NexaYori Tools DNSSEC chainHelp
DNSSEC chain
Try: cloudflare.com · ietf.org · dnssec-failed.org
cloudflare.com A is secure
  1. . Secure
    Trust anchors: 20326 RSASHA256, 38696 RSASHA256 → matches key 20326, 38696
    Keys: 8763 ZSK RSASHA256 2048-bit · 20326 KSK RSASHA256 2048-bit · 38696 KSK RSASHA256 2048-bit
    Key set signed by 38696, signature valid until 2026-11-21
  2. com. Secure
    DS: 19718 ECDSAP256SHA256 → matches key 19718
    Keys: 65344 ZSK ECDSAP256SHA256 256-bit · 19718 KSK ECDSAP256SHA256 256-bit
    Key set signed by 19718, signature valid until 2026-11-18
  3. cloudflare.com. Secure
    DS: 2371 ECDSAP256SHA256 → matches key 2371
    Keys: 34505 ZSK ECDSAP256SHA256 256-bit · 2371 KSK ECDSAP256SHA256 256-bit
    Key set signed by 2371, signature valid until 2026-12-13
  4. cloudflare.com A Secure
    104.16.132.229
    104.16.133.229
    Signed by key 34505
Every signature is verified here against the IANA root keys, not just taken from a resolver’s “validated” flag. Unsigned delegations show as insecure; NSEC/NSEC3 denial proofs aren’t checked. Terminal: curl "…/dnssec?q=example.com"