ADVERT

DNSKEY Record Checker

Retrieve DNSKEY records published for DNSSEC validation, including algorithms, key tags, and public keys.

How to use this tool

Query DNSKEY records for the zone you want to validate.
Review key tags, algorithms, flags, and public key material.
Cross-check DNSKEY entries against DS and RRSIG data during rollovers.

DNSSEC key checks

Flag 257 generally indicates KSK, while 256 indicates ZSK.
Use key tags to match DNSKEY records with DS and RRSIG references.
Verify replacement keys are visible before retiring older keys.

Operational guidance

Stage rollover keys early so validating resolvers can cache them.
Confirm parent-zone DS updates align with published DNSKEYs.
Audit keysets after signer changes to catch propagation gaps.

FAQ

What is the purpose of the key tag?: The key tag is a compact identifier used to associate DNSKEY records with DS entries and signatures.
Why might several DNSKEY records be present?: Zones commonly publish multiple keys during planned KSK or ZSK rollovers.

ADVERT

DNS Record Lookup
Look up DNS A, AAAA, MX, TXT, CNAME, NS, and DNSSEC records instantly using Google's public resolver.
A Record Checker
Fetch IPv4 A records for any domain to verify hosting changes, check propagation, and troubleshoot routing or DNS misconfigurations with IPs at a glance.
AAAA Record Checker
Check AAAA records to confirm IPv6 addresses published for your domain and diagnose dual-stack issues.
MX Record Checker
List MX records to see which mail exchangers handle email for a domain and validate deliverability setups.
TXT Record Checker
Inspect TXT records for SPF, DKIM, DMARC, and verification tokens on any domain to validate email setups, third-party integrations, and deliverability.
CNAME Record Checker
Run a CNAME lookup to reveal aliases and see how hostnames map to canonical domains, CDNs, and services. Verify routing, redirects, and DNS setups during migrations.

ADVERT