DNSSEC adds a digital signature to a domain’s DNS records, so anyone looking up the domain can confirm the answer really came from its owner and was not changed along the way. When it is set up correctly, it works quietly in the background. When it breaks, the domain can vanish for a large share of the internet, with no warning other than “site cannot be reached.” The checker above looks at each part of a domain’s DNSSEC setup, tells you whether answers pass validation and explains how to fix anything that is wrong.

What DNSSEC Is

DNS was designed long before security was a concern, and plain DNS answers can be forged. An attacker who can slip a fake answer into a DNS service’s memory can send visitors to the wrong server without them noticing. DNSSEC, short for Domain Name System Security Extensions, closes that gap by signing records with a cryptographic key.

Signing alone is not enough, because an attacker could sign fake records with their own key. So DNSSEC builds a chain of trust. The root of DNS vouches for each extension, such as .com, and the .com registry vouches for your domain’s key through a record called DS, short for delegation signer. A DNS service that checks DNSSEC follows this chain from the root down to your records.

What This Tool Checks

Enter a domain, and the tool finds the zone it belongs to and checks each link in its chain of trust:

• The DS record held by the registry, with its key tag, algorithm and digest type
• The DNSKEY records published by the domain’s DNS host, split into key signing and zone signing keys
• Whether the DS record matches one of those keys
• Whether a signed answer passes validation at a DNS service that checks DNSSEC
• Whether the domain uses an outdated algorithm or digest

If validation fails, the tool repeats the lookup with checking turned off. If the answer comes back that way, the records exist but the signatures are wrong, which is the clearest sign of a broken DNSSEC setup.

How to Read Your Results

The verdict at the top falls into one of four groups. “DNSSEC is valid” in green means everything matches and answers pass validation. “DNSSEC is not turned on” means the domain has no DS record and no keys, which is the case for most domains and is not an error. “Signed but not active” in amber means the DNS host signs the records, but the registry has no DS record, so nobody checks the signatures. “DNSSEC is broken” in red means answers fail validation, and the domain is unreachable for many people.

Each row below the verdict has a colored dot. Green means that part is correct, amber means it needs attention and red marks the part that breaks the chain. A What to Fix box explains the steps for anything amber or red.

Why Broken DNSSEC Is So Serious

Most problems with a website affect everyone in the same way. Broken DNSSEC is different. DNS services that check DNSSEC, including Google Public DNS, Cloudflare, Quad9 and many large internet providers, refuse to return any answer for a domain whose signatures fail. People using those services cannot reach the website or send it email, while people using a service that does not check DNSSEC see nothing wrong.

That split makes the problem hard to spot. The owner may test the site from home and find it working, while a large share of visitors and email senders get errors. If some people report your site is down and others say it works, DNSSEC is one of the first things to check.

The Most Common Cause: Moving DNS Hosts

Most broken DNSSEC setups follow the same pattern. A domain has DNSSEC turned on at one DNS host, and the registry holds a DS record that matches that host’s key. The owner then moves the domain to a new DNS host or changes nameservers, but the old DS record stays at the registrar. The new host either does not sign the records or signs them with a different key, and the chain of trust breaks the moment the nameservers change.

The safe way to move is to turn DNSSEC off first. Remove the DS record at the registrar, wait a day or two for the old record to expire everywhere, move the nameservers, then turn DNSSEC on at the new host and add its new DS record.

How to Fix Broken DNSSEC

If your domain is broken right now, the fastest fix is to remove the DS record at your registrar. Without a DS record, DNS services stop checking signatures, and the domain works for everyone again as soon as the change reaches the registry, usually within a few hours. Once the site is back, turn DNSSEC on again properly at your current DNS host.

If the DS record matches the key but signatures still fail, the signatures have probably expired. That happens when a DNS host stops re-signing the zone, or when records were changed outside the signing system. Your DNS host needs to re-sign the zone, and removing the DS record is again the quick way to restore access in the meantime.

How to Turn DNSSEC On

Turning DNSSEC on is a two-step job. First, enable it at your DNS host. Cloudflare, most large registrars and many hosting control panels offer it as a single switch. The host then shows you a DS record, a short line with a key tag, an algorithm number, a digest type and a long digest. Second, add that DS record in the DNSSEC section of your domain at the registrar. Some registrars, and Cloudflare Registrar, do this second step automatically.

After adding the DS record, run the check again. It can take a few hours for the registry to publish it. Once the verdict shows DNSSEC is valid, there is nothing more to do, as long as you remember to update or remove the DS record before any future move to a different DNS host.

Algorithms and Digests

DNSSEC keys use a signing algorithm, and DS records use a digest type. Modern setups use ECDSA P-256, algorithm 13, which produces small, fast signatures, or RSA with SHA-256, algorithm 8. Older algorithms based on SHA-1 are outdated, and some DNS services have started treating them as unsigned. For DS records, a SHA-256 digest, type 2, is the standard choice, and a record that only uses SHA-1 should be replaced. The tool flags both cases in amber.

Your Checks Stay Private

Lookups run in your browser through Google Public DNS, with Cloudflare DNS as a backup, the same services that validate DNSSEC for millions of people. Domibot does not see or store the domains you check.