~/tools / dnssec-checker

DNSSEC Checker

Check whether a domain has DNSSEC signing enabled. Shows DNSKEY presence at the domain and DS presence at the parent zone — both are required for a valid chain of trust.

>
[ WARNING ] DNSKEY found but no DS record at parent — delegation chain incomplete.
── output ─────
Signed overall
[ NO ]
DNSKEY
[ 3 records ]
DS (parent)
[ 0 records ]
// Full chain validation (RRSIG, DS hashes, algorithm support) not performed here — use DNSViz or Verisign Labs for deep analysis.
// Save bild.de → we'll run this daily and alert on changes. /signup →