Read the DS record the parent zone holds and see whether it matches a published key
Runs in your browser. Only the lookup you start is sent to cloudflare-dns.com or dns.google; nothing else leaves your device. Updated on 18 Oct 2026.The DS (Delegation Signer) record sits in the parent zone, at .com for example.com, and holds a hash of the domain’s key-signing key. If it is missing, DNSSEC is switched off for everyone; if it is wrong, the domain stops resolving. This page fetches the DS, finds the key with the same tag, and recomputes the SHA-256 or SHA-1 digest in your browser to prove they match.
Type the domain, such as example.com, and press Check DNSSEC.
Read the DS table, shown first on this page, with the key tag and digest the parent zone holds.
Look at Matches a DNSKEY: Yes, digest recomputed means the DS fits a published key.
If it says Digest differs or No key with this tag, correct the DS record at your registrar.
Type a domain and the page asks one public resolver, Cloudflare or Google, four questions over DNS-over-HTTPS with the DNSSEC bit set: the zone's DNSKEY records, the DS record its parent publishes, the NSEC3PARAM record, and the signatures that come back with each. Those answers are then read for you.
Keys are listed with their flags decoded (256 is a zone-signing key, 257 a key-signing key), the algorithm by number and name, and the key size. Each algorithm is shown against RFC 8624's signing column and the IANA registry that replaced it in 2025, so RSA/SHA-1 (algorithms 5 and 7), now marked MUST NOT, stands out.
Key tags and DS digests are recomputed in your browser. The tag is worked out from the key bytes as RFC 4034 Appendix B describes, and the DS digest is hashed again with WebCrypto, so "the DS matches the key" is checked here, not taken on trust.
The rest of the article, and all 6 questions about DNSSEC Checker, are on the DNSSEC Checker page.
Enter the domain and press Check DNSSEC. A green Secure verdict means the resolver validated the answer and set the AD flag. Unsigned means there is no DS record at the parent. Not linked means the zone has keys but the registrar never received the DS record, so nobody trusts them yet.
The resolver answered SERVFAIL with validation on, yet answered normally with checking disabled. So the zone is signed but something does not check out: the DS at the registrar points at a key the zone no longer publishes, or a signature has expired. Validating resolvers then refuse to answer for the whole domain.
Both are DNSKEY records. Flags 257 mark the key-signing key, whose hash the parent holds as the DS record and which signs only the key set. Flags 256 mark the zone-signing key, which signs every other record. Splitting them lets the zone key change often without touching the registrar.
RFC 4034 Appendix B defines it: the DNSKEY data (flags, protocol, algorithm and key) is added up as 16-bit numbers, the overflow is folded back in, and the low 16 bits are the tag. The page does this in your browser and uses it to find which key each DS record points at.
Still stuck? Ask about DNSSEC Checker and anybody who knows can answer. No account needed.
Same job, other tools: AAAA Record Lookup (IPv6) – Check whether a domain has an IPv6 address, and what it is · CNAME Lookup – Check where a CNAME alias points and follow the chain to its final address · AS Number Lookup – Turn an AS number into the network name, registry and allocation date · IP to ASN Lookup – Map an IP address to the ASN that announces it, with the BGP prefix.
On the related tools: Open Port Checker – See if a port forwarded on your router is reachable from the internet.