dnsprobe v1
Tools / DNSSEC

DNSSEC chain validator

Walks the trust chain from the root down to the target domain. A verdict of secure means RRSIGs validated against a trusted DNSKEY. insecure means the zone is unsigned. bogus means a broken or tampered chain.

$

How the validator works

dnsprobe walks the DNSSEC chain of trust from the root zone down to your domain. At every delegation it fetches the DS record from the parent, the DNSKEY set from the child, and verifies the RRSIG signatures over each record set. If every link validates, the verdict is secure. If a zone in the path is simply unsigned, the verdict is insecure — no DNSSEC, but not an error. If a signature is missing, expired, or a DS digest does not match the child's key, the chain is broken and the verdict is bogus.

What secure, insecure and bogus mean

  • secure — the full chain from root to domain validated. Answers are cryptographically authenticated and cannot be spoofed in transit.
  • insecure — the zone is not signed. It resolves normally; there is just no DNSSEC protection. This is the default for most domains.
  • bogus — the zone claims to be signed but validation failed. Validating resolvers (1.1.1.1, 8.8.8.8, most ISPs) return SERVFAIL, so the domain is effectively down for those users. Bogus is an emergency, not a warning.

Common DNSSEC failures and how to fix them

  • Missing DS at the registrar. You signed the zone but never uploaded the DS record to your registrar. The child is signed, the parent doesn't vouch for it → often reported as insecure or bogus depending on the resolver. Fix: copy the DS from your DNS provider into the registrar's DNSSEC panel.
  • DS / DNSKEY mismatch. The DS at the parent points to a KSK that no longer exists — usually after a key rollover done without updating the DS. Fix: publish a DS that matches the current KSK and wait out the old DS TTL before removing the old key.
  • Expired RRSIG. Signatures have a validity window. If your signer stopped re-signing the zone, the RRSIGs expire and the zone goes bogus even though nothing else changed. Fix: confirm automatic re-signing is running.
  • Algorithm mismatch. The parent DS uses a digest or algorithm the child no longer publishes. Fix: align the DS digest type with what the zone signs with.

DNSSEC FAQ

What does a "bogus" DNSSEC result mean? →

Bogus means the chain of trust is broken or tampered: a signature is missing, expired, or a DS digest does not match the zone's DNSKEY. Validating resolvers such as 1.1.1.1 and 8.8.8.8 return SERVFAIL for a bogus domain, so it becomes unreachable for anyone behind a validating resolver — not just a warning.

Is an "insecure" result a problem? →

No. Insecure simply means the zone is not signed with DNSSEC. DNSSEC is optional; a correctly configured unsigned zone resolves normally. You only see bogus when a zone claims to be signed but the signatures do not validate.

Why does my domain validate here but fail in another tool? →

Almost always caching and TTLs. If you just uploaded a DS record or rolled a key, resolvers may still hold the old DS/DNSKEY until the TTL expires. Re-check after the longest TTL in the chain has passed, and confirm propagation with the multi-resolver probe.

How do I enable DNSSEC on my domain? →

Two steps. First sign the zone at your DNS provider (most managed providers do this with one toggle). Then copy the generated DS record into your registrar's DNSSEC panel. The chain only becomes secure once the parent (registrar) publishes a DS that matches your KSK.

Does DNSSEC encrypt my DNS queries? →

No. DNSSEC authenticates records — it proves an answer was not forged — but it does not encrypt anything. For query privacy you need DNS-over-HTTPS or DNS-over-TLS, which are a separate mechanism.

Related tools & reading