DNSSEC checker
Paste your domains. Warnwell looks for a DS record at the registry and checks whether a validating resolver accepts the answers.
- Free
- No sign-up
- Up to 50 domains at once
The three states
| Warnwell says | What it found | How bad |
|---|---|---|
| DNSSEC on | A DS record at the registry, and the answers validate | Fine |
| DNSSEC off | No DS record | A note. Most domains are unsigned. |
| DNS is signed wrong (DNSSEC) | A DS record, but the answers fail validation | Red. Google's and Cloudflare's resolvers refuse to answer, so the site and email stop for a large share of visitors. |
There is a fourth case, shown as "DNSSEC on, but not checked": a DS record using an old signing algorithm that public resolvers no longer validate. It does no harm, but it protects nothing either.
How "signed wrong" happens
Almost always after moving DNS to a new host. The registry still holds a DS record for the old host's key, the new host signs with a different key or not at all, and validation fails. The fix is to delete the old DS record at the registrar, or replace it with the one the new DNS host gives you.
Warnwell finds it by asking the same question twice, once normally and once with checking switched off (the cd flag). If only the second one answers, the signature is the problem.
Should you turn DNSSEC on?
It stops forged DNS answers that could send visitors or mail somewhere else. At Cloudflare it is one switch plus pasting a DS record at the registrar. Do it when you are not about to move DNS, since a move is when it breaks.
Questions
- How do I check DNSSEC by hand?
- Run
dig +dnssec example.comand look for the ad flag in the answer, ordig DS example.comto see whether the registry has a DS record. - My domain shows "DNSSEC off". Is that a problem?
- No. It is shown as a note, not a warning. Turning it on adds protection, and leaving it off breaks nothing.
- Can I check many domains?
- Yes, up to 50 per run. The CSV has a dnssec column with on, off or broken.
Related
Updated 20 Oct 2026.