DNSSEC Check

Check a domain's DNSSEC chain: DS at the registry, DNSKEYs, signatures and validation, with the DS record to add when it's half set up.

DNSSEC signs a domain's DNS answers so resolvers can tell they weren't forged. It needs two halves to match: the keys published in your DNS zone, and a DS record at your registrar that vouches for them. This check shows both, recomputes the DS from the key to see that they agree, and asks validating resolvers (Google and Cloudflare) whether the answers check out. A mismatch is worse than no DNSSEC at all: validating resolvers then refuse to answer, and the domain stops resolving for many people.