# DNSSEC Chain & RDAP Trust Auditor

Audit a domain end to end: IANA RDAP bootstrap referral, registry/registrar WHOIS data, and the DNSSEC chain of trust from the root KSK through the TLD DS to the apex DNSKEY — with DS digest verification and RRSIG expiry flags.

> Canonical page: https://elysiatools.com/en/tools/whois-rdap-dnssec-chain-validator-and-iana-bootstrap-trust-auditor

- **Category:** Network

- **Keywords:** dnssec validator, dnssec chain of trust, rdap lookup, whois rdap, ds record check, dnskey validation, rrsig expiry, root trust anchor, domain audit, iana bootstrap

## Overview

The auditor walks the full trust chain of a domain in nine pass/fail steps. It starts at the IANA RDAP bootstrap registry (data.iana.org/rdap/dns.json) to discover the authoritative registry server for the TLD, then queries that registry over RDAP for registration data — registrar entity, creation/expiry events, EPP status codes, nameservers, and the registry’s secureDNS view. In parallel the DNSSEC side resolves through DNS-over-HTTPS (AliDNS with Cloudflare/Google failover, selectable): it fetches the root DNSKEY set and verifies the SHA-256 DS digests of the embedded root trust anchors (KSK-2017 tag 20326 and KSK-2024 tag 38696, matching the published IANA root-anchors.xml), then walks down — the DS the root publishes for the TLD is recomputed from the TLD DNSKEY RDATA, and the DS the TLD publishes for the domain is recomputed from the apex DNSKEY RDATA, byte for byte. Mismatches, expired or near-expiry RRSIG signatures (serial-number arithmetic over the 32-bit time fields), unsigned delegations and missing DS records are each flagged with their exact key tags, algorithms and computed digests. Note the scope: DS↔DNSKEY digest matching is the cryptographic glue of the delegation chain; full per-RRset RRSIG signature validation is reported via the resolver’s AD flag and expiry checks rather than local RSA/ECDSA verification.

## Inputs

- **Domain name** (text): example.com
- **DoH resolver** (select)
- **Include RDAP registry data** (checkbox)

## When to use

- When enabling or rolling over DNSSEC keys to ensure the parent zone publishes matching DS digests before cutting over.
- When troubleshooting DNS resolution failures caused by broken DNSSEC delegation chains or expired RRSIG records.
- When auditing domain ownership, registrar metadata, EPP status codes, and cryptographic trust status in a single workflow.

## How it works

- Discovers the authoritative TLD RDAP server through IANA's bootstrap registry (data.iana.org/rdap/dns.json) and queries registrar details, status codes, and secureDNS records.
- Queries DNS-over-HTTPS resolvers (AliDNS, Cloudflare, or Google) to fetch root, TLD, and apex DNSKEY and DS resource record sets.
- Recomputes SHA-256 digests byte-for-byte from DNSKEY RDATA and matches them against published DS records at each delegation tier.
- Evaluates RRSIG expiration timestamps and resolver Authenticated Data (AD) flags to flag expiring signatures or broken trust chains.

## Use cases

- Pre-deployment validation during DNSSEC key rollover to prevent domain-wide NXDOMAIN outages.
- Security compliance verification of TLD-to-apex chain integrity and registrar EPP lock flags.
- Rapid diagnostics for resolving DNS validation failures reported by validating recursive resolvers.

## Frequently asked questions

### How does the tool verify the DNSSEC root anchor?

It matches published root DNSKEY records against embedded IANA trust anchors (KSK-2017 tag 20326 and KSK-2024 tag 38696) using SHA-256 digests.

### Does the tool perform full cryptographic signature verification locally?

No, it recomputes and validates DS-to-DNSKEY cryptographic digests locally while relying on DoH resolver AD flags and 32-bit timestamp calculations for RRSIG validity.

### What happens if a domain has no DNSSEC configured?

The report marks the delegation as unsigned or insecure, highlighting the absence of DS records in the parent zone while returning available RDAP data.

