Follow the chain of trust from the root to a name, and see the link that breaks it.
Example
Chain of trust
Findings
Capabilities and processing
Enter a domain or paste DS and DNSKEY records. For a domain, our server asks a validating resolver for the DS, DNSKEY and RRSIG records from the root down; pasted records are read in your browser.
Each level shows the DS its parent publishes and the key it names, the zone’s keys with their tags and algorithms, and each signature’s validity window. Key tags are computed in your browser (RFC 4034) to match DS records to keys.
Example workflow
The sample chain is valid from the root. Break it shows a DS that names no published key, an unsigned zone, expired signatures and a deprecated SHA-1 algorithm.
Limits and interpretation
Resolver failure is reported as indeterminate. SERVFAIL that disappears with checking disabled is evidence of a likely DNSSEC failure, not a locally verified signature diagnosis. The structure is checked here; whether the signatures verify is the validating resolver’s answer (the AD flag). Sample keys are generated for the example. Nothing is stored.