DNSSEC test
Check whether a domain has DNSSEC configured, and whether it actually validates end-to-end.
Checked via DNS-over-HTTPS, since DNSKEY/DS records aren't queryable through a plain DNS Lookup.
Enter a domain to test DNSSEC
Whether signing keys exist and whether the chain of trust actually validates.
DNSSEC adds cryptographic signatures to DNS records, allowing a resolver to verify that the response it received has not been altered in transit. This closes off a class of attack — including cache poisoning and spoofed responses — that plain DNS has no defense against. A domain enables DNSSEC by publishing signing keys (DNSKEY) and registering a corresponding DS record with its registrar, which links it into the parent zone's chain of trust.
Publishing keys is not the same as validating correctly. A domain can publish DNSKEY records and still be misconfigured if the DS record at the registrar does not match, breaking the chain of trust. This is a worse state than not deploying DNSSEC at all, since validating resolvers may refuse to resolve the domain entirely rather than ignore the broken signature.
Most sites do not require DNSSEC, but it is relevant for domains that are high-value targets or frequently impersonated, where DNS-level spoofing carries real consequences.