DNSBuddy

Knowledge base

DNSSEC

Learn how DNSSEC uses DS, DNSKEY, and RRSIG records to authenticate DNS answers, what each record means, and how to check whether a domain publishes DNSSEC evidence.

What Is DNSSEC?

TL;DR DNSSEC adds cryptographic signatures to DNS so resolvers can verify that DNS answers were not changed in transit. A working DNSSEC chain usually has a DS record at the parent zone, DNSKEY records at the signed zone, and RRSIG records that sign DNS record sets.

Look up DS records
Enter a domain name to lookup DS records

Enter the domain name you want to lookup Examples:

View full DNS lookup tool with advanced options →

The Records That Matter

  • DS: Published in the parent zone. It points to the child zone's key and connects the delegation to the DNSSEC chain of trust.
  • DNSKEY: Published by the signed zone. These public keys let validators verify signatures.
  • RRSIG: The signature over a DNS record set. Validators use DNSKEY records to verify these signatures.

How To Check DNSSEC

Use the DNSSEC Checker for a combined DS, DNSKEY, and RRSIG check. For individual records, you can also query:

dig example.com DS
dig example.com DNSKEY +dnssec
dig example.com RRSIG +dnssec

Common Problems

  • DNSKEY exists but DS is missing: The zone may be signed locally, but the parent has not been updated, so the chain of trust is incomplete.
  • DS exists but DNSKEY does not match: The parent points at a key that is missing or rotated incorrectly. This can cause validating resolvers to fail.
  • RRSIG is missing: The zone may not be fully signed, or the resolver may not be returning DNSSEC data.

Related