DNSSEC Chain of Trust Debugger
Inspect cryptographic authentication records across the global domain hierarchy. Verify delegation signers (DS), zone keys (DNSKEY), and signature validity (RRSIG) from the ICANN Root Anchor down to host records.
Frequently Asked Questions
How does the DNSSEC cryptographic chain of trust function?
DNSSEC establishes trust through a hierarchical cryptographic chain: The Root Zone KSK signs the Root ZSK, which signs the TLD delegation signer (DS) record. The TLD signs the domain DS record, which in turn verifies the domain DNSKEY and zone RRSIG signatures.
What causes a DNSSEC validation failure (SERVFAIL)?
Validation fails when a domain DS record at the parent registry does not match the actual KSK DNSKEY in the child zone, when an RRSIG cryptographic signature expires, or when an unsupported algorithm is used. Validating resolvers drop unverified answers and return SERVFAIL.
What is the AD (Authenticated Data) bit in DNS responses?
The AD bit in a DNS header (RFC 2535 / RFC 4035) indicates that the recursive resolver cryptographically verified all signatures in the response back to the global root trust anchor.
What cryptographic algorithms are recommended for DNSSEC in 2026?
Algorithm 13 (ECDSA Curve P-256 with SHA-256) and Algorithm 15 (Ed25519) are industry standards due to compact signature sizes and rapid cryptographic verification times, minimizing UDP packet fragmentation.