DNSSEC check
The DNSSEC check validates the chain of trust from the root down to the domain, signatures included, and explains each error with the next step.
The DNSSEC-Prüfung (DNSSEC check) validates the chain from the root zone down to your domain on its own, level by level and with its own cryptography. It doesn’t rely on a resolver’s AD flag. The tool needs a license.
How to check
Type the domain into Domain and click Prüfen (check). The resolver picker next to it decides which resolver the data is fetched through. The app sets the CD bit, so the resolver hands out the data even when its own validation fails. That’s the only way to examine a broken chain at all.
What gets checked
- The app finds the zone cuts; for
www.example.comthat’s the root,comandexample.com. - For the root, the official trust anchors (KSK-2017 and KSK-2024) are the starting point.
- For every zone below: the DS record in the parent zone, the signature over the DS, whether a DNSKEY of the zone matches the DS, and whether the DNSKEY RRset is validly signed.
- Finally the signature over the domain’s A record. If there isn’t one, the app checks the zone’s SOA instead.
It also rates the algorithms in use and when the signatures expire.
The tables
Vertrauenskette (chain of trust) shows, per zone, the DS (key tag, algorithm, digest), the DNSKEYs (KSK or ZSK with key tag) and the status:
| Status | Meaning |
|---|---|
| gültig (valid) | This level is correctly anchored and signed. |
| unsigniert (unsigned) | No DS and no keys; the zone doesn’t use DNSSEC. |
| signiert, ohne DS (signed, no DS) | The zone is signed, but the parent zone doesn’t know the key. |
| DS passt nicht (DS doesn’t match) | No DNSKEY of the zone matches the DS. |
| Signatur ungültig (signature invalid) | The DNSKEY RRset isn’t validly signed. |
| fehlerhaft (faulty) | A DS exists, but the zone publishes no keys. |
| nicht prüfbar (not checkable) | An algorithm the app can’t verify cryptographically. |
| unsicher / nicht geprüft (insecure / not checked) | Levels below an unsigned or broken level. |
Signaturen (signatures) lists every signature checked, with RRset, key, algorithm, expiry date (Gültig bis, valid until) and result.
Findings and what to do
| Finding | What to do |
|---|---|
| DNSSEC-Kette gültig (chain valid) | Nothing. Every level is correctly signed. |
| … ist nicht mit DNSSEC gesichert (not secured with DNSSEC, warning) | Your domain doesn’t use DNSSEC. Enable DNSSEC at your DNS host and add the DS record at your registrar. |
| Keine DNSSEC-Vertrauenskette ab … (no chain of trust from …, note) | A parent zone isn’t signed. You have no influence on that. |
| DNSSEC-Kette gebrochen (chain broken, error) | Validating resolvers such as 1.1.1.1, 8.8.8.8 or 9.9.9.9 return SERVFAIL. For many users the domain is then unreachable. The findings below name the cause. Act immediately. |
| … ist signiert, aber ohne DS in der Elternzone (signed but no DS in parent, warning) | The signature has no effect. Add the DS or DNSKEY at the registrar. |
| DS vorhanden, aber keine DNSKEYs (DS present, no DNSKEYs, error) | Typical when DNSSEC was switched off at the host but the DS stayed at the registrar. Remove the DS or re-enable DNSSEC. |
| kein DNSKEY passt zum DS (no DNSKEY matches the DS, error) | Usually after a key rollover or provider change without updating the DS. Enter the current DS at the registrar. |
| DNSKEY-RRset nicht gültig signiert (DNSKEY RRset not validly signed, error) | The signature has expired or is wrong. Check the signing at your DNS host. |
| DS-Record von … nicht gültig signiert (DS not validly signed, error) | A problem in the parent zone. |
| … nicht gültig signiert (not validly signed, error) | The signature over the checked A or SOA RRset doesn’t verify. |
| DS von … nutzt SHA-1 (DS uses SHA-1, warning) | SHA-1 is considered outdated. Add a DS with SHA-256 at the registrar and remove the SHA-1 DS. |
| unsicherer Algorithmus … (insecure algorithm, error) | Re-sign the zone with algorithm 13 (ECDSA P-256) or 8 (RSA/SHA-256). |
| veralteter Algorithmus … (deprecated algorithm, warning) | SHA-1-based signatures are no longer validated everywhere. Switch to algorithm 13 or 8. |
| Algorithmus … hier nicht prüfbar (algorithm not checkable here, note) | The signatures aren’t verified cryptographically. Not a fault of the domain. |
| abgelaufene DNSKEY-Signatur (expired DNSKEY signature, warning) | At least one signature has expired; another valid one still carries the chain. |
| Signatur läuft in … Stunden ab (signature expires in … hours, warning) | Less than 7 days until expiry. Normally the signer renews in time. Check that automatic re-signing is running. |
| Nächster Signaturablauf (next signature expiry, note) | Date of the next signature to expire. |
| … existiert nicht (NXDOMAIN) (doesn’t exist, note) | The name doesn’t exist. The app doesn’t check the proof of non-existence (NSEC/NSEC3); it checks the zone’s SOA instead. |
Good to know
- A broken chain is worse than no DNSSEC. If you want to switch DNSSEC off, first remove the DS at the registrar, wait out its TTL and only then stop signing.
- After a provider change, run the check right after the move. A forgotten old DS is the most common mistake.
- With watching, the app checks DNSSEC regularly and notifies you as soon as the result changes.