DNSSEC checker

QUESTIONS ABOUT THIS TOOL

What does DNSSEC actually protect against?

Forged DNS answers. Without it, a resolver has no way to tell your real A record from one injected by whoever is between it and your nameservers, which is how cache poisoning sends visitors to an attacker's server while the address bar still reads your domain. DNSSEC signs the answers so tampering is detectable.

What is the AD flag, and why do you read it?

AD stands for authenticated data. A validating resolver sets that bit on its reply when it has verified the signature chain from the root down to your record. It is the resolver telling us, in one bit, that the cryptography checked out. A DS record proves signing was switched on; the AD flag proves it still works.

Broken DNSSEC is worse than no DNSSEC. Why?

A validating resolver that cannot verify a signed answer does not fall back to serving it unsigned. It refuses, and returns SERVFAIL. So a broken chain does not degrade your domain, it removes it, for every user whose resolver validates. An unsigned domain at least resolves.

Does DNSSEC help my SEO?

There is no ranking benefit, and Google has never claimed one. The reason to enable it is availability and trust: a hijacked domain loses its rankings entirely, and DNSSEC is one of the checks a growing number of AI agents and procurement reviews run against a domain before trusting it.

How do I turn DNSSEC on?

At your DNS host, enable signing for the zone; it will give you a DS record. Then paste that DS record into your registrar, which publishes it in the parent zone. Both halves are needed. If your registrar and DNS host are the same company, it is usually a single switch.

Why did my domain break right after I moved DNS hosts?

The old host's DS record was still published at the registrar while the new host was signing with a different key. The parent zone pointed at a key that no longer existed, so every validating resolver rejected the domain. Remove the DS record before a migration and add the new one after.