IP e rede

DNSSEC & CAA Checker

Check whether a domain is DNSSEC-signed and the chain of trust runs from the root to your keys — and which certificate authorities may issue SSL for it.

Fatos principais

DNSSEC signs DNS answers so they cannot be forged: the DS record in the parent zone must match your zone’s DNSKEY. Enter a domain: we compare DS and DNSKEY, ask a validating resolver (the AD flag) and show signature expiry. CAA in the same report shows which certificate authorities may issue SSL for the domain.

Preço: Grátis
Cadastro: Não é necessário
Processamento: On our server: DNS-over-HTTPS queries to Cloudflare (Google as fallback) for DS, DNSKEY, RRSIG and CAA; a DS-to-key comparison and a verdict from the AD flag
Entrada: A domain (for example example.com)
Limites: No sign-up; 12 checks per minute per IP; no daily limit
Resultado: DNSSEC: whether DS exists at the registrar and DNSKEY in the zone, key tag, algorithm and hash, match, the AD flag and signature expiry; CAA: which CAs may issue SSL and where the record was found
Última atualização: 2026-10-26

DNSSEC test and CAA record lookup

This DNSSEC checker shows whether a domain is signed and whether the signature actually validates: it reads the DS record at the registrar and the DNSKEY records in the zone, matches them (key tag, algorithm, digest), checks whether a validating resolver sets the AD flag, and warns about a broken chain, obsolete algorithms and expiring signatures. The same report covers CAA — which certificate authorities may issue SSL certificates for the domain. Free, no sign-up.

DS at the registrar ↔ zone DNSKEY: key tag, algorithm, digest

AD flag and broken (bogus) DNSSEC that makes validating resolvers return SERVFAIL

Algorithms per RFC 8624, RSA key sizes, DNSKEY signature expiry

CAA: issue, issuewild, iodef and inheritance from the parent domain

Como usar

Enter a domain or subdomain
Read the status and the chain: root → TLD → DS → DNSKEY → AD
Fix the findings at your DNS provider or registrar

FAQ

DNSSEC adds digital signatures to DNS so a resolver can confirm an answer was not forged. It protects against DNS record spoofing but does not encrypt traffic.

The parent zone (the registrar) holds the fingerprint of an old or foreign key. Validating resolvers treat the domain as untrustworthy and return an error, so the site can vanish for some users.

AD (Authenticated Data) means a validating resolver successfully verified the signature chain. If DNSSEC is on but AD is missing, the chain probably does not validate.

CAA states which certificate authorities may issue SSL certificates for a domain. Without CAA any CA may; a wrong CAA blocks issuance from the one you need.

Not necessarily. It helps when the registrar and DNS provider support it, but a wrong setup or changing providers without coordinating DS can break the domain. Enable it deliberately.

PromoPilot vs. alternativas: comparação

Comparamos apenas o que está confirmado nas páginas de cada serviço. Onde não conseguimos confirmar um dado, a célula mostra "—".

Parâmetro	PromoPilot	DNSViz	Verisign DNSSEC Debugger
DS and DNSKEY comparison	✓	✓ analysis of the DNSSEC chain and configuration errors	✓ runs DNSSEC validation for the entered domain
Visual chain of trust	✗	✓ visual analysis of the authentication chain	—
CAA in the same report	✓	Not mentioned on the page	—
Free without sign-up	✓	Not stated on the page	—

Role a tabela para os lados

Onde somos mais fracos: there is no chain graph or custom trust anchors and no cryptographic signature check of our own: the verdict rests on a Cloudflare or Google resolver’s answer.

Quando escolher o PromoPilot: When you want a quick check that DNSSEC is enabled correctly and DS matches, plus CAA. We do not verify the signatures cryptographically ourselves; for deep chain debugging use visual analyzers.

Verificado em: 2026-10-16. "—" significa que não foi confirmado na página oficial; condições e preços mudam, então confira os sites dos próprios serviços.