Best free DNSSEC checkers

AdminKit is built by Netbase JSC. AdminKit is listed below; the other tools are independent.

Criteria and how we weighted them

This roundup ranks five free tools against four published criteria, in priority order:

1. Free, no account required for at least one domain check — a tool that fails this outright still gets listed if it’s well known, but ranks behind every tool that passes.
2. Diagnostic depth: whether the tool shows a full chain-of-trust diagram or itemized errors, or only a summary verdict — the difference between seeing exactly where a signature chain breaks and just learning that it’s broken.
3. Advanced troubleshooting options: whether you can test with a custom trust anchor or an alternate authoritative nameserver, useful specifically when debugging a key rollover before it’s fully live.
4. Automation: whether a documented CLI or API exists for scripting checks across many domains, versus a one-domain-at-a-time web form.

Ranking from those criteria, not from preference, is why AdminKit sits last of five rather than first: AdminKit’s own DNSSEC check returns a plain secure, insecure or bogus verdict and nothing else — no chain diagram, no custom trust-anchor option, no documented API — while every other tool in this roundup beats it on at least one of those three remaining criteria, confirmed from each tool’s own page. The table below shows the same facts by feature; the list underneath explains each tool’s placement.

The ranked list, explained

1. DNSViz — the deepest diagnostic view in this roundup. Per its own homepage, read 2026-11-07, DNSViz provides “a visual analysis of the DNSSEC authentication chain for a domain name and its resolution path in the DNS namespace, and it lists configuration errors detected by the tool” — a graph of the chain itself, not just a pass/fail result, plus a named list of what’s wrong when something is. It’s free, needs no login (you type a domain directly into the form), and its source has been open on GitHub since Sandia National Laboratories originally built it in 2010; VeriSign, Inc. maintained it from 2014–2016, and Casey Deccio has maintained it since 2016. No documented public API was found on the pages read for this comparison, and it has no option to supply a custom trust anchor or alternate nameserver.

2. Verisign Labs’ DNSSEC Debugger — close behind on depth, and ahead of DNSViz on one specific troubleshooting feature. Per its own page, read 2026-11-07, you “paste a DS or DNSKEY record into the field above to use a Trust Anchor that is not published in the DNS,” and may “supply alternative starting name servers” that are “authoritative for the same zone as the Trust Anchor” — exactly the scenario when testing a new key or a nameserver change before it’s live and publicly resolvable. Results show with an expandable “more/less” detail toggle rather than a visual chain diagram. It’s free, no login required, and the footer states ”© 2011-2026 VeriSign, Inc.” (the same organization that maintained DNSViz for two years, before DNSViz moved to independent maintenance).

3. Zonemaster — the most automatable option here. Per its own homepage and GitHub repository, both read 2026-11-07, Zonemaster “investigates the state of the domain name from the top to the bottom of the DNS tree,” checking DNSSEC signatures alongside nameserver accessibility and IP address validity as part of a broader DNS delegation audit — not a DNSSEC-only tool like DNSViz or the Debugger. It’s jointly developed by AFNIC and IIS (the Swedish Internet Foundation), open source under a 2-clause BSD license, and its repository documents a Command Line Interface and a JSON/RPC API alongside its web UI — the clearest automation story of any tool in this roundup, AdminKit included. It’s free and needs no login.

4. internet.nl — the broadest standards scope, at the cost of DNSSEC-specific depth. Per its own homepage, read 2026-11-07, it tests “whether websites, email systems and internet connections comply with modern standards,” specifically naming “IPv6, DNSSEC, HTTPS, DMARC, STARTTLS and DANE” across separate website, email and connection test categories. It’s “an initiative of the Internet community and the Dutch government” rather than a commercial or single-purpose DNSSEC tool, is free with no login required, and states on its own homepage that it has tested over 917,000 web domains and 465,000 mail domains to date. What its own pages don’t confirm is any DNSSEC-specific visual output or an advanced trust-anchor option — DNSSEC is one signal folded into a combined compliance score, not the focus of a dedicated report.

5. AdminKit — free, no account, and the fastest plain answer of the five. AdminKit’s DNSSEC check sends a real DNS query and returns a live secure, insecure or bogus verdict: secure means the zone’s DNSKEY/DS key material is present and a validating resolver’s probe query came back with the authenticated-data flag set; insecure means no DNSSEC key material exists at all (not a failure, just unsigned); bogus means the key material exists but the signature chain doesn’t currently validate. AdminKit ranks last here specifically because that’s all it does — no chain-of-trust diagram like DNSViz’s, no custom trust-anchor or alternate-nameserver option like the Debugger’s, no CLI or API like Zonemaster’s, and no broader standards context like internet.nl’s. For a plain yes/no/broken answer with nothing else to configure, it’s the quickest of the five; for diagnosing why a chain is broken, it is honestly the shallowest.

Why doesn’t this page include dnssec-name-and-shame.com?

dnssec-name-and-shame.com offers a per-domain DNSSEC check alongside a public leaderboard of compliant and non-compliant organizations, and was reachable when checked for this comparison. It’s left out of the ranked list above because its own page states the site “is being decommissioned” during 2026 after more than twelve years online — recommending a sunsetting tool as one of the best free options available today would not be honest, even though it still works during its wind-down period at verification time.

Best for your specific need

• Seeing exactly where a signature chain breaks, not just that it’s broken: DNSViz’s visual chain diagram.
• Testing an unpublished key or a nameserver change before a rollover goes live: Verisign Labs’ DNSSEC Debugger’s custom trust-anchor and alternate-nameserver options.
• Auditing many domains on a schedule, or wiring DNSSEC checks into your own pipeline: Zonemaster’s CLI and API.
• Checking DNSSEC alongside your email and web standards in one pass: internet.nl’s combined report.
• A quick secure/insecure/bogus answer with nothing to configure: AdminKit’s DNSSEC check.

Where AdminKit is honestly behind

AdminKit’s DNSSEC check does not draw a visual chain-of-trust diagram the way DNSViz does, does not accept a custom trust anchor or alternate nameserver the way Verisign Labs’ DNSSEC Debugger does, and has no CLI or documented API the way Zonemaster does — three concrete gaps against three different tools in this roundup, each sourced from that tool’s own page above. What AdminKit’s check does today is return a live, real-query secure/insecure/bogus verdict in one request, free, with no login and nothing to configure, which is why it’s listed here at all rather than left out — it answers the single most common question (“is this domain’s DNSSEC actually working right now”) plainly, even though it doesn’t go further than that the way its four competitors each do in their own way. See DNSSEC: what it actually protects — and what it doesn’t for the full threat model, and AdminKit’s best free DNS propagation checkers comparison if what you actually need to confirm is that a recent DNS change has finished spreading, not that the zone’s signatures validate. AdminKit’s DNSSEC check sits in AdminKit’s DNS cluster, alongside the DNS lookup and propagation tools this roundup also references.

---

Trademarks belong to their respective owners; AdminKit is not affiliated with Casