DNSSEC checker
DNSSEC cryptographically signs your DNS records so a recipient can confirm they came from you and weren't tampered with in transit. We verify the structural chain (DS records at the parent, DNSKEY at the child, RRSIG signatures), check the signing algorithm, and ask a validating recursive resolver whether the AD (authenticated-data) bit comes back set. SMB security audits frequently ask for this evidence.
Example result for example.com
Sample data. Run the check above to see yours.
DNSSEC not enabled
Not setexample.com has no DS record in the parent zone, so its DNS answers are not signed.
- Turn on signing at your DNS host, then publish the DS record at your registrar.
Want ongoing monitoring?
This tool is a one-shot check. PhishFence watches your domain with automated hourly monitoring (daily on Free) for DMARC changes, new lookalike registrations, and spoofing attempts.