DNSSEC Query Tool
Domain Name System (DNS) lookups with Domain Name System Security Extensions (DNSSEC) validation status.
Monitor DNSSEC Query Tool automatically
Domain Name System (DNS) lookups with Domain Name System Security Extensions (DNSSEC) validation status. NetTests can run this check on a schedule, preserve historical results, compare changes over time, and alert you the moment something breaks.
Start monitoring free → See all monitoring productsFrequently Asked Questions
What makes drill different from dig or host?
drill comes from the ldns library (NLnet Labs) rather than BIND, and its distinguishing feature is built-in Domain Name System Security Extensions (DNSSEC) support — it fetches and reports the signature chain a resolver would use to validate a response, not just the answer itself.
What does drill's DNSSEC validation actually check?
It walks the chain of trust from the queried name up toward the root, checking that each RRSIG (signature) record validates against the DNSKEY of its parent zone. The AD (Authenticated Data) bit in the response tells you whether the resolver itself considers the answer validated. A missing or broken chain here — rather than just a missing record — is usually what's actually wrong when DNSSEC-dependent services (like DANE or signed mail) fail.
What DNS record types should I know?
- A — IPv4 address of the domain.
- AAAA — IPv6 address.
- CNAME — alias pointing to another hostname.
- MX — mail server(s) for the domain.
- TXT — free-text records; used for SPF, DKIM, domain verification.
- NS — nameservers authoritative for the domain.
- SOA — start-of-authority; holds the primary NS and serial number.
- PTR — reverse DNS; maps an IP to a hostname.
What is TTL and why does it matter?
Time To Live (TTL) is the number of seconds resolvers are allowed to cache a Domain Name System (DNS) record. A TTL of 300 means the record may be cached for up to 5 minutes. Lower TTLs allow faster propagation of changes; higher TTLs reduce DNS query load but mean old records stick around longer after a change.
Why do I get different results from different resolvers?
Results can differ due to caching (each resolver may have cached a different version), geo-DNS (some Content Delivery Networks (CDNs) return different IPs based on the resolver's location), or propagation delays after a recent Domain Name System (DNS) change. Use the DNS Propagation tool to query many resolvers simultaneously.