🔐 DNSSEC Checker
Validate the DNSSEC chain of trust — DS, DNSKEY, and RRSIG records
🔧 Related Tools
Try a known DNSSEC domain: cloudflare.com · bankofamerica.com · icann.org · verisign.com
Frequently Asked Questions
What is DNSSEC?
DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records, allowing resolvers to verify that responses haven't been tampered with. Without DNSSEC, attackers could perform "DNS cache poisoning" attacks — redirecting your domain's visitors to malicious servers without anyone noticing. DNSSEC creates a chain of trust from the root DNS zone down to your domain, ensuring every DNS response is authentic and unmodified.
Which domains have DNSSEC? What are good examples to test?
Many security-conscious organisations have deployed DNSSEC. Good examples to check include: cloudflare.com, bankofamerica.com, nic.cz, icann.org, google.com, and verisign.com. Government and financial domains are often good candidates. You can use these to see what a healthy DNSSEC chain looks like.
What does "DNSSEC not enabled" mean?
Most domains do not have DNSSEC enabled — this is normal. It means your DNS records are served without cryptographic signatures. Visitors can still reach your site, but there is no protection against DNS cache poisoning. If you handle sensitive data or are a government or financial entity, enabling DNSSEC is strongly recommended.
What does a "broken" DNSSEC status mean?
A broken DNSSEC status means DNSSEC records exist but the cryptographic chain cannot be validated. This is worse than having no DNSSEC at all — some resolvers will actively refuse to resolve your domain, causing outages for users on DNSSEC-validating resolvers (like those using Cloudflare 1.1.1.1 or Google 8.8.8.8). Common causes: expired RRSIG records, DS record mismatch after key rollover, or missing DNSKEY records.
How do I enable DNSSEC for my domain?
DNSSEC is enabled at two levels: (1) your DNS hosting provider must sign your zone and publish DNSKEY/RRSIG records, and (2) your domain registrar must publish a DS record in the parent zone. Most modern DNS providers (Cloudflare, Route 53, Google Cloud DNS) support DNSSEC. The exact steps vary by provider — check your DNS host's documentation. If you need help, contact OSH.co.za.
Privacy Policy
Data Collection: This DNSSEC Checker processes data to provide results. When you enter a domain name, we perform DNSSEC validation queries via trusted DNS resolvers (Google, Cloudflare). No domain names or results are stored on our servers. We do not store, log, or share the domain names or data you submit beyond what is necessary to return your results.
Data Usage: Your input is used solely to generate results. No data is saved, analysed for profiling, or shared with third parties. Each new check operates independently.
DNS Lookups: To check your domain, we perform DNS queries via Google's DNS-over-HTTPS (dns.google). These queries are subject to Google's Privacy Policy. Only the domain name is transmitted — no personally identifiable information.
Analytics: We may collect anonymized usage statistics (page views, tool usage frequency) to improve functionality. This does not include the domain names you check or any personally identifiable information.
Contact: For privacy enquiries or questions, please contact us at support@osh.co.za or visit osh.co.za/contact.