DNSSEC Check

What It Does

Fetches DNSKEY, DS, and RRSIG records (with cd=1 to bypass resolver-side validation), parses each per RFC 4034, then performs three layers of validation: (1) structural — algorithm/key-tag/digest-type matching between DS and DNSKEY; (2) cryptographic DS digest — compute SHA-1/256/384 over canonical owner-name + DNSKEY RDATA and compare to the published DS digest; (3) cryptographic RRSIG — reconstruct the canonical signed RRset and verify the signature with Web Crypto using the matching DNSKEY public key. Surfaces RRSIG expiry/inception, weak-algorithm warnings (RFC 8624), revoked-key flags (RFC 5011), and orphaned RRSIGs. Mismatched DS digests or failed signatures correctly downgrade status to `bogus` — validating resolvers will SERVFAIL the zone.

Why It's Useful

Most DNSSEC-checking tools verify only that records *exist* — they trust the upstream resolver's AD bit and never do the math themselves. That gives you a yes/no answer with no detail when something's wrong. EdgeDNS reconstructs the signed RRset and runs the cryptographic verification locally, so when a check fails the response tells you exactly which DS didn't match a DNSKEY (the most common DNSSEC misconfiguration: KSK rolled, parent DS not updated at the registrar) or which RRSIG signature failed. That's the difference between "your zone might be broken" and "your DS digest doesn't match your KSK; here's the correct one to publish at your registrar".

Use Cases

Parameters

Response Fields

Code Examples

curl "https://api.edgedns.dev/v1/dns/dnssec" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "domain=cloudflare.com"

const response = await fetch(
  'https://api.edgedns.dev/v1/dns/dnssec?domain=cloudflare.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.edgedns.dev/v1/dns/dnssec',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'domain': 'cloudflare.com'
    }
)

data = response.json()
print(data)

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.