IP y red

DNSSEC & CAA Checker

Check whether a domain is DNSSEC-signed and the chain of trust runs from the root to your keys — and which certificate authorities may issue SSL for it.

Datos clave

DNSSEC signs DNS answers so they cannot be forged: the DS record in the parent zone must match your zone’s DNSKEY. Enter a domain: we compare DS and DNSKEY, ask a validating resolver (the AD flag) and show signature expiry. CAA in the same report shows which certificate authorities may issue SSL for the domain.

Precio: Gratis
Registro: No necesario
Procesamiento: On our server: DNS-over-HTTPS queries to Cloudflare (Google as fallback) for DS, DNSKEY, RRSIG and CAA; a DS-to-key comparison and a verdict from the AD flag
Entrada: A domain (for example example.com)
Límites: No sign-up; 12 checks per minute per IP; no daily limit
Resultado: DNSSEC: whether DS exists at the registrar and DNSKEY in the zone, key tag, algorithm and hash, match, the AD flag and signature expiry; CAA: which CAs may issue SSL and where the record was found
Última actualización: 2026-10-26

DNSSEC test and CAA record lookup

This DNSSEC checker shows whether a domain is signed and whether the signature actually validates: it reads the DS record at the registrar and the DNSKEY records in the zone, matches them (key tag, algorithm, digest), checks whether a validating resolver sets the AD flag, and warns about a broken chain, obsolete algorithms and expiring signatures. The same report covers CAA — which certificate authorities may issue SSL certificates for the domain. Free, no sign-up.

DS at the registrar ↔ zone DNSKEY: key tag, algorithm, digest

AD flag and broken (bogus) DNSSEC that makes validating resolvers return SERVFAIL

Algorithms per RFC 8624, RSA key sizes, DNSKEY signature expiry

CAA: issue, issuewild, iodef and inheritance from the parent domain

Cómo usar

Enter a domain or subdomain
Read the status and the chain: root → TLD → DS → DNSKEY → AD
Fix the findings at your DNS provider or registrar

FAQ

DNSSEC adds digital signatures to DNS so a resolver can confirm an answer was not forged. It protects against DNS record spoofing but does not encrypt traffic.

The parent zone (the registrar) holds the fingerprint of an old or foreign key. Validating resolvers treat the domain as untrustworthy and return an error, so the site can vanish for some users.

AD (Authenticated Data) means a validating resolver successfully verified the signature chain. If DNSSEC is on but AD is missing, the chain probably does not validate.

CAA states which certificate authorities may issue SSL certificates for a domain. Without CAA any CA may; a wrong CAA blocks issuance from the one you need.

Not necessarily. It helps when the registrar and DNS provider support it, but a wrong setup or changing providers without coordinating DS can break the domain. Enable it deliberately.

PromoPilot frente a alternativas: comparación

Comparamos solo lo que está confirmado en las páginas de cada servicio. Donde no pudimos confirmar un dato, la celda muestra "—".

Parámetro	PromoPilot	DNSViz	Verisign DNSSEC Debugger
DS and DNSKEY comparison	✓	✓ analysis of the DNSSEC chain and configuration errors	✓ runs DNSSEC validation for the entered domain
Visual chain of trust	✗	✓ visual analysis of the authentication chain	—
CAA in the same report	✓	Not mentioned on the page	—
Free without sign-up	✓	Not stated on the page	—

Desplaza la tabla hacia los lados

Dónde somos más débiles: there is no chain graph or custom trust anchors and no cryptographic signature check of our own: the verdict rests on a Cloudflare or Google resolver’s answer.

Cuándo elegir PromoPilot: When you want a quick check that DNSSEC is enabled correctly and DS matches, plus CAA. We do not verify the signatures cryptographically ourselves; for deep chain debugging use visual analyzers.

Comprobado el: 2026-10-16. "—" significa que no está confirmado en la página oficial; las condiciones y los precios cambian, así que consulta los sitios de cada servicio.