NexaYori Tools DNSSEC chainHelp
DNSSEC chain
Try: cloudflare.com · ietf.org · dnssec-failed.org
dnssec-failed.org A is bogus
  1. . Secure
    Trust anchors: 20326 RSASHA256, 38696 RSASHA256 → matches key 20326, 38696
    Keys: 8763 ZSK RSASHA256 2048-bit · 20326 KSK RSASHA256 2048-bit · 38696 KSK RSASHA256 2048-bit
    Key set signed by 38696, signature valid until 2026-11-21
  2. org. Secure
    DS: 725 RSASHA256, 26974 RSASHA256 → matches key 725, 26974
    Keys: 25488 ZSK RSASHA256 1024-bit · 11859 ZSK RSASHA256 1024-bit · 24060 ZSK RSASHA256 1024-bit · 725 KSK RSASHA256 2048-bit · 26974 KSK RSASHA256 2048-bit
    Key set signed by 26974, signature valid until 2026-11-22
  3. dnssec-failed.org A Bogus
    96.99.227.255
    Signature doesn’t verify (no DNSKEY with tag 32784)
Every signature is verified here against the IANA root keys, not just taken from a resolver’s “validated” flag. Unsigned delegations show as insecure; NSEC/NSEC3 denial proofs aren’t checked. Terminal: curl "…/dnssec?q=example.com"