isitdns?

DNSSEC chain check: root to answer

dnssec chain check

Does the chain of DS and DNSKEY records hold from the root to this name's answer, and if not, at which zone does it break?

The walk opens on the DNSSEC chain page, drawn key by key. The same walk as text: dnssec_chain over MCP, or /api/dnssec-chain?name=example.com&type=A (JSON).

read

These lines read the text walk (the reading below: dnssec_chain over MCP, /api/dnssec-chain). The chain page the form opens draws the same walk and ends in a verdict word of its own, named in each line.

  • GO No structural break found (the chain page: CHAIN INTACT): every signed cut reads DS matches: tag <N> and every signature reads inside its window. Signature bytes are not verified (the reading says sigs: not verified; the chain page's verdict names what it checked: the DS digests, the windows and the resolver's AD bit), so a corrupt or forged RRSIG with a good key tag and good dates passes this read; delv below is the check that verifies them.
  • NO GO BREAKS at <zone> (the chain page: BROKEN): a DS with no matching DNSKEY, or a signature outside its window (expired, not yet valid) -> zone operator: publish the DS that matches the KSK in use (RFC 4034 section 5), or re-sign before the window ends (RFC 4034 section 3.1.5).
  • NOT RUN INSECURE from <zone> (the chain page: UNSIGNED PATH): no DS at that cut, so a validator treats everything below it as insecure and validates nothing there, signed or not (RFC 4035 section 5.2). Not a break.
  • NOT RUN no break found before the walk stopped, or no break found in the links checked with items not checked listed above it: the walk did not read or check every link, so the links it names are the read and the rest are not. Not a GO.
  • NOT RUN the chain page's two other verdicts: NXDOMAIN (no such name; the chain drawn is the path that would sign it) and SIGNED, BUT (the chain the page could draw holds and the resolver set no AD on the final answer: the resolver's validation is what did not happen, not the chain). Neither is a break and neither is a GO. The text walk asks with CD=1 and reads no AD bit; its answer: line carries the rcode.
example

example.com A, read 2026-10-18T22:02:07Z:

  isitdns · dnssec chain · example.com A
  ;; read through cloudflare-dns.com over DoH with RD=1, DO=1 and CD=1 (RFC 4035 section 3.2.2), 2026-10-18T22:02:07.257Z, from the Cloudflare edge · checked: key tags, signers, windows · sigs: not verified
  No structural break found; signature bytes not verified.
  . (root)
    DNSKEY: tag 8763 alg 8 ZSK; tag 20326 alg 8 KSK; tag 38696 alg 8 KSK
    DNSKEY set signed: tag 38696 alg 8 by ., inside (20261011000000 to 20261101000000)
  com
    DS at the parent: 1 (19718 13 2 8ACBB0CD28F41250A80A491389424D341522D946B0DA0C0291F2D3D771D7805A); signed tag 8763 alg 8 by ., inside (20261018160000 to 20261031170000)
    DNSKEY: tag 41446 alg 13 ZSK; tag 65344 alg 13 ZSK; tag 19718 alg 13 KSK
    DS matches: tag 19718
    DNSKEY set signed: tag 19718 alg 13 by com, inside (20261014135735 to 20261029140235)
  example.com
    DS at the parent: 1 (2371 13 2 C988EC423E3880EB8DD8A46FE06CA230EE23F35B578D64E78B29C3E1C83D245A); signed tag 65344 alg 13 by com, inside (20261017002323 to 20261024013323)
    DNSKEY: tag 36315 alg 13 ZSK; tag 9776 alg 13 ZSK; tag 34505 alg 13 ZSK; tag 2371 alg 13 KSK
    DS matches: tag 2371
    DNSKEY set signed: tag 2371 alg 13 by example.com, inside (20260925174647 to 20261125174647)
  answer: NOERROR, 2 A records (A 172.66.147.243; A 104.20.23.154); signed tag 34505 alg 13 by example.com, inside (20261017205919 to 20261019225919)

api: https://isitdns.net/api/dnssec-chain?name=example.com&type=A
from your own machine
delv @1.1.1.1 example.com A
dig +dnssec @1.1.1.1 example.com DS

delv validates every link against its own root key and prints one verdict; dig DS reads the one record the parent holds for the child.

the manual
other jobs