Skip to content
Mail TesterMail DoctorIMAP MigrationList VerificationArchive RecoveryMonitoring
What is my IP addressDNS Propagation CheckerTCP Port CheckerMTA-STS and TLS-RPT CheckerDNSSEC checkSecurity Headers CheckerSPF, DKIM and DMARC CheckerWHOIS and Domain LookupEmail Header AnalyzerSSL Certificate CheckDNS and MX LookupBlacklist CheckIs It DownSpeed testPassword generator

DNSSEC check

Paste a domain. You get whether it is signed, whether the chain validates up to the root, and — the part that matters — whether a broken signature is quietly making it unreachable.

Why a broken signature is worse than no signature

Without DNSSEC, an answer can be forged and believed. With DNSSEC working, a forged answer is thrown out. With DNSSEC broken, every resolver that checks refuses to answer at all — so the domain does not look wrong, it looks gone. And from a resolver that does not check, it looks perfect, which is why this is usually found by a customer and not by you.

What this does not tell you

That a domain is signed says nothing about whether its site is safe, its mail is authenticated or its certificate is valid: DNSSEC protects the ANSWERS to DNS queries, not what is at the other end of them. And not being signed is not a fault — most domains are not.

If you are here, this is usually what comes next

If what you are chasing is the whole DNS picture

This looks at one thing very closely. To see the name servers, MX, A, AAAA, SPF and DMARC of a domain side by side, there is another tool:

DNS and MX Lookup →

Frequently asked questions

My domain is not signed. Should I sign it?
Only if you can keep it signed. A signature that expires or stops matching takes the domain off the internet for everyone who validates, which is a far worse day than not having it. If your DNS provider does it for you with one switch and renews it on its own, it is worth it; if it means remembering to roll keys by hand, it is not.
It says broken, but the site opens for me.
That is exactly the shape of this fault. Your resolver is not validating, so it hands you the answer anyway. Resolvers that do validate — most large providers — refuse to answer at all, and for those users the domain simply does not exist. Try it from a phone on mobile data and you will probably see the other half.
What is a DS record and why is it at my registrar?
The DS is how the parent zone says “this domain is signed, check it”. It has to live one level up, which is your registrar rather than your DNS, and that split is why the most common half-finished state is a zone signed with no DS: all of the work and none of the protection.