Truvo Free Tools

DNSSEC checker

DNSSEC signs your DNS records so resolvers can detect forged answers and cache poisoning. This checker asks a validating resolver whether your domain's records are signed and verify, flags an unsigned zone, and names the SOC 2 and ISO 27001 controls the answer affects.

SOC 2 CC6.1SOC 2 CC6.7SOC 2 A1.2ISO 27001 A.8.20ISO 27001 A.8.14ISO 27001 A.8.24
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure. These tools come out of that work.

Connect on LinkedIn

How the DNSSEC checker works

The check is passive: it queries a validating DNS over HTTPS resolver and reads the authenticated data flag, without touching your nameservers directly.

01

Query

You enter a domain. The tool asks a validating DNS over HTTPS resolver for the domain's records and asks it to report whether the response was authenticated (the AD flag).

02

Read

A signed zone with a valid chain of trust from the root returns authenticated data. An unsigned zone, or a signed zone whose DS record is missing at the registrar, does not, and is flagged.

03

Map

Each finding names the controls it speaks to: SOC 2 CC6.1, CC6.7 and A1.2, and ISO 27001:2022 A.8.20, A.8.14 and A.8.24. A validating zone is evidence that DNS answers for your domain cannot be silently forged.

Found a gap? We fix it for you.

Truvo's security engineers harden DNS and TLS, and hand you the evidence an auditor asks for. Tell us the domain and we will scope the fix.

Contact us

  • DNSSEC signing

  • CAA records

  • Redundant nameservers

  • TLS and HSTS

  • Audit evidence

  • Fixed-price scope

DNSSEC checker: frequently asked questions

It asks a validating resolver for your domain's records and checks whether the answer is marked authenticated. That confirms the zone is signed, the DS record is published at the parent, and the chain of trust verifies. It does not audit key lengths or rollover schedules.

The most common cause is a missing DS record at the registrar. Signing the zone at your DNS host is half the job; the DS record that points the parent zone at your keys has to be published at the registrar, or resolvers have no chain of trust and treat the zone as unsigned.

No. DNSSEC authenticates answers so a resolver can tell a forged response from a real one; it does not hide the query. Encryption of DNS traffic is a separate feature (DNS over HTTPS or DNS over TLS) at the resolver.

The risk is operational: an expired signature or a DS record left behind after changing DNS providers makes the domain unresolvable for validating resolvers. Most managed DNS providers automate signing and rollover; the step to get right is updating or removing the DS record whenever you move providers.

Truvo maps DNSSEC findings to SOC 2 CC6.1, CC6.7 and A1.2, and to ISO 27001:2022 Annex A controls A.8.20 (networks security), A.8.14 (redundancy) and A.8.24 (use of cryptography). The mapping is advisory and is not a substitute for an audit.

Each zone signs its records with a private key and publishes the public key as a DNSKEY record. The parent zone publishes a DS record, a hash of that key, and signs it in turn, all the way up to the root. A validating resolver walks that chain: if any signature fails or a DS is missing, the answer is rejected instead of trusted. That is what makes a forged or poisoned answer detectable.