Tools · DNS · DNSSEC

DNSSEC chain validator

Walk the authoritative delegation from the root to your domain and verify the cryptographic evidence at every hop.

Authoritative validation

Check a DNSSEC chain

Use the registrable domain, such as example.com rather than www.example.com.

Enter a domain to validate its chain of trust

The result separates cryptographic security, algorithm guidance, and validator capability so an aging algorithm is never mistaken for a broken chain.

Argus insight D.B. Argus — field note

How authoritative DNSSEC validation works

Argus starts with the root trust anchor, then authenticates every parent-to-child delegation until it reaches the target zone.

Step 1 of 4

Root trust is bootstrapped

A versioned IANA root trust anchor authenticates the root DNSKEY set.

Current evidence

No domain has been checked yet.
The authoritative chain walk has not been run yet.
No authoritative hops have been examined.
Algorithm policy has not been assessed.
No chain failure was reported.

Terms in this check

DS: the parent-side fingerprint for a child key.
DNSKEY: a public key published by the signed zone.
RRSIG: the signature that authenticates a DNS record set.
NSEC/NSEC3: signed proof that a requested record does not exist.

Why it matters

A broken delegated chain can make otherwise reachable DNS answers unusable to validating resolvers. An insecure delegation is different: it is not validated, but it is not cryptographically bogus.

Method

The Rust DNS engine sends DNSSEC-aware, non-recursive queries directly to authoritative servers. It validates the root DNSKEY set, each parent DS signature, each DS-to-DNSKEY match, and each child DNSKEY signature.

Boundary

The walk is intentionally bounded by time, attempts, hops, response size, and NSEC3 work. Unsupported algorithms or exhausted limits produce an indeterminate result, never a false failure.

Next checks

Repair the first failed delegation rather than changing unrelated DNS records.
Treat algorithm guidance as migration advice separate from chain validity.
Re-run after a key, signature, or parent DS change has propagated.

Show more context

Provenance

Open each hop to inspect the exact authoritative attempts and the DS, DNSKEY, RRSIG, NSEC, or NSEC3 evidence used for the verdict.

Open related guide