Skip to content

duck.toolslocal-first tools

Search tools/

Images3

Image Collage
Image Compressor
Image Cropper

Generators1

QR Code Generator

Local AI2

AI Background RemoverAI
Quack AIAI

Developer1

Domain Availability

JSON6

JSON Compressor
JSON Converter
JSON Designer
JSON Diff
JSON Formatter
JSON Validator

Networking3

DNS Lookup
DNSSEC Checker
IP Network

Linux1

Crontab Generator

Calculators1

Currency Converter

External Tools

No tools match yet.

About Privacy Pro

DNSSEC Checker

Networking

Loading DNSSEC Checker

Settings

DNSSEC Checker uses Duck Tools servers

Processed on Duck Tools servers

This lookup leaves your browser.The domain you type is sent to Duck Tools, then to Cloudflare DNS over HTTPS. We request DS, DNSKEY and SOA with DNSSEC checking on and off. We do not accept lookups from other websites.
No tracking.No analytics and no tracking cookies. Sign-in uses a session cookie and loads Cloudflare Turnstile only when you open the account dialog.
Short-lived, not a dossier.Queries are rate-limited and cached briefly so repeats are fast. We do not sell them or keep a history under your name.

The domain you type is sent to Duck Tools, then to Cloudflare DNS over HTTPS with DNSSEC records requested. We keep a short cache. We do not sell queries or store a history under your name.

To be precise: your browser still downloads this page, its scriptsover the network, and our web server keeps standard access logs. For this tool the domain name you look up also travels, on purpose.

Read the full privacy page →

Your account

No password. We email you a sign-in link.

Email

Human check

Saving presets across devices is next. For now this just signs you in.

How we handle your email

DNSSEC Checker

See if a domain has DNSSEC enabled and whether the chain validates.

Type a domain to check DS at the parent, DNSKEYs in the zone, and whether a validating resolver authenticates the answer. Broken chains show up as SERVFAIL when checking is on. Lookups go through Duck Tools to Cloudflare DNS over HTTPS — other sites cannot embed this endpoint.

How it works

Type a domain. We look up SOA, NS, DS and DNSKEY through Cloudflare DNS over HTTPS.
A validating query (checking on) shows whether the chain of trust holds.
If DS exists but that query SERVFAILs, DNSSEC is enabled and broken.
No DS means resolvers will not authenticate the zone. Other sites cannot embed this.

Also known as

dns
dnssec
ds
dnskey
rrsig
security
domain

Related tools

DNS LookupLive DNS records for a domain — A, MX, NS, TXT and common hostnames.
Domain AvailabilityCheck if a name is free across popular TLDs, with a short WHOIS peek on taken ones.
IP NetworkWHOIS and reverse DNS for any IPv4 or IPv6 address.

SERVERProcessed on Duck Tools servers

This lookup leaves your browser.The domain you type is sent to Duck Tools, then to Cloudflare DNS over HTTPS. We request DS, DNSKEY and SOA with DNSSEC checking on and off. We do not accept lookups from other websites.
No tracking.No analytics and no tracking cookies. Sign-in uses a session cookie and loads Cloudflare Turnstile only when you open the account dialog.
Short-lived, not a dossier.Queries are rate-limited and cached briefly so repeats are fast. We do not sell them or keep a history under your name.

The domain you type is sent to Duck Tools, then to Cloudflare DNS over HTTPS with DNSSEC records requested. We keep a short cache. We do not sell queries or store a history under your name.

To be precise: your browser still downloads this page, its scriptsover the network, and our web server keeps standard access logs. For this tool the domain name you look up also travels, on purpose.

More networking tools →Full privacy page →