DNSSEC checker
DNS answers are not authenticated by default, so anyone able to answer faster than your resolver can send you somewhere else. DNSSEC signs the answers. This checks whether a domain is signed and whether the parent zone vouches for it.
Free, no signup, no daily limit. We do not store what you check here.
Signed is not the same as protected
A zone can publish DNSKEY records and still be unprotected, because what makes the signature meaningful is the DS record in the parent zone — the registry saying "this key belongs to this domain". Publishing keys without submitting the DS to your registrar is the usual half-finished state: every signature validates against a key nobody has any reason to trust.
What it does not solve
DNSSEC authenticates DNS answers. It does not encrypt them, does not make your website safer, and does nothing about a compromised registrar account. Its practical value for mail is narrower still: it is the foundation DANE needs, and DANE is honoured by a minority of senders. Worth having, not worth an outage.
Questions
Will enabling DNSSEC break anything?
It can, and the failure mode is total: a signature that does not validate makes the domain disappear for validating resolvers rather than degrade. The dangerous moment is a key rollover or a registrar transfer where the DS record and the published keys stop matching.
Do I need DNSSEC for email authentication?
No. SPF, DKIM and DMARC work without it. DNSSEC matters for mail only if you intend to publish DANE records, which large senders mostly do not check.
Related tools
Nameserver lookup
Find which nameservers are authoritative for a domain, who operates them, and whether they are spread across providers. Free and live.
CAA record lookup
See which certificate authorities are allowed to issue for a domain, and who gets notified if one tries. Free, live DNS.
MX record lookup
Look up the MX records for any domain and see who handles its mail. Free, live DNS query, no signup.
When you need more than a free tool
This page answers what can be determined offline and from public DNS. The API adds live carrier and mailbox verification, a calibrated confidence score, and the full evidence trail behind every verdict.
Credits never expire. Inconclusive verdicts are never billed. Cancel in one call. See pricing or read the docs.