Does my browser validate DNSSEC itself?

No. Cryptographic chain validation is done by the upstream resolver (Cloudflare 1.1.1.1). The page displays whether the resolver set AD=1 and shows the records it returned.

Is the domain I check logged?

trydevtools does not log queries. The DoH endpoint at Cloudflare may; see their privacy policy.

What does it mean if AD is not set?

Either the domain is not signed (no DNSSEC), or signing is broken (validation failed). The DS and DNSKEY readouts help distinguish the two.

Why are RRSIG records so large?

Each signed RRset has an RRSIG containing a signature over the data, plus the key tag and signer name. Large keys (RSA 2048) yield long base64 signatures.

dnssec · ds · dnskey · rrsig · cloudflare doh

Check DNSSEC on any domain

Query Cloudflare DNS-over-HTTPS for DS, DNSKEY and RRSIG records and report whether the zone is properly signed.

DNSSEC Checker

Domain

cloudflare.com

queried

Signed

—

ds/rrsig

DNSKEY

—

keys

AD flag

—

resolver

input · domain

Type a domain above and click Run check. Three parallel DoH queries fetch:

A records with the +DO bit, returning RRSIG signatures
DS — delegation signers at the parent zone
DNSKEY — published signing keys

output · records

—

Quick Start

How to verify DNSSEC

DNSSEC chains trust from the root zone down to your records using cryptographic signatures. Both DS at the parent and DNSKEY at your zone must be in place.

01
Enter the domain
Use the apex (example.com), not a subdomain — DS records sit at the delegation point.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
domainIANAregistryofflinelive
input · queryapex · IANA
```
cloudflare.com
```
loaded · IANA bundlespec · ready
02
Run the check
Three DoH queries run in parallel: A+DO, DS and DNSKEY.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
queryRFC 9110canonicalspec-compliantlive
dns · options3x · live
```
+DO bit set
```
options applied · livecanonical
03
Inspect chain
Signed zones return RRSIG/DS/DNSKEY. AD flag confirms resolver-validated.
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
recordsvalidationlintpitfallslive
chain · looked upok · ready
```
DS + DNSKEY present
```
result · livevalidated
04
Copy the summary
Share results in incident channels — includes counts and AD status.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
shareclipboardMIME-correctblobcurl-ready
ok · copiedready · done
```
✓ Copied summary
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to check DNSSEC

Migration audits, registrar issues, supply-chain checks.

Pre-launch

Verify DNSSEC is published before going live. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Registrar change

Confirm DS records survived a transfer. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Vendor audit

Spot-check a SaaS or supplier's domain hygiene. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Incident response

Rule out DNS hijacks during outages. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Key rotation

Confirm new DNSKEYs are propagated. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

Compliance

Government / .gov mandates require DNSSEC. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

Why might a domain show signed=no?

Either the zone isn't signed at the registrar, or DS records haven't been added at the parent yet — both halves are required.

What is the AD flag?

Authenticated Data — the recursive resolver validated the signature chain itself, so the response is trustworthy.

Does this validate cryptographically?

We rely on Cloudflare's resolver to validate; the AD flag indicates success. For local verification, run dig +dnssec.

How do I enable DNSSEC?

Sign your zone at the DNS host, then add the matching DS at your registrar. Most modern hosts do both with a click.

Is anything sent to a server?

Only the queried domain — sent to cloudflare-dns.com. No other tracking.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!