External DNSSEC Diagnostic Tools

Last updated October 26, 2026

To test whether DNSSEC works for your domain, run it through DNSSEC Analyzer for a quick pass or fail, use DNSViz to see where the chain of trust breaks, or check it yourself with dig +dnssec. These tools find common problems such as missing DS records, expired signatures, or DNSKEY mismatches.

How to test your DNSSEC configuration

To check if DNSSEC is working correctly for your domain, run your domain through one or more of the tools listed below. Start with DNSSEC Analyzer for a quick pass/fail overview, then use DNSViz if you need a visual breakdown of where the chain of trust fails. For command-line validation, use dig +dnssec locally.

DNSSEC Analyzer (Verisign Labs)

dnssec-analyzer.verisignlabs.com

Checks whether a domain validates correctly with DNSSEC and reports configuration problems including DS record mismatches, missing DNSKEY records, and expired signatures.

DNSViz

dnsviz.net

Provides a visual representation of the DNSSEC chain of trust and highlights where validation fails between the parent zone and the authoritative DNS provider.

Local validation using dig

You can also perform DNSSEC validation checks from your own system using the dig command.

For example:

dig +dnssec example.com

Look for:

• The ad flag in the header, which means your resolver validated the answer. You only see it if your resolver validates DNSSEC.
• RRSIG records next to the answer.
• DNSKEY records, when you query them with dig +dnssec DNSKEY example.com.

A validating resolver that can’t verify the answer returns SERVFAIL instead. Adding +cd (checking disabled) to the same query returns the answer without validation, which helps confirm the failure is a DNSSEC problem.

For usage details, see How to Use dig and the dig Reference Guide. For fixes to common problems, see Troubleshoot DNSSEC.

Have more questions?

If you have additional questions or need any assistance with DNSSEC diagnostics, just contact support, and we will be happy to help. You can also read more about domain and DNS security at DNSimple.