DNSSEC check
Check whether a domain has DNSSEC, and whether the signature is working.
About this tool
DNSSEC protects a domain against forged DNS responses. The zone is signed with a key, and the registry (for example, Internetstiftelsen for .se) publishes a DS record pointing to that key. This allows resolvers to verify that responses genuinely come from the domain's name servers.
The tool shows whether the domain has a DS record at the registry, which keys the zone has, and whether a validating resolver accepts the responses. You can also see which algorithms are in use.
The most serious problem is broken DNSSEC: the DS record is still present but no longer matches the zone's keys, which often happens after changing name servers. When this occurs, the domain becomes completely unreachable for anyone using a validating resolver – and that includes many Swedish internet service providers.
Frequently asked questions
Does my domain need DNSSEC?
It is recommended, especially for .se domains where it is common practice. DNSSEC makes it harder for attackers to redirect visitors to a fake website or email server.
What does it mean if the DS record is missing?
The zone is signed, but the registry does not know about it, so DNSSEC is not in effect. Add the DS record at your registrar, or ask whoever manages the domain to do so.
DNSSEC is broken. What should I do?
Remove the old DS record at the registrar or replace it with the new one that matches the zone's key. Act quickly: while the error persists, many visitors will be unable to reach the domain.
If I move my domain to Admax, what happens to DNSSEC?
We will help you migrate without any interruption, ensuring the DS record is updated at the same time as the name servers are changed.