DNSSEC Validator

DNSSEC protects against DNS cache poisoning and spoofing — attacks where an attacker injects false DNS responses to redirect traffic. It does this by digitally signing DNS records with cryptographic keys that resolvers can verify against a chain of trust anchored at the DNS root. DNSSEC authenticates data integrity but does not encrypt DNS queries.

The chain starts at the DNS root, which publishes its public keys (DNSKEY). Each parent zone signs the public key hash (DS record) of its child zones. For example.com: the root signs the .com DS record; .com signs example.com's DS; and example.com uses its DNSKEY to sign its own resource records (RRSIG). A validating resolver walks this chain to verify every response.

A DNSKEY record contains the zone's public key — typically a Key Signing Key (KSK) that signs other DNSKEYs, and a Zone Signing Key (ZSK) that signs zone data. A DS (Delegation Signer) record lives in the parent zone and contains a hash of the child zone's KSK — it's the cryptographic link between parent trust and child keys.

BOGUS means validation failed — signatures exist but don't verify correctly. This could indicate tampering, a configuration error (mismatched DS/DNSKEY), or an expired signature (RRSIG records have validity periods and must be re-signed regularly). A BOGUS result causes a validating resolver to return SERVFAIL — failing closed is the intended security behaviour.

INSECURE means the domain has no DNSSEC signatures, not that there's an active attack. Most domains don't have DNSSEC enabled — it's the normal unsigned state. Consider enabling DNSSEC through your registrar for added protection, especially for domains handling sensitive services like email, banking, or authentication.