### Which DNS-over-HTTPS resolvers can be selected?

You can choose Auto (with failover), AliDNS, Cloudflare 1.1.1.1, or Google Public DNS.

### Can I run a DNSSEC check without querying RDAP?

Yes, unchecking the 'Include RDAP registry data' option restricts the audit strictly to DNSKEY, DS, and RRSIG chain validation.

## Related tools

- [Webhook Debugger & Relay](https://elysiatools.com/en/tools/webhook-debugger-relay): Generate a unique webhook capture URL, inspect incoming requests, validate signatures, and replay payloads to a target endpoint
- [HTTP Link Header RFC 8288 Parser and Pagination Crawler Preview](https://elysiatools.com/en/tools/http-link-header-rfc8288-parser-and-pagination-crawler-preview): Parse RFC 8288 Link headers with the spec appendix-B algorithm, resolve relative URI-references against a base URL, classify rel types against the IANA registry, validate preload/prefetch hints, and simulate how a rel="next" pagination crawler walks your responses — including cycle detection.
- [MAC OUI Vendor Lookup](https://elysiatools.com/en/tools/mac-oui-vendor-lookup): Look up the manufacturer of a MAC address from the IEEE OUI database, or reverse-search a company name to list all its OUI blocks — fully offline
- [NB-IoT LTE-M Cat-M1 CoAP LwM2M Cellular IoT Packet Analyzer](https://elysiatools.com/en/tools/nb-iot-lte-m-cat-m1-coap-lwm2m-cellular-iot-packet-analyzer): Decode hex captures from cellular IoT devices: CoAP headers/options (block-wise, Observe), LwM2M TLV object trees with registry names, SMS-DELIVER UDH port addressing unwrapping CoAP-over-SMS, link-format registrations and DTLS record summaries.
- [Wi-Fi Channel Overlap Planner](https://elysiatools.com/en/tools/wifi-channel-overlap-planner): Plan 2.4, 5, and 6 GHz Wi-Fi channels from measured AP channels, widths, and RSSI, with overlap, DFS, and PSC warnings.
- [AI Domain Name Idea Generator](https://elysiatools.com/en/tools/ai-domain-name-idea-generator): Generate up to 10 creative domain names with AI and filter out already-registered ones via DNS + RDAP.
- [APNG IDAT/fdAT Chunk, Streaming Deflate Replay and Disposal Method Frame-Timing Analyzer](https://elysiatools.com/en/tools/apng-idat-fdat-chunk-streaming-deflate-replay-and-disposal-method-analyzer): Upload a PNG or APNG and audit the whole animation structure: PNG signature and per-chunk CRC32 checks, IHDR bit depth / color type / interlace, acTL placement and declared frame counts, every fcTL (region bounds inside the canvas, normalized delay fractions, dispose_op none/background/previous, blend_op source/over), the shared fcTL+fdAT sequence-number contract from 0, per-frame replay of the IDAT/fdAT deflate streams with exact decompressed-size verification, and disposal-semantics audit — first-frame PREVIOUS treated as BACKGROUND, zero-delay frames, loop counts, fps and compression ratios.
- [Claim–Evidence–Citation Mapper](https://elysiatools.com/en/tools/claim-evidence-citation-mapper): Extract factual claims from a document, map each to its footnote/link/reference evidence, and flag unsourced, weak-source, duplicate-citation, and ambiguous-scope claims

## Samples

- [Zero Trust Architecture Samples](https://elysiatools.com/en/samples/zero-trust-samples): Comprehensive Zero Trust architecture samples covering identity authentication, network segmentation, micro-segmentation strategies, and secure access control
- [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion
- [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion
- [Android Image Processing Kotlin Samples](https://elysiatools.com/en/samples/android-image-processing-kotlin): Android Kotlin image processing examples including reading/saving images, scaling, and format conversion