DNSSEC Debugger

Trace and verify the DNSSEC chain of trust from DNS Root (.) down to your domain — step by step.

Enter a domain name — no http:// or www needed
About DNSSEC

DNSSEC adds cryptographic signatures to DNS records, forming a chain of trust from the root zone down to every signed domain. Each level must validate against its parent to complete the chain.

  • DNSKEY Public key record. KSK (flags=257) signs the ZSK, ZSK (flags=256) signs zone data.
  • DS Delegation Signer — a hash of the child KSK stored in the parent zone, linking the zones together.
  • RRSIG Resource Record Signature — cryptographic signature over a DNS record set, proving authenticity.