[{"data":1,"prerenderedAt":53},["ShallowReactive",2],{"tool-guide:dnssec-inspector":3},{"overview":4,"whatIs":5,"useCases":6,"commonMistakes":12,"relatedStandards":18,"steps":31,"example":35,"limitations":39,"faq":43},"DNSSEC Inspector retrieves bounded DNSKEY, DS, RRSIG, NSEC, or NSEC3PARAM answers through the disclosed Cloudflare DNS-over-HTTPS resolver and parses their presentation fields locally.","DNSSEC (Domain Name System Security Extensions) adds a layer of cryptographic authentication to DNS responses. Without DNSSEC, DNS responses can be spoofed — an attacker can forge a response that redirects traffic to a malicious server (DNS cache poisoning). DNSSEC prevents this by signing DNS records with cryptographic keys and publishing the signatures alongside the records. The system works through a chain of trust: the root zone signs the TLD zones, the TLD zones sign the domain zones, and each zone signs its own records. The key record types are DNSKEY (public keys used for signing), DS (Delegation Signer — links a child zone key to the parent zone), RRSIG (the actual signatures over record sets), and NSEC\u002FNSEC3 (authenticated denial of existence — proving that a record does not exist). This inspector retrieves and parses these DNSSEC records for any domain, showing key tags, algorithms, signature validity periods, and delegation status. It helps you verify that DNSSEC is properly configured for a domain without running command-line tools like dig or delv.",[7,8,9,10,11],"Verifying DNSSEC deployment — check that a domain has published DNSKEY and DS records and that the delegation chain is intact.","Debugging DNSSEC failures — inspect RRSIG expiration dates, algorithm mismatches, and missing DS records that cause validation failures.","Auditing key rollovers — verify that both the old and new DNSKEY records are published during a key rollover period.","Checking algorithm support — inspect the signing algorithms (RSA\u002FSHA-256, ECDSA P-256, Ed25519) used by a domain to ensure modern, supported algorithms.","Investigating NSEC\u002FNSEC3 configuration — check whether a domain uses NSEC (which allows zone walking) or NSEC3 (which provides hashed denial of existence).",[13,14,15,16,17],"Confusing AD flag with full validation — the AD (Authenticated Data) flag in DNS responses indicates that the recursive resolver validated the response, not that you have independently verified it.","Expired RRSIG signatures — DNSSEC signatures have inception and expiration dates. If the signing system fails to re-sign records before expiration, the entire zone becomes unresolvable.","Missing DS records — a DNSKEY without a corresponding DS record in the parent zone means the chain of trust is broken. The domain may have DNSSEC keys but no working validation.","Algorithm mismatch — the DS record in the parent zone must reference a DNSKEY that exists in the child zone with matching key tag and algorithm.","KSK vs ZSK confusion — Key Signing Keys (flag 257) sign DNSKEY sets and are referenced by DS records. Zone Signing Keys (flag 256) sign all other record types. Both must be present for DNSSEC to function.",[19,22,25,28],{"title":20,"url":21},"RFC 4033 — DNSSEC Introduction","https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Fhtml\u002Frfc4033",{"title":23,"url":24},"RFC 4034 — DNSSEC Resource Records","https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Fhtml\u002Frfc4034",{"title":26,"url":27},"RFC 4035 — DNSSEC Protocol Modifications","https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Fhtml\u002Frfc4035",{"title":29,"url":30},"RFC 5155 — NSEC3 Hashed Authenticated Denial","https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Fhtml\u002Frfc5155",[32,33,34],"Enter a public domain and choose a DNSKEY + DS delegation snapshot or one DNSSEC record type.","Review the exact query count and provider disclosure, then run the explicit lookup.","Inspect returned fields and cautious findings, or paste RDATA directly into the no-network local inspector.",{"label":36,"input":37,"output":38},"Synthetic DNSKEY","256 3 8 AQIDBA==","Zone Key · protocol 3 · RSA\u002FSHA-256 · calculated key tag 2062",[40,41,42],"A delegation snapshot sends two parallel GET requests; single-record modes send one. Cloudflare receives each queried name and type plus normal connection metadata.","The resolver AD bit is provider-reported. StackCache does not independently validate signatures, DS digests, denial proofs, or a chain of trust.","Matching a DS key tag and algorithm to a DNSKEY is a useful reference check, not cryptographic digest verification or proof that a domain is securely delegated.",[44,47,50],{"question":45,"answer":46},"What is DNSSEC?","DNSSEC adds cryptographic signatures to DNS records so resolvers can verify that responses have not been tampered with. It uses DNSKEY, DS, and RRSIG records to build a chain of trust from the root zone.",{"question":48,"answer":49},"What is a DNSKEY record?","A DNSKEY record publishes the public key used to sign DNS records for a zone. It includes the key tag, algorithm, and flags that indicate whether it is a Zone Signing Key (ZSK) or Key Signing Key (KSK).",{"question":51,"answer":52},"Does this tool verify the DNSSEC chain of trust?","No. It retrieves and parses DNSSEC records but does not perform independent cryptographic validation of signatures, DS digests, or the full chain of trust.",1788868141347]