Signed and valid
The zone publishes its keys, and resolvers validate its answers.
Free DNSKEY lookup for DNSSEC keys
List the DNSSEC keys a domain publishes, with each key type, algorithm and key tag.
- Free, with no signup
- Runs in your browser
What your result means
Not signed
The zone publishes no keys. DNSSEC is optional, and email works without it.
Signed, not valid
The keys exist, but answers do not validate, often because the DS record does not match a key.
Questions about the DNSKEY lookup
What is a DNSKEY record?
It holds a public key that signs the zone's records. A key signing key signs the keys, and a zone signing key signs the other records.
What is a key tag?
A short number computed from the key. DS records and signatures name a key by its tag.
What happens if DNSSEC breaks?
Resolvers that validate DNSSEC refuse every answer for the domain, so it stops resolving for their users, and email to and from it fails.
Found a problem? We will check the rest.
Book a deliverability audit and we will look at every domain and mailbox you send from.