Free tool
DNSSEC checker
DNSSEC adds digital signatures to DNS answers so resolvers can detect forged responses. It is optional, valuable when supported well, and unforgiving when misconfigured. This checker looks for the delegation signer (DS) record at your parent zone.
What this checks
- DS record at the parent zone via a public DNS-over-HTTPS resolver
How to use it
- Enter your domain.
- If DNSSEC is not enabled and your DNS host supports it, turn on signing there.
- Copy the DS record to your registrar.
- Verify.
Methodology and limitations
PixelPrivate checks DS presence; it does not fully validate the signature chain. PixelPrivate performs passive checks against publicly visible configuration only. It does not test for exploitable vulnerabilities, so a clean result is not a guarantee of security. Read the full security methodology.
Key terms
- DNSSEC — DNSSEC (DNS Security Extensions) adds digital signatures to DNS answers so resolvers can detect forged or tampered responses..
Frequently asked questions
Can enabling DNSSEC break my domain?
Yes, if the DS record and the signing keys do not match. Follow your DNS host’s documented process and do not remove the DS record before disabling signing.
Keep this check running automatically
Create a free account to save results, track your score and get alerted when something changes.
Create free account