Is your DNS signed?
Enter a domain to see whether DNSSEC is enabled, responses are authenticated and DS/DNSKEY records exist.
About this tool
DNSSEC digitally signs DNS records to prevent forgery and cache poisoning (DNS spoofing). When DNSSEC is enabled, resolvers can be sure the answer they receive hasn't been tampered with. This tool checks for a valid signature (the AD flag) and for DS and DNSKEY records.
Frequently asked questions
What is DNSSEC?
A security layer that digitally signs DNS records to prevent forgery and tampering.
What does the AD flag mean?
Authenticated Data — the resolver was able to verify the DNSSEC signature of the response.
How do I enable DNSSEC?
Turn it on in your DNS panel and register the DS record with your domain registrar; ServerNet can guide you.
Need help fixing this?
ServerNet's team sets up DNS, email, SSL and servers for you — fast, reliable and fully managed.