DNS diagnostics
DNSSEC Checker
Observe DNSKEY records and the parent-side DS delegation for a domain without overstating what a record lookup proves.
Inspect DNSSEC records
Records are evidence, not full validation
DNSSEC signs DNS data so a validating resolver can detect forged or altered answers. DNSKEY publishes zone keys and DS connects a child zone to its parent in the chain of trust. This checker observes those records through its resolver; it does not independently validate every signature from the root.
DNSSEC does not encrypt DNS questions or answers. Encrypted DNS transports such as DoH and DoT address privacy in transit, while DNSSEC addresses authenticity and integrity. Records can also look temporarily inconsistent during key rollovers, delegation changes, or resolver caching.