AltF DomainOps

DNSSEC check: signed, delegated and validating

DNSSEC signs DNS answers so they cannot be forged on the way to the user. A domain is protected only when three things line up: the zone publishes DNSKEY records, the registry holds a matching DS record, and resolvers validate the chain. DomainOps checks all three and flags a broken chain, which can take a domain offline for validating resolvers.

  • Free, no sign-up
  • Real DNS, RDAP and TLS data
  • Raw records shown
  • No affiliate links
Check a domain

The three states

  • Signed and validating: DS at the parent, DNSKEY in the zone, resolver sets the AD flag.
  • Signed but not delegated: DNSKEY exists but no DS at the registry, so nobody checks it.
  • Broken: DS exists but does not match any DNSKEY. Validating resolvers return SERVFAIL and the domain disappears for their users.

Turning DNSSEC on safely

  • Enable signing at your DNS host first and wait for DNSKEY to appear here.
  • Copy the DS record (key tag, algorithm, digest type, digest) to your registrar.
  • Check again: the health report should show DNSSEC as passing.
  • Before moving DNS hosts, remove the DS first, wait a day, then move, then re-enable.

DNSSEC check: questions and answers

Will DNSSEC slow my site down?

Not noticeably. Answers are slightly larger and validating resolvers do a little more work, but responses are cached like any other.

Why did my domain stop working after changing DNS host?

If the old DS record is still at the registry, validating resolvers reject the new, differently signed zone. Remove or update the DS record at your registrar.

Focused checks and guides

Checks

Full domain health checkAll nine tools, the record glossary and how each check works.DNS lookupFree DNS lookup for A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, DS, DNSKEY and HTTPS records, with TTLs, DNSSEC status and what each record means.MX lookupFree MX record lookup: see a domain's mail servers in priority order, which email provider runs them, and whether SPF and DMARC are set.NS lookupFree nameserver lookup: see which nameservers answer for a domain, who the DNS host is, the SOA serial, and whether the zone is DNSSEC-signed.TXT record lookupFree TXT record lookup that labels each record: SPF, Google and Microsoft verification, Meta, Apple, Stripe and 25 more services, plus DMARC and DKIM.SSL certificate checkFree live SSL checker: connect to any site and see its certificate issuer, expiry date and days left, covered hostnames, chain trust and TLS version.Domain expiry checkCheck when a domain expires from the registry's own RDAP data: expiry date, days left, registrar, transfer lock and status codes in plain English.Reverse DNS lookupFree reverse DNS lookup for IPv4 and IPv6: find the PTR hostname of an IP address and the network owner from the regional internet registry.CAA record checkLook up a domain's CAA records to see which certificate authorities may issue certificates, including wildcard and reporting rules, with fixes.

Guides

Domain launch checklistA 20-point checklist to launch a new domain: DNS records, www, HTTPS, email authentication, DNSSEC, CAA, registrar lock, with a free check for each step.Website migration DNS checklistMove a website or DNS to a new host without downtime: lower TTLs, copy records, switch nameservers, watch resolvers, handle DNSSEC and email.Email domain setup guideSet up email for your domain the right way: MX records, one SPF record under 10 lookups, DKIM keys, a DMARC rollout plan, MTA-STS and BIMI.

25 more free domain and DNS tools

Single-purpose AltFTool tools for one job each, grouped by what you are trying to do.

Lookups

One question, one answer.

Write records

Generate correct records before you paste them into your DNS host.

Certificates and HTTPS

Go deeper than the live certificate check.

See all 25 tools

AltFTool does not store the domains or addresses you check. DNS lookups in the DNS, compare, email and IP tools run from your browser; registration, report and certificate checks pass through AltFTool's server and keep nothing.