DNSSEC Query Tool
Domain Name System (DNS) lookups with Domain Name System Security Extensions (DNSSEC) validation status.
Monitor DNSSEC Query Tool automatically
Domain Name System (DNS) lookups with Domain Name System Security Extensions (DNSSEC) validation status. NetTests can run this check on a schedule, preserve historical results, compare changes over time, and alert you the moment something breaks.
Start monitoring free → See all monitoring productsFrequently Asked Questions
What does the DNSSEC Query Tool check?
It sends the query with the DNSSEC-OK bit set, so the response includes the signature (RRSIG) records for the answer, and it reports whether our resolver marked the answer as authenticated — the AD (Authenticated Data) flag. AD set means the resolver validated the signature chain; AD clear on a signed zone means it could not.
Does it validate the chain of trust itself?
No — it reports the resolver's verdict rather than walking the chain step by step. To see each link from the root down — which DNSKEY signs which record, and where a broken chain breaks — use the DNSSEC Validator.
What DNS record types should I know?
- A — IPv4 address of the domain.
- AAAA — IPv6 address.
- CNAME — alias pointing to another hostname.
- MX — mail server(s) for the domain.
- TXT — free-text records; used for SPF, DKIM, domain verification.
- NS — nameservers authoritative for the domain.
- SOA — start-of-authority; holds the primary NS and serial number.
- PTR — reverse DNS; maps an IP to a hostname.
What is TTL and why does it matter?
Time To Live (TTL) is the number of seconds resolvers are allowed to cache a Domain Name System (DNS) record. A TTL of 300 means the record may be cached for up to 5 minutes. Lower TTLs allow faster propagation of changes; higher TTLs reduce DNS query load but mean old records stick around longer after a change.
Why do I get different results from different resolvers?
Results can differ due to caching (each resolver may have cached a different version), geo-DNS (some Content Delivery Networks (CDNs) return different IPs based on the resolver's location), or propagation delays after a recent Domain Name System (DNS) change. Use the DNS Propagation tool to query many resolvers simultaneously.