NexaYori Tools DNSSEC chainHelp
DNSSEC chain
Try: cloudflare.com · ietf.org · dnssec-failed.org
ietf.org A is secure
  1. . Secure
    Trust anchors: 20326 RSASHA256, 38696 RSASHA256 → matches key 20326, 38696
    Keys: 8763 ZSK RSASHA256 2048-bit · 20326 KSK RSASHA256 2048-bit · 38696 KSK RSASHA256 2048-bit
    Key set signed by 38696, signature valid until 2026-11-21
  2. org. Secure
    DS: 725 RSASHA256, 26974 RSASHA256 → matches key 725, 26974
    Keys: 25488 ZSK RSASHA256 1024-bit · 11859 ZSK RSASHA256 1024-bit · 24060 ZSK RSASHA256 1024-bit · 725 KSK RSASHA256 2048-bit · 26974 KSK RSASHA256 2048-bit
    Key set signed by 26974, signature valid until 2026-11-22
  3. ietf.org. Secure
    DS: 2371 ECDSAP256SHA256 → matches key 2371
    Keys: 34505 ZSK ECDSAP256SHA256 256-bit · 2371 KSK ECDSAP256SHA256 256-bit
    Key set signed by 2371, signature valid until 2026-12-27
  4. ietf.org A Secure
    104.16.44.99
    104.16.45.99
    Signed by key 34505
Every signature is verified here against the IANA root keys, not just taken from a resolver’s “validated” flag. Unsigned delegations show as insecure; NSEC/NSEC3 denial proofs aren’t checked. Terminal: curl "…/dnssec?q=example.com"