DNSSEC Inspector
Inspect DNSKEY, DS, RRSIG, NSEC, and NSEC3PARAM records.
Explicit network action
Inspect public DNSSEC records
No request made
Nothing is queried until you submit
Use a delegation snapshot to compare returned DS references with DNSKEY key tags, or inspect one DNSSEC record type.
No network request
Local record inspector
0 / 8,192 characters
Working notes
Use DNSSEC Inspector with the boundary visible.
DNSSEC Inspector retrieves bounded DNSKEY, DS, RRSIG, NSEC, or NSEC3PARAM answers through the disclosed Cloudflare DNS-over-HTTPS resolver and parses their presentation fields locally.
What is DNSSEC Inspector?
DNSSEC (Domain Name System Security Extensions) adds a layer of cryptographic authentication to DNS responses. Without DNSSEC, DNS responses can be spoofed — an attacker can forge a response that redirects traffic to a malicious server (DNS cache poisoning). DNSSEC prevents this by signing DNS records with cryptographic keys and publishing the signatures alongside the records. The system works through a chain of trust: the root zone signs the TLD zones, the TLD zones sign the domain zones, and each zone signs its own records. The key record types are DNSKEY (public keys used for signing), DS (Delegation Signer — links a child zone key to the parent zone), RRSIG (the actual signatures over record sets), and NSEC/NSEC3 (authenticated denial of existence — proving that a record does not exist). This inspector retrieves and parses these DNSSEC records for any domain, showing key tags, algorithms, signature validity periods, and delegation status. It helps you verify that DNSSEC is properly configured for a domain without running command-line tools like dig or delv.
When to use it
- Verifying DNSSEC deployment — check that a domain has published DNSKEY and DS records and that the delegation chain is intact.
- Debugging DNSSEC failures — inspect RRSIG expiration dates, algorithm mismatches, and missing DS records that cause validation failures.
- Auditing key rollovers — verify that both the old and new DNSKEY records are published during a key rollover period.
- Checking algorithm support — inspect the signing algorithms (RSA/SHA-256, ECDSA P-256, Ed25519) used by a domain to ensure modern, supported algorithms.
- Investigating NSEC/NSEC3 configuration — check whether a domain uses NSEC (which allows zone walking) or NSEC3 (which provides hashed denial of existence).
How to use it
- 01Enter a public domain and choose a DNSKEY + DS delegation snapshot or one DNSSEC record type.
- 02Review the exact query count and provider disclosure, then run the explicit lookup.
- 03Inspect returned fields and cautious findings, or paste RDATA directly into the no-network local inspector.
Common mistakes
- Confusing AD flag with full validation — the AD (Authenticated Data) flag in DNS responses indicates that the recursive resolver validated the response, not that you have independently verified it.
- Expired RRSIG signatures — DNSSEC signatures have inception and expiration dates. If the signing system fails to re-sign records before expiration, the entire zone becomes unresolvable.
- Missing DS records — a DNSKEY without a corresponding DS record in the parent zone means the chain of trust is broken. The domain may have DNSSEC keys but no working validation.
- Algorithm mismatch — the DS record in the parent zone must reference a DNSKEY that exists in the child zone with matching key tag and algorithm.
- KSK vs ZSK confusion — Key Signing Keys (flag 257) sign DNSKEY sets and are referenced by DS records. Zone Signing Keys (flag 256) sign all other record types. Both must be present for DNSSEC to function.
Synthetic example
Synthetic DNSKEY
Input
256 3 8 AQIDBA==
Result
Zone Key · protocol 3 · RSA/SHA-256 · calculated key tag 2062
Related standards
Limits and data boundary
- A delegation snapshot sends two parallel GET requests; single-record modes send one. Cloudflare receives each queried name and type plus normal connection metadata.
- The resolver AD bit is provider-reported. StackCache does not independently validate signatures, DS digests, denial proofs, or a chain of trust.
- Matching a DS key tag and algorithm to a DNSKEY is a useful reference check, not cryptographic digest verification or proof that a domain is securely delegated.
Frequently asked questions
- What is DNSSEC?
- DNSSEC adds cryptographic signatures to DNS records so resolvers can verify that responses have not been tampered with. It uses DNSKEY, DS, and RRSIG records to build a chain of trust from the root zone.
- What is a DNSKEY record?
- A DNSKEY record publishes the public key used to sign DNS records for a zone. It includes the key tag, algorithm, and flags that indicate whether it is a Zone Signing Key (ZSK) or Key Signing Key (KSK).
- Does this tool verify the DNSSEC chain of trust?
- No. It retrieves and parses DNSSEC records but does not perform independent cryptographic validation of signatures, DS digests, or the full chain of trust.
Keep working