What this tool does
DNSSEC adds cryptographic signatures to DNS so resolvers can verify that an answer really came from the domain owner and wasn't tampered with in transit. This checker queries the domain through validating resolvers and reports whether the responses are authenticated (the AD flag). If it shows DNSSEC on, the chain of trust is intact; if off, the domain isn't signed.
Frequently asked questions
What does DNSSEC protect against?
It protects against DNS spoofing and cache poisoning, where an attacker injects forged answers to send you to the wrong server. Signed records let resolvers reject anything that doesn't validate.
My domain shows DNSSEC off, what should I do?
Enabling DNSSEC is done at your DNS provider and registrar (you publish a DS record at the registry). Many providers offer a one-click toggle. It's a worthwhile hardening step for important domains.
Does DNSSEC encrypt my DNS?
No. DNSSEC authenticates DNS answers but doesn't encrypt them. For privacy you'd use DNS-over-HTTPS or DNS-over-TLS, which is a separate concern.