DNSSEC & CAA Checker

Check whether a domain is DNSSEC-signed and the chain of trust runs from the root to your keys — and which certificate authorities may issue SSL for it.

Key facts

Price: Free
Sign-up: Not required
Processing: On our server: DNS-over-HTTPS to Cloudflare's validating resolver (Google as a fallback); nothing is sent to the domain's servers
Input: A domain or subdomain
Limits: 12 checks per minute, no daily cap
Output: DNSSEC status and the root → TLD → DS → DNSKEY → AD chain, DS and DNSKEY tables, signature expiry, what to fix; CAA records explained
Last updated: 2026-10-13

Alternatives

Other tools for the same job, and what each one does well:

DNSViz — Visualises the DNSSEC authentication chain from the root to the domain and lists configuration errors — the most detailed view for debugging.
Verisign DNSSEC Debugger — Walks the chain from the root to the domain step by step; you can supply your own trust anchor and name servers.
Zonemaster — A full domain health check from the root through the TLD to your name servers, including DNSSEC signatures and server reachability.
Internet.nl — Tests a website and mail domain for modern standards: IPv6, DNSSEC, HTTPS, DMARC, STARTTLS and DANE.

When to choose this tool: When you want a short "works / broken / what to fix" answer, with DS-to-DNSKEY matching and CAA in one report — in English, Russian, Ukrainian or Polish.

Descriptions checked against each tool's own site in October 2026.

DNSSEC test and CAA record lookup

This DNSSEC checker shows whether a domain is signed and whether the signature actually validates: it reads the DS record at the registrar and the DNSKEY records in the zone, matches them (key tag, algorithm, digest), checks whether a validating resolver sets the AD flag, and warns about a broken chain, obsolete algorithms and expiring signatures. The same report covers CAA — which certificate authorities may issue SSL certificates for the domain. Free, no sign-up.

DS at the registrar ↔ zone DNSKEY: key tag, algorithm, digest

AD flag and broken (bogus) DNSSEC that makes validating resolvers return SERVFAIL

Algorithms per RFC 8624, RSA key sizes, DNSKEY signature expiry

CAA: issue, issuewild, iodef and inheritance from the parent domain

How to Use

Enter a domain or subdomain
Read the status and the chain: root → TLD → DS → DNSKEY → AD
Fix the findings at your DNS provider or registrar

FAQ

Нужны три вещи: DS-запись в родительской зоне (её публикует регистратор), ключи DNSKEY в самой зоне и флаг AD в ответе проверяющего резолвера — он означает, что подписи сошлись. Инструмент проверяет все три и сверяет DS с ключами. В командной строке то же самое показывают dig +dnssec example.com и delv example.com.

У регистратора опубликована DS-запись, а ключи или подписи зоны ей не соответствуют. Резолверы с проверкой DNSSEC (Google, Cloudflare, Quad9 и многие провайдеры) в этом случае отвечают SERVFAIL, и для их пользователей домен перестаёт существовать — и сайт, и почта. Чаще всего так бывает после переезда на другой DNS-хостинг без обновления DS. Решение: опубликуйте DS нового провайдера или удалите DS у регистратора.

DNSSEC защищает от подделки DNS-ответов: без него резолвер не может отличить настоящий IP вашего сайта или MX от подставленного. Это вопрос безопасности, а не скорости или SEO. Включать проще всего у DNS-провайдера, который сам подписывает зону и меняет ключи, — тогда остаётся один раз добавить DS у регистратора. Главный риск — ошибка при переезде DNS, поэтому перед сменой провайдера DS лучше снять заранее.

CAA перечисляет удостоверяющие центры, которым разрешено выпускать сертификаты для домена, например 0 issue "letsencrypt.org". Перед выпуском центр обязан проверить CAA и отказать, если его там нет. Запись необязательна: без неё выпускать может любой центр. Добавляя CAA, перечислите все центры, которыми пользуетесь вы и ваш CDN, иначе продление сертификата не пройдёт; у поддомена без своих CAA действуют записи родительского домена.

Да, бесплатно и без регистрации, до 12 проверок в минуту, дневного лимита нет. DNS-данные мы берём у публичного проверяющего резолвера Cloudflare (запасной — Google) по DNS-over-HTTPS; к серверам вашего домена запросов нет.

How the DNSSEC chain of trust works

DNSSEC adds digital signatures to DNS records. A resolver checks them top-down: the root zone key is known in advance, the root signs the DS record of the TLD (.com, .ua, .pl), the TLD signs the DS record of your domain, and that DS points to your DNSKEY, which signs your records. Break any link and the protection is gone — and in the worst case the domain stops resolving.

Link	Where it lives	Who sets it up
DS (Delegation Signer)	In the parent zone	Your registrar — you paste the DS into its panel
DNSKEY (KSK 257 and ZSK 256)	In your zone	The DNS provider that signs the zone
RRSIG	Next to every record set	The signing DNS server, refreshed regularly
AD flag	In the resolver's answer	Set by the resolver when every signature checks out

What the statuses mean

DNSSEC is enabled and valid — the DS matches a zone key and a validating resolver sets the AD flag.
DNSSEC is not enabled — no DS and no DNSKEY. The domain works, just without protection against forged answers.
Signed, but no DS at the registrar — the provider signs the zone but the chain is open. Copy the DS from your DNS provider to the registrar.
DNSSEC is broken — a DS exists but matches no key, or signatures fail. Validating resolvers return SERVFAIL and the domain is unreachable for their users. The most common cause is moving to another DNS host without updating the DS.

How to turn DNSSEC on or off safely

Enable zone signing at your DNS provider (often a single switch) and wait until the DNSKEY records show up here.
Copy the DS (key tag, algorithm, digest type, digest) into your registrar's panel.
An hour or two later check the domain here: you should see "enabled and valid" and the AD flag.
Moving to a new DNS host? Remove the DS at the registrar first, wait for its TTL to expire (usually up to a day), then change the name servers. Re-enable DNSSEC after the move.

Modern algorithms are ECDSAP256SHA256 (13) and ED25519 (15); RSASHA256 (8) is fine too. SHA-1 based algorithms (5, 7) are not recommended by RFC 8624, and a DS with a SHA-1 digest (type 1) should be replaced with SHA-256 (type 2).

CAA: who may issue certificates

A CAA record limits which certificate authorities may issue an SSL certificate for the domain:

example.com.  CAA 0 issue "letsencrypt.org"
example.com.  CAA 0 issuewild ";"
example.com.  CAA 0 iodef "mailto:[email protected]"

issue — who may issue regular certificates; ";" means nobody.
issuewild — a separate rule for wildcards (*.example.com); without it, issue applies.
iodef — where a CA can report a request that violates CAA.

A name without its own CAA records inherits those of the closest parent domain. Before adding CAA, list every CA that you and your CDN or host use (some CDNs use several), or automatic certificate renewals will start failing.