How does the tool verify the DNSSEC root anchor?

It matches published root DNSKEY records against embedded IANA trust anchors (KSK-2017 tag 20326 and KSK-2024 tag 38696) using SHA-256 digests.

Does the tool perform full cryptographic signature verification locally?

No, it recomputes and validates DS-to-DNSKEY cryptographic digests locally while relying on DoH resolver AD flags and 32-bit timestamp calculations for RRSIG validity.

What happens if a domain has no DNSSEC configured?

The report marks the delegation as unsigned or insecure, highlighting the absence of DS records in the parent zone while returning available RDAP data.

Which DNS-over-HTTPS resolvers can be selected?

You can choose Auto (with failover), AliDNS, Cloudflare 1.1.1.1, or Google Public DNS.

Can I run a DNSSEC check without querying RDAP?

Yes, unchecking the 'Include RDAP registry data' option restricts the audit strictly to DNSKEY, DS, and RRSIG chain validation.

Elysia Tools

Navigation

Network

DNSSEC Chain & RDAP Trust Auditor

Audit a domain end to end: IANA RDAP bootstrap referral, registry/registrar WHOIS data, and the DNSSEC chain of trust from the root KSK through the TLD DS to the apex DNSKEY — with DS digest verification and RRSIG expiry flags.

Details

What this tool helps you do

The auditor walks the full trust chain of a domain in nine pass/fail steps. It starts at the IANA RDAP bootstrap registry (data.iana.org/rdap/dns.json) to discover the authoritative registry server for the TLD, then queries that registry over RDAP for registration data — registrar entity, creation/expiry events, EPP status codes, nameservers, and the registry’s secureDNS view. In parallel the DNSSEC side resolves through DNS-over-HTTPS (AliDNS with Cloudflare/Google failover, selectable): it fetches the root DNSKEY set and verifies the SHA-256 DS digests of the embedded root trust anchors (KSK-2017 tag 20326 and KSK-2024 tag 38696, matching the published IANA root-anchors.xml), then walks down — the DS the root publishes for the TLD is recomputed from the TLD DNSKEY RDATA, and the DS the TLD publishes for the domain is recomputed from the apex DNSKEY RDATA, byte for byte. Mismatches, expired or near-expiry RRSIG signatures (serial-number arithmetic over the 32-bit time fields), unsigned delegations and missing DS records are each flagged with their exact key tags, algorithms and computed digests. Note the scope: DS↔DNSKEY digest matching is the cryptographic glue of the delegation chain; full per-RRset RRSIG signature validation is reported via the resolver’s AD flag and expiry checks rather than local RSA/ECDSA verification.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Samples

DNSSEC Chain & RDAP Trust Auditor

What this tool helps you do

Run this tool

Examples that match this tool

Continue with connected tools and hubs

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Overview

When to use

How it works

Use cases

Examples

1. End-to-End Audit for a Signed Commercial Domain

2. Isolated DNSSEC Chain Validation

FAQ

Zero Trust Architecture Samples

Web Image Processing Python Samples

Android Image Processing Java Samples

Android Image Processing Kotlin Samples

Webhook Debugger & Relay

HTTP Link Header RFC 8288 Parser and Pagination Crawler Preview

MAC OUI Vendor Lookup

NB-IoT LTE-M Cat-M1 CoAP LwM2M Cellular IoT Packet Analyzer