DNSSEC checker: is this domain signed, and does it validate?
In short: Paste one domain or a list and see which are signed and validate, which are broken (validating resolvers refuse them), which have keys but no DS at the registry, and which aren't signed. Limit: It asks one validating public resolver; it doesn't walk the chain itself or check each of the domain's name servers separately.
A DNSSEC checker tells you whether a domain is signed and whether the signatures validate. Paste one domain, or up to 100 (500 after a Google sign-in): each is asked for its DS record at the registry and its DNSKEY records at the DNS host, through a validating public resolver, and comes back Signed and valid, Broken, Keys but no DS, or Not signed.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
Sample result
acme.example is signed and validates; globex.example's DNSSEC is broken.
- Domain
- acme.example
- DS
- 2371 · SHA-256
- Algorithm
- ECDSAP256SHA256
What this means for you
Find the domains validating resolvers refuse before their sites and email stop working.
- DS at the registry, DNSKEY in the zone
- Broken chains caught before users hit them
- Weak algorithms flagged per RFC 8624
- 100 domains a run, 500 when signed in
- DNSSEC
- DS
- DNSKEY
By SimpleVerifier Team · Last updated
Also in: Português (Brasil) · Español · Deutsch · Français
Auditing every domain you own, or the domains you send email from?
- Over 500 domains? Run them in batches of 500 when signed in and download the CSV after each.
- Broken DNSSEC stops validating mail servers from finding MX records, so check those domains' mail setup next with the cold email domain checker.
- Sending to a list of addresses on these domains? Check them at /verify. The first 100 email checks are free with a Google sign-in, no card.
How do I check if DNSSEC is enabled for a domain?
- Paste one domain, or a list one per line: up to 100 a run, or 500 after a free Google sign-in. Addresses and URLs work; subdomains are reduced to the registered name.
- Press Check DNSSEC. Each domain's DS and DNSKEY records are asked of Google Public DNS over HTTPS, with Cloudflare as the fallback.
- Read the status and the reasons: the key tags and algorithms found, whether the DS matches a key, and whether the resolver validated the answer.
- Fix Broken first, since validating resolvers refuse those domains. For Keys but no DS, copy the DS record from your DNS host into the registrar's DNSSEC settings.
Example
- You enter
- Three domains:
acme.example,globex.exampleandinitech.example. - You get
acme.exampleSigned and valid: DS key tag 2371 (ECDSAP256SHA256, SHA-256) at the registry matches a key in the zone, and the resolver validated it.globex.exampleBroken: the DS points at key tag 42069, which the zone no longer serves, so validating resolvers refuse the domain.initech.exampleNot signed. Download the CSV.- Limits
- Up to 100 domains a run without an account and 500 when signed in with Google. Subdomains are reduced to the registered domain.
How does DNSSEC validation work?
DNSSEC adds signatures to DNS answers so a resolver can tell they weren't forged (RFC 4033). The domain's DNS host signs the zone and publishes its public keys as DNSKEY records. The registry publishes a DS record, a fingerprint of the key-signing key, in the parent zone (.com, .org and so on). A validating resolver follows the chain from the root's key down through each DS to the domain's keys (RFC 4035).
This checker asks a validating resolver for both records with the AD (authenticated data) flag requested, as RFC 6840 describes. If the resolver sets AD, the chain validated. If it answers SERVFAIL but answers with checking disabled, the chain is there but fails: that's Broken.
What do the statuses mean?
Signed and valid: DS at the registry, DNSKEY in the zone, and the resolver validated it. Broken: a DS is published but the zone's keys or signatures don't match it, so resolvers that validate refuse to answer for the domain at all. This is the one to fix now; the usual cause is a move to a new DNS host without removing the old DS at the registrar.
Keys but no DS: the DNS host signs the zone, but the DS was never added at the registrar, so nothing is validated. Signed, not validated: both are published but the resolver didn't validate, usually because of an algorithm it doesn't support. Not signed: neither record exists, which is still the case for most domains.
Which DNSSEC algorithms should a domain use?
RFC 8624 lists which algorithms signers and validators should use. ECDSAP256SHA256 (algorithm 13) and RSASHA256 (8) are the two every signer must support; RSAMD5, DSA and ECC-GOST must not be used for signing, and RSASHA1 (5 and 7) is not recommended. For DS digests, SHA-256 (digest type 2) is required and SHA-1 must not be used for new delegations. The checker names each algorithm from IANA's DNSSEC algorithm registry and flags the weak ones.
Who uses this tool, and for what?
- IT teams
- Audit every company domain for broken DNSSEC before a DNS host migration, and again after it.
- Agencies
- Taking over a client's DNS? Find the domains with a DS record that will break when the nameservers change.
- Domain investors
- Spot names that are signed so you remove the DS before moving them to a new DNS host.
- Cold emailers
- Make sure no sending domain has broken DNSSEC, which silently stops mail to validating servers.
What can’t this tool tell you?
- It asks one validating public resolver; it doesn't walk the chain itself or check each of the domain's name servers separately.
- It checks the registered domain, not delegated subdomains with their own DS records.
- It doesn't check signature expiry dates or NSEC/NSEC3 denial records.
- A resolver's cache can show the old state for up to the record's TTL after a change.
- Up to 100 domains a run without an account and 500 signed in.
Common questions
- How do I know if DNSSEC is enabled?
- Look for a DS record for the domain in its parent zone and DNSKEY records in the domain's own zone. This checker asks for both and shows whether a validating resolver accepted the chain.
- What happens if DNSSEC is broken?
- Resolvers that validate, including Google Public DNS, Cloudflare 1.1.1.1 and Quad9, return SERVFAIL for the domain, so its website and email stop working for everyone using them. Removing the stale DS record at the registrar fixes it once caches expire.
- Where do I turn on DNSSEC?
- Two places. Turn on signing at your DNS host (for example Cloudflare or Route 53), then copy the DS record it gives you into your registrar's DNSSEC settings. If the registrar is also the DNS host, it's often one switch.
- Can I check DNSSEC for many domains at once?
- Yes. Paste up to 100 domains a run, or 500 after a free Google sign-in, and download the results as CSV.
- Does DNSSEC affect email deliverability?
- Not being signed doesn't hurt deliverability. Broken DNSSEC does: mail servers that validate can't look up the domain's MX, SPF or DKIM records, so mail to and from it fails.
- Is the DNSSEC checker free?
- Yes. 100 domains a run without an account and 500 after a free Google sign-in, no card.
Sources
You audited one domain. Cold outreach means thousands.
This tool checks a domain you type in. It will not tell you which addresses at that domain are real.
- Bulk mailbox verification with real SMTP checks
- The email finder — name plus company to a verified address
- Website enrichment for emails, owner names and socials
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.