Skip to content
Inbox Theory

DNS

DNSSEC Validation Checker

Checks whether a domain has deployed DNSSEC and, if so, whether its chain of trust (DS in the parent zone, DNSKEY in the zone itself) actually validates, plus the supporting DS and DNSKEY records for anyone who wants to inspect them directly.

DNSSEC signs a zone's DNS records so a resolver can prove the answers it got are the ones the zone actually published, rather than something injected in transit.

The chain of trust runs from a DS record in the parent zone to a DNSKEY in the zone itself; if the two stop matching (usually after a key rollover), a validating resolver returns SERVFAIL and the domain goes dark for a large slice of the internet, mail included.