ADVERT

RRSIG Record Checker

View RRSIG records to inspect DNSSEC signatures, inception and expiration windows, and covered record sets.

How to use this tool

Query RRSIG records for the zone or name under review.
Inspect covered type, signer, key tag, inception, and expiration windows.
Correlate signature metadata with DNSKEY and DS records when diagnosing DNSSEC failures.

Signature health checks

Catch expired or not-yet-valid signatures before they trigger validation failures.
Verify key tags point to expected active DNSKEY entries.
Confirm required record sets are being signed by authoritative infrastructure.

Operational guidance

Keep signer clocks synchronized to avoid future-dated signatures.
Use practical validity windows that balance risk and operational load.
Audit signature coverage after dynamic updates or key rollovers.

FAQ

Why can inception times appear in the future?: Clock skew on signing infrastructure can produce signatures that are not yet valid to resolvers.
What if an RRSIG covers NSEC or NSEC3 records?: That is expected in DNSSEC zones and protects authenticated denial-of-existence responses.
How long should RRSIG validity windows be?: Many operators use moderate windows and rotate regularly to balance resilience with compromise exposure.

ADVERT

DNS Record Lookup
Look up DNS A, AAAA, MX, TXT, CNAME, NS, and DNSSEC records instantly using Google's public resolver.
A Record Checker
Fetch IPv4 A records for any domain to verify hosting changes, check propagation, and troubleshoot routing or DNS misconfigurations with IPs at a glance.
AAAA Record Checker
Check AAAA records to confirm IPv6 addresses published for your domain and diagnose dual-stack issues.
MX Record Checker
List MX records to see which mail exchangers handle email for a domain and validate deliverability setups.
TXT Record Checker
Inspect TXT records for SPF, DKIM, DMARC, and verification tokens on any domain to validate email setups, third-party integrations, and deliverability.
CNAME Record Checker
Run a CNAME lookup to reveal aliases and see how hostnames map to canonical domains, CDNs, and services. Verify routing, redirects, and DNS setups during migrations.

ADVERT