# DNSSEC Validator

Check DNSSEC for a domain and see the whole chain of trust from the root: the DS record at each parent, the keys of each zone, the signatures and their validity dates.

Canonical: https://tamperbox.dev/dnssec-checker

Reviewed: 2026-10-14

## Capabilities and processing

Enter a domain or paste DS and DNSKEY records. For a domain, our server asks a validating resolver for the DS, DNSKEY and RRSIG records from the root down; pasted records are read in your browser.

Each level shows the DS its parent publishes and the key it names, the zone’s keys with their tags and algorithms, and each signature’s validity window. Key tags are computed in your browser (RFC 4034) to match DS records to keys.

## Example workflow

The sample chain is valid from the root. Break it shows a DS that names no published key, an unsigned zone, expired signatures and a deprecated SHA-1 algorithm.

## Limits and interpretation

Resolver failure is reported as indeterminate. SERVFAIL that disappears with checking disabled is evidence of a likely DNSSEC failure, not a locally verified signature diagnosis. The structure is checked here; whether the signatures verify is the validating resolver’s answer (the AD flag). Sample keys are generated for the example. Nothing is stored.

## Related tools

[All tools](https://tamperbox.dev/) · [Privacy](https://tamperbox.dev/privacy)