Is the domain's DNS signed, and does the chain of trust validate? See the DS record, keys and algorithm.
Free — no credit card. Sign in with Google (free) to keep checking and save your results; Lifetime unlocks the full lists.
DNSSEC adds digital signatures to DNS answers so attackers can't send visitors to a fake server by poisoning DNS caches. It works through a chain of trust: the registry publishes a DS record that matches your zone's signing key (DNSKEY).
Nuqti checks the DS record, reads the DNSKEY keys and their algorithm, and asks a validating resolver whether the answers verify. A broken chain is worse than no DNSSEC — validating resolvers will refuse to answer.
It's recommended for banks, governments and any domain where DNS spoofing is a risk. Most registrars and DNS hosts enable it with one click.
A DS record exists at the registry but the zone isn't signed with a matching key — usually after changing DNS host without removing the old DS. Validating resolvers then fail to resolve your domain.
The zone is signed (DNSKEY exists) but no DS at the registry, so nobody validates it yet. Add the DS record at your registrar.
ECDSA P-256 (13) or Ed25519 (15) are modern and compact. RSA/SHA-1 algorithms (5, 7) are outdated.
Site Explorer, Keywords Explorer, Site Audit, Rank Tracker and AI visibility — one sign-in with Google, no card.
100% free
Live data
Every number explained
English & Arabic
Start free with Google