The DNSSEC Chain validator walks the delegation chain from the root zone down to the target domain, checking DS and DNSKEY records and the AD (Authenticated Data) flag to confirm whether the zone is cryptographically signed and verifiable.
Enter a domain name (example.org) and run the tool. The probe queries Cloudflare DNS-over-HTTPS for the DS and DNSKEY records and checks the authentication flag.
Input: Domain — e.g. example.org.
The result reports whether the zone is DNSSEC-signed (VALID) or unsigned (INSECURE), and lists the DS and DNSKEY records found. A VALID result means resolvers can cryptographically verify the zone's records; INSECURE means the zone has not enabled DNSSEC and is vulnerable to spoofing.
→ Confirm a zone is DNSSEC-signed after enabling signing.
→ Verify the DS at the parent matches the child’s DNSKEY after a key rollover.
→ Audit a domain’s DNSSEC chain before relying on its records.
→ Diagnose validation failures caused by a broken trust chain.
VALID means a complete chain of trust exists from the root to the zone and records are cryptographically signed. INSECURE means the zone has deliberately not enabled DNSSEC — answers are not authenticated and could be spoofed by a cache-poisoning attack.
No. DNSSEC guarantees authenticity and integrity of DNS data — that the answer really came from the zone and was not tampered with. It does not encrypt DNS queries and does not prevent zone enumeration or DDoS.
A Delegation Signer (DS) record sits in the parent zone and contains a hash of the child’s DNSKEY. It is the link that chains trust from the parent to the child; without a valid DS at the parent, the child’s signatures are not trusted.