Free DNSSEC Checker
Check whether a domain has DNSSEC enabled in one click.
This DNSSEC checker looks up your domain's DNSKEY records to confirm whether DNSSEC is enabled — shown alongside your SPF, DKIM, DMARC, mail servers and domain registration for a complete health picture.
DNSSEC (Domain Name System Security Extensions) cryptographically signs your DNS records so resolvers can verify they haven't been forged or tampered with in transit. Without it, attackers can spoof DNS responses (cache poisoning) to redirect your website or email to servers they control.
Agencies and MSPs: the paid plan continuously monitors DNSSEC and every DNS, email and certificate signal across all your clients' domains, alerting you the moment something changes.
Frequently asked questions
- What is DNSSEC?
- DNSSEC adds cryptographic signatures to your DNS so resolvers can verify responses are authentic, protecting against spoofing and cache-poisoning attacks.
- How do I enable DNSSEC?
- Enable it at your DNS host (many, like Cloudflare, do it with one click), then publish the resulting DS record at your domain registrar to complete the chain of trust.
- Do I need DNSSEC?
- It's optional but recommended — it meaningfully hardens your domain against DNS spoofing. It's especially worthwhile for domains handling email or sensitive traffic.