DNSSEC Validator

Domain Name System Security Extensions (DNSSEC) protects against Domain Name System (DNS) cache poisoning and spoofing — attacks where an attacker injects false DNS responses to redirect traffic. It does this by digitally signing DNS records with cryptographic keys that resolvers can verify against a chain of trust anchored at the DNS root. DNSSEC authenticates data integrity but does not encrypt DNS queries.

The chain starts at the Domain Name System (DNS) root, which publishes its public keys (DNS Public Key (DNSKEY)). Each parent zone signs the public key hash (Delegation Signer (DS) record) of its child zones. For example.com: the root signs the .com DS record; .com signs example.com's DS; and example.com uses its DNSKEY to sign its own resource records (Resource Record Signature (RRSIG)). A validating resolver walks this chain to verify every response.

A DNS Public Key (DNSKEY) record contains the zone's public key — typically a Key Signing Key (KSK) that signs other DNSKEYs, and a Zone Signing Key (ZSK) that signs zone data. A Delegation Signer (DS) record lives in the parent zone and contains a hash of the child zone's KSK — it's the cryptographic link between parent trust and child keys.

BOGUS means validation failed — signatures exist but don't verify correctly. This could indicate tampering, a configuration error (mismatched Delegation Signer (DS)/DNS Public Key (DNSKEY)), or an expired signature (Resource Record Signature (RRSIG) records have validity periods and must be re-signed regularly). A BOGUS result causes a validating resolver to return SERVFAIL — failing closed is the intended security behaviour.

INSECURE means the domain has no Domain Name System Security Extensions (DNSSEC) signatures, not that there's an active attack. Most domains don't have DNSSEC enabled — it's the normal unsigned state. Consider enabling DNSSEC through your registrar for added protection, especially for domains handling sensitive services like email, banking, or authentication.