Is DNSSEC set up properly on my domain?

Updated 2026-10-16

Short answer: DNSSEC signs your DNS so answers can't be forged. It has two halves: your DNS provider signs the records, and your registrar publishes a DS record at the registry. With only the first half done, nothing checks the signatures. With the halves mismatched, your domain can stop resolving for anyone whose resolver validates.

How to check it yourself

  1. Check whether your DNS provider has DNSSEC turned on (in Cloudflare: DNS, then Settings).
  2. Look up the DS record at the registry: dig DS yourdomain.com.
  3. No DS record with signing on means half set up. A DS record that doesn't match the provider's key means broken.
  4. Copy the DS details from your DNS provider into your registrar's DNSSEC settings, or turn signing off cleanly if you don't want it.

What Preventionlabs shows

Every report says whether DNSSEC is on, off or broken for your domain. For example, from a real report: "DNSSEC is half set up: your DNS provider signs it, but the registry has no DS record yet, so nothing checks the signatures." In a batch of real reports, three of four sites had DNSSEC half set up in exactly this way.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free