What this tool does
DNSSEC adds cryptographic signatures to DNS so resolvers can verify that an answer really came from the domain owner and wasn't tampered with in transit. This checker queries the domain through validating resolvers and reports whether the responses are authenticated (the AD flag). If it shows DNSSEC on, the chain of trust is intact; if off, the domain isn't signed.
Turning DNSSEC on without breaking resolution
Enabling DNSSEC has two halves that must agree: your DNS provider signs the zone, and your registrar publishes a matching DS record at the registry. If those fall out of sync, from a botched key rollover, a bad DS value, or moving DNS providers while DNSSEC is still on, validating resolvers return SERVFAIL and your domain effectively disappears for a large share of the internet. The rule of thumb is to disable DNSSEC (remove the DS record and wait for its TTL) before any DNS migration, then re-enable it once the new provider is live.
Frequently asked questions
What does DNSSEC protect against?
It protects against DNS spoofing and cache poisoning, where an attacker injects forged answers to send you to the wrong server. Signed records let resolvers reject anything that doesn't validate.
My domain shows DNSSEC off, what should I do?
Enabling DNSSEC is done at your DNS provider and registrar (you publish a DS record at the registry). Many providers offer a one-click toggle. It's a worthwhile hardening step for important domains.
Does DNSSEC encrypt my DNS?
No. DNSSEC authenticates DNS answers but doesn't encrypt them. For privacy you'd use DNS-over-HTTPS or DNS-over-TLS, which is a separate concern.
Can DNSSEC make my domain unreachable?
Yes, and it's the main risk to manage. If the DS record at your registrar stops matching the keys your zone is signed with, validating resolvers reject every answer with SERVFAIL and the domain fails to resolve for those users. It's why a broken DS record is treated as an outage, and why you remove DNSSEC before migrating DNS.