Signed
Each record set carries a signature that has not expired, with the key that made it.
Free RRSIG lookup for DNSSEC signatures
See the DNSSEC signatures on a domain's records, with the key that made each one and when it expires.
- Free, with no signup
- Runs in your browser
What your result means
Not signed
The records come without signatures.
Expired signature
A signature has expired, so validating resolvers reject that record.
Questions about the RRSIG lookup
What is an RRSIG record?
The DNSSEC signature on a set of records. Resolvers check it with the zone's public key.
Why do signatures expire?
Each signature is valid for a fixed time, so an old signed answer cannot be replayed forever. The DNS host signs the records again before they expire.
Which records does the lookup check?
The SOA, A, MX, TXT and DNSKEY records of the name, the ones a mail domain depends on.
Found a problem? We will check the rest.
Book a deliverability audit and we will look at every domain and mailbox you send from.