DNSSEC

DNSSEC signs a domain’s DNS answers so a resolver can tell a real answer from a forged one. We check the chain from the registry down — and whether it is signed with algorithms the rest of the internet still accepts.

Try nic.cz, cloudflare.com or dnssec-failed.org (broken on purpose)