to check whether it has DNSSEC enabled - a security extension that protects against DNS spoofing.

More DNS Tools

SRV Record Lookup TTL Checker CAA Record Lookup DNS Lookup DNS Propagation Checker A Record Lookup SOA Record Lookup AAAA Record Lookup

JustChecker tracks your DNS and security posture continuously.

What Is DNSSEC?

DNSSEC adds cryptographic signatures to DNS so resolvers can detect forged answers. This tool checks whether a domain publishes DNSKEY records and whether a DS record exists at the parent zone - the two parts that must both be present for DNSSEC to work.

When to Use It

After enabling DNSSEC at your DNS provider and registrar.
Before moving DNS providers - a stale DS record will break the domain.
During security reviews.

How to Use It

Enter the domain.
Check that both DNSKEY and DS records are reported.

Understanding the Result

DNSKEY without DS means signing is set up at the DNS host but not activated at the registrar. DS without matching keys is dangerous: validating resolvers will treat the domain as broken. Remove the DS record at the registrar before switching DNS providers.

Limitations

This checks that the records exist; it does not perform full cryptographic chain validation. Tools such as DNSViz give a detailed signature analysis.

Frequently Asked Questions

DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records, letting resolvers verify that DNS responses haven't been tampered with or spoofed.

No - it checks for the presence of DNSKEY and DS records, which indicates DNSSEC is likely configured. A full chain-of-trust validation requires checking signatures all the way to the DNS root, which this lightweight tool doesn't perform.

This is configured through your domain registrar or DNS provider - most major providers offer a one-click DNSSEC enable option, which then requires adding a DS record at your registrar.