List a zone’s DNSKEY records with key tags, KSK or ZSK roles, algorithms and key sizes
Runs in your browser. Only the lookup you start is sent to cloudflare-dns.com or dns.google; nothing else leaves your device. Updated on 18 Oct 2026.A DNSKEY record holds one of the public keys a zone signs with. Flags 256 mark a zone-signing key and 257 a key-signing key, the one the parent points at. Enter a domain to list every key with its tag worked out per RFC 4034 Appendix B, its algorithm by number and name, whether RFC 8624 and the IANA registry still allow it for signing, and its size in bits.
Type the zone, such as example.com, and press Check DNSSEC.
Read the DNSKEY table, shown first on this page, with each Key tag and Role (flags).
Tell the keys apart: flags 256 is a zone-signing key (ZSK) and 257 the key-signing key (KSK).
Check the Algorithm, RFC 8624 signing, IANA today and Size columns for each key.
Type a domain and the page asks one public resolver, Cloudflare or Google, four questions over DNS-over-HTTPS with the DNSSEC bit set: the zone's DNSKEY records, the DS record its parent publishes, the NSEC3PARAM record, and the signatures that come back with each. Those answers are then read for you.
Keys are listed with their flags decoded (256 is a zone-signing key, 257 a key-signing key), the algorithm by number and name, and the key size. Each algorithm is shown against RFC 8624's signing column and the IANA registry that replaced it in 2025, so RSA/SHA-1 (algorithms 5 and 7), now marked MUST NOT, stands out.
Key tags and DS digests are recomputed in your browser. The tag is worked out from the key bytes as RFC 4034 Appendix B describes, and the DS digest is hashed again with WebCrypto, so "the DS matches the key" is checked here, not taken on trust.
The rest of the article, and all 6 questions about DNSSEC Checker, are on the DNSSEC Checker page.
The resolver answered SERVFAIL with validation on, yet answered normally with checking disabled. So the zone is signed but something does not check out: the DS at the registrar points at a key the zone no longer publishes, or a signature has expired. Validating resolvers then refuse to answer for the whole domain.
Both are DNSKEY records. Flags 257 mark the key-signing key, whose hash the parent holds as the DS record and which signs only the key set. Flags 256 mark the zone-signing key, which signs every other record. Splitting them lets the zone key change often without touching the registrar.
RFC 4034 Appendix B defines it: the DNSKEY data (flags, protocol, algorithm and key) is added up as 16-bit numbers, the overflow is folded back in, and the low 16 bits are the tag. The page does this in your browser and uses it to find which key each DS record points at.
No. The domain name goes to the resolver you choose, Cloudflare or Google, as four DNS questions over HTTPS. The key tags and digests are then worked out on your own device with the browser's WebCrypto. Nothing is stored, and no other server is contacted.
Still stuck? Ask about DNSSEC Checker and anybody who knows can answer. No account needed.
Same job, other tools: NS Lookup – Find the name servers a domain is delegated to, and how long resolvers cache them · SRV Record Lookup – Look up SRV records: priority, weight, port and target for a service · IP to ASN Lookup – Map an IP address to the ASN that announces it, with the BGP prefix · AS Number Lookup – Turn an AS number into the network name, registry and allocation date.
On the related tools: Open Port Checker – See if a port forwarded on your router is reachable from the internet.