DNSSEC Debugger

Trace and verify the DNSSEC chain of trust from DNS Root (.) down to your domain — step by step.

Enter a domain name — no http:// or www needed
About DNSSEC

DNSSEC adds cryptographic signatures to DNS records, forming a chain of trust from the root zone down to every signed domain. Each level must validate against its parent to complete the chain.

  • DNSKEY Public key record. KSK (flags=257) signs the ZSK, ZSK (flags=256) signs zone data.
  • DS Delegation Signer — a hash of the child KSK stored in the parent zone, linking the zones together.
  • RRSIG Resource Record Signature — cryptographic signature over a DNS record set, proving authenticity.

About DNSSEC Debugger – Check DNSSEC Chain of Trust

Verify and debug the full DNSSEC chain of trust from the DNS Root zone down to your domain. Check DNSKEY, DS, and RRSIG records at every level.

Inspect DNSSEC keys, signatures, DS records, and delegation links to find why a signed domain validates or fails.

Key features

  • Diagnostic scope Inspect DNSSEC keys, signatures, DS records, and delegation links to find why a signed domain validates or fails.
  • Target input Enter the affected domain and select a record type when the page permits focused validation.
  • Checks to review Review DNSKEY, DS, RRSIG, key tags, algorithms, signature times, parent-child matching, and validation status at each zone.
  • Diagnostic result The diagnostic distinguishes unsigned, insecure, secure, and bogus paths and points to the broken chain component.

How to use DNSSEC Debugger – Check DNSSEC Chain of Trust

Follow this workflow to work with DNSSEC validation chain safely and accurately.

  1. Enter the target Enter the affected domain and select a record type when the page permits focused validation.
  2. Select the diagnostic scope Review DNSKEY, DS, RRSIG, key tags, algorithms, signature times, parent-child matching, and validation status at each zone.
  3. Run the network check Run the DNSSEC validation chain diagnostic and retain status, timing, returned values, and the observation point needed to reproduce it.
  4. Correlate the result The diagnostic distinguishes unsigned, insecure, secure, and bogus paths and points to the broken chain component.

Usage tips

  • Confirm the parent DS matches the active child KSK before and after a key rollover.
  • Check RRSIG inception and expiration against accurate system time.
  • Remove a stale DS at the registrar before serving an intentionally unsigned child zone.

Frequently asked questions

Inspect DNSSEC keys, signatures, DS records, and delegation links to find why a signed domain validates or fails.
Enter the affected domain and select a record type when the page permits focused validation.
Review DNSKEY, DS, RRSIG, key tags, algorithms, signature times, parent-child matching, and validation status at each zone.
DNSSEC failures can be cached and location-dependent. Verify with multiple validating resolvers and authoritative queries before changing production keys or DS records.