A parent-zone record that points to the child zone signing key.
DNS security
DNSSEC checker
Check DS and DNSKEY records and ask a validating public resolver whether the domain's DNSSEC chain authenticates correctly.
Quick guide
What DNSSEC protects
DNSSEC adds cryptographic signatures to DNS so validating resolvers can detect forged or altered answers. A normal chain of trust links a parent DS record to DNSKEY records in the child zone.
DNSSEC does not encrypt DNS traffic or make a website itself secure. It authenticates DNS data.
The public keys published by the signed DNS zone.
A validating resolver authenticated the signed response through the chain of trust.
IPGetter checks DS and DNSKEY records and asks a validating public resolver whether the signed DNS chain can be authenticated.
- Confirming DNSSEC is actually validating
- Troubleshooting broken signing after DNS changes
- Checking whether a zone has the expected signing material
Terminal shortcut
Prefer the command line?
Check DNSSEC validation from the Terminal.
> dnssec example.com
Run in Terminal ->