DNSSEC (Domain Name System Security Extensions) adds digital signatures to DNS records. A resolver that supports it can verify those signatures back up through the parent zone to the root, confirming the answer it received actually came from the domain's real owner and wasn't altered in transit.

A free tool that asks a validating resolver whether a domain's DNSSEC chain of trust actually checks out, not just whether the records are present. It reads the DS record at the parent zone, the DNSKEY record at the domain itself, and the resolver's own validation result, then gives a direct verdict: valid, not signed, or broken.

Without DNSSEC, DNS responses can be forged. An attacker on the path, or one who poisons a resolver's cache, can redirect a domain to the wrong server without anyone noticing. DNSSEC closes that gap. It's also a prerequisite for DANE, which lets a domain pin its own TLS certificate in DNS.

Any publicly resolvable domain, on any TLD that supports DNSSEC delegation, including internationalized domain names in non-Latin scripts. Enter it as written, without "http://" or "www", for example example.com or ಐಪಿಫೈ.ಭಾರತ — the checker converts it to the correct DNS-safe form automatically before resolving it.

It means a DS record is published at the registrar, but it no longer matches the DNSKEY the zone is actually signing with. This usually happens after a key rollover that wasn't reflected at the registrar, or a nameserver or registrar migration that left the old DS record in place. Until the DS record is corrected or removed, validating resolvers will refuse to resolve the domain at all.