Validate a domain's DNSSEC chain of trust: DS/DNSKEY/RRSIG, signing algorithms, expiry, and trust statusagi和ai的区别
• Domain: enter a bare domain without https:// (e.g. cloudflare.com)
• Validates the DNSSEC chain of trust via Cloudflare / Google validating resolvers
• Unsigned is a normal state; bogus means signature validation failed and needs attention
DNSSEC validation checks whether a domain has enabled DNS Security Extensions and whether the full chain of trust — from the root zone through the TLD to the domain's own DNSKEY — is intact. It returns the trust status (secure, insecure, or bogus), the DS and DNSKEY records, the RRSIG signatures and their expiry, and any warnings about weak algorithms or broken chains.智普ai
Common uses include confirming that DNSSEC is correctly configured after enabling it, diagnosing 'bogus' status caused by a broken chain or expired RRSIG, auditing algorithm strength when migrating from RSASHA1 to ECDSAP256SHA256, and verifying that a recently added DS record at the TLD registry has propagated correctly.京灵平台官网
'Secure' means the domain has DNSSEC enabled and the chain of trust validates successfully. 'Insecure' means there is no DNSSEC delegation from the parent zone — the domain is unsigned, which is normal for most domains. 'Bogus' means DNSSEC is configured but validation fails, which is a configuration error that needs fixing.chart gpt
Most domains do not use DNSSEC. Without it, DNS responses are not authenticated and could theoretically be spoofed. Whether the risk justifies the operational complexity of DNSSEC depends on your use case.saylo国际版
Common causes include an expired RRSIG signature (DNSSEC records need regular resigning), a DS record at the parent that does not match the zone's DNSKEY, or a missing DNSKEY after key rollover. Check the RRSIG expiry and DS/DNSKEY match in the result.ai是人工智能吗
RRSIG records have a signature validity window, typically 7 to 30 days, depending on the operator's key rollover policy. Most DNS hosting providers automatically resign records. If you manage your own zone, ensure your signing process runs before signatures expire.豆包和ai哪个更好