IP Lookup Tools DNSSEC Validation

DNSSEC chain of trust validation

Validate a domain's DNSSEC signatures starting at the root zone. A broken chain or an expired signature makes the domain fail to resolve at validating resolvers.

Unsigned domains are not an error; they are only marked as unsigned.

What is checked?

DS to DNSKEY matching for the root, the extension and the domain
Cryptographic validation of RRSIG signatures and their expiry
The AD flag from a validating resolver

How do I read the result?

Signed with a sound chain: green, no action needed.
DS record present but not matching a key: the domain cannot resolve, update the DS.
If the signature has expired, re-sign the zone.

Frequently asked questions

Is DNSSEC mandatory?

No, but if used it must be configured correctly. Broken DNSSEC is worse than no DNSSEC at all.