DNSSEC
DNSSEC signs a domain’s DNS answers so a resolver can tell a real answer from a forged one. We check the chain from the registry down — and whether it is signed with algorithms the rest of the internet still accepts.
Looking good
- Chain of trust intactThe parent’s DS record matches key 695, which signs the zone’s key set.
- Validated end to endA validating resolver checked every signature from the root down and accepted them.
- Algorithm RSASHA256 (8)Recommended and universally supported. ECDSAP256SHA256 (13) or ED25519 (15) give the same assurance with much smaller responses, if your DNS host offers them.
- NSEC3 parameters follow RFC 9276No extra iterations, no salt.
DS records at the parent
Published by the registry. Each must name a key the zone publishes, by key tag, algorithm and digest.
| Key tag | Algorithm | Digest | Matches |
|---|---|---|---|
| 695 | RSASHA256 (8) |
SHA-256 (2) 7277592dbd8993bde70704dbabd30afdbb85057e658ef1428f18f5d9a534bce0
|
key 695, digest verified |
DNSKEY records
The zone’s public keys. The key-signing key (KSK) signs the key set and is what the DS points at; zone-signing keys (ZSK) sign everything else.
| Role | Key tag | Algorithm | Size | IANA guidance |
|---|---|---|---|---|
| ZSK | 52549 | RSASHA256 (8) | 2048-bit | RECOMMENDED |
| KSK · trusted by DS | 695 | RSASHA256 (8) | 2048-bit | RECOMMENDED |
Signatures checked
| Covers | Signed by | Algorithm | Valid from | Valid until (UTC) |
|---|---|---|---|---|
| DNSKEY | 695 | RSASHA256 (8) | 2026-10-21 11:35 | 2026-11-25 11:51 |
| SOA | 52549 | RSASHA256 (8) | 2026-10-27 00:30 | 2026-12-01 01:30 |
Checked through 93.95.224.28, a validating resolver.
HOW TO READ THIS
What each part is forTwo halves, two places
The keys and signatures live with your DNS host. The DS record — a fingerprint of your key — lives at the registry, put there by your registrar. Both halves have to agree. Changing DNS host without updating the DS is the most common way a signed domain disappears.
Broken is worse than unsigned
An unsigned domain resolves everywhere; it just cannot prove its answers are genuine. A domain with a DS that does not match its keys fails to resolve at every validating resolver — Google, Cloudflare, Quad9 and most ISPs. That is why a mismatch is an error here and not signing at all is not.
Which algorithm
The IANA registry, the canonical source since RFC 9904, recommends ECDSAP256SHA256 (13) and ED25519 (15) for signing, with RSASHA256 (8) still recommended. RFC 9905 (2025) moved the SHA-1 algorithms (5 and 7) to MUST NOT. Changing algorithm is a key rollover your DNS host handles.
NSEC3 settings
RFC 9276 says NSEC3 must use zero extra iterations and should not use a salt — the recommended parameters are 1 0 0 -. Higher counts cost every resolver CPU without hiding names, and validators may treat them as insecure.
DNSSEC is also what makes DANE possible: a TLSA record in an unsigned zone protects nothing.