Help / DNSSEC chain
DNSSEC chain
Walks the DNSSEC chain of trust from the root down to your record and verifies every signature itself, showing exactly where a chain breaks.
How to use it
- Type a domain and pick a record type.
- Press Validate. Each zone (root, top-level domain, your domain) gets a status.
Reading the results
- Secure
- Every link verified: trust anchor → DS → DNSKEY → signature.
- Insecure
- The chain stops because a zone isn’t signed (no DS at the parent). Not an error, just unprotected.
- Bogus
- Something is signed but doesn’t verify: resolvers that check DNSSEC will refuse the answer.
- DS
- A fingerprint of a zone’s key, published by the parent zone.
- DNSKEY / KSK / ZSK
- The zone’s public keys. The key-signing key signs the key set; the zone-signing key signs records.
- Trust anchors
- The root’s keys, published by IANA. Everything is checked against these.
Examples
- cloudflare.com Fully secure chain
- ietf.org Secure
- dnssec-failed.org Deliberately broken (bogus)
From the command line
curl "https://tools.nexayori.com/dnssec?q=cloudflare.com" curl "https://tools.nexayori.com/dnssec?q=cloudflare.com&format=json"
| q | Domain |
| type | A (default), AAAA, MX, TXT, NS, SOA, CAA |
| format | text, json or html |
Questions
My site works but this says bogus?
Resolvers that don’t validate DNSSEC still answer, but many large ones (1.1.1.1, 8.8.8.8, Quad9) will fail. Fix it soon: usually a stale DS record at the registrar.
Which algorithms are supported?
RSA (SHA-1/256/512), ECDSA P-256/P-384 and Ed25519.
Limitations
- Proofs that a record doesn’t exist (NSEC/NSEC3) aren’t checked.