DNSSEC checker

DNSSEC adds cryptographic signatures to DNS responses so the resolver can verify the data hasn't been tampered with on its way back. Without DNSSEC, a man-in-the-middle (compromised public Wi-Fi, ISP-level attacker, BGP-hijack mishap) can substitute a fake IP for a real lookup and direct your customers to a phishing site that looks identical to yours.

The chain has three parts: a DNSKEY published at your apex (the public key used to sign records), an RRSIG on every signed record (the actual signature), and a DS record published at the parent zone (anchoring your DNSKEY into the global trust chain so resolvers know to trust it). Break any one of those and DNSSEC fails.

Validating resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9, most major ISPs in the EU + AU) refuse to return data when signatures don't verify - they return SERVFAIL. That's the "Bogus" state: your domain is silently unreachable for ~30-40% of internet users.

Verdict tiers:

• Secure: AD flag set, DNSKEY at apex, DS at parent. Validating resolvers trust the chain. Nothing to do.
• Insecure: no DNSKEY at apex (zone unsigned), OR DNSKEY present but no DS at parent (chain unanchored). Enable DNSSEC at your DNS provider + publish the DS at your registrar.
• Bogus: signatures fail to validate. Either an expired RRSIG, a DS/DNSKEY algorithm mismatch, or a half-removed DNSSEC state. URGENT - fix or roll back. Customers using validating resolvers cannot reach your domain.

What "Bogus" looks like in production: customers report intermittent "site won't load" but only on some networks (the ones using validating resolvers). Easy to misdiagnose as a CDN issue. The give-away: SERVFAIL responses for ANY query on the domain, not just A records.