DNSSEC Check
Signed and valid? DS matching? When do signatures expire? One table, with suggested fixes.
FAQ
What is DNSSEC?
Digital signatures on DNS records so resolvers can verify answers were not tampered with. The parent (registry) holds DS records; the domain's DNS servers publish DNSKEYs and signatures.
Is "not signed" a problem?
It does not break anything; the domain just lacks tamper protection. You can enable signing at your DNS provider and then add the DS at your registrar.
What happens when validation fails?
Validating resolvers (many public and ISP resolvers) return SERVFAIL, so the site and mail stop working for those users. Fix it promptly.
How is the check done?
A validating recursive resolver gives the verdict, and DS, DNSKEY and RRSIG are queried directly from the parent and authoritative servers to compare digests and validity dates.
Migrate to 189DNS in one click
Send the domains you just checked straight to the 189DNS console. Zones are created and existing records imported for you, no retyping.