DNS & DNSSEC checker
Look up A, AAAA, MX, NS, TXT and CAA records and test whether DNSSEC validates.
What this checks
We query public validating resolvers (Cloudflare, with Google as backup) over DNS-over-HTTPS, the same way a visitor's resolver sees your domain.
- DNSSEC: whether answers are signed and validate. A DS record at the registrar that doesn't match your DNSKEY takes the whole domain offline for validating resolvers.
- CAA: which certificate authorities may issue certificates for you. Subdomains inherit the closest parent's CAA.
- NS, A/AAAA, MX, TXT, SOA: the basics, with TTLs.
For mail records, use the SPF, DKIM and DMARC checker.