Free tool · no signup
DNSSEC checker
We look up your domain through public validating resolvers and check whether its DNS answers are signed, whether the chain of trust from the parent zone holds, and whether the signing algorithm is up to date.
Only public pages are read. Results are not stored.
How to switch on DNSSEC
- Find who hosts your DNS — the nameservers shown in the results above.
- Turn on DNSSEC with that provider (see the provider list below).
- If your registrar is a different company from your DNS host, copy the DS record your DNS provider gives you into the registrar's DNSSEC section.
- Wait up to 24 hours for the record to take effect, then run this check again.
- Use a modern signing algorithm such as ECDSA P-256 (13) or Ed25519 (15).
- Cloudflare: Dashboard → your domain → DNS → Settings → Enable DNSSEC (one click; the DS record is published for you).
- AWS Route 53: Hosted zone → DNSSEC signing → Enable. Copy the DS record it shows to your registrar.
- GoDaddy: Domain settings → DNS → DNSSEC → add the DS record your DNS host gives you.
- Namecheap: Domain list → Manage → Advanced DNS → DNSSEC → paste the DS record.
- 123-reg: Domain → DNS management → DNSSEC → paste the DS record.
- Squarespace / Wix: Domain settings → DNSSEC → paste the DS record.
- Other providers: Look for a DNSSEC section in your DNS provider's settings and follow its own signing or DS-record instructions.
Frequently asked questions
- What is DNSSEC?
- DNSSEC adds digital signatures to your domain's DNS answers, so resolvers can tell that an address for your site or email server really came from you and wasn't forged.
- Is an unsigned domain a problem?
- Most domains are still unsigned, so it isn't urgent. Signing removes a class of DNS spoofing attacks and is usually a single switch with your DNS provider.
- Why is a broken DNSSEC setup critical?
- If the registrar has a DS record that no longer matches your zone, resolvers that check DNSSEC will refuse to answer, and many visitors won't be able to load your site at all.
- Can I check a lovable.app address?
- No. Platform addresses are managed by the host, not you. Check your own custom domain instead.
- Does SaaS Sentinel check this automatically?
- Yes. The daily Public exposure check for each app with a custom domain includes the same DNSSEC test, and a broken chain raises an alert.
More free tools
Lovable security checker
Leaked secret keys, exposed .env files, source maps and security headers.
Link preview checker
How your link looks when shared on Google, X, LinkedIn, Facebook and Slack.
CORS checker
Whether other websites can read your app's responses or use your visitors' logins.
404 page checker
Whether missing pages return a real, branded 404 that helps visitors back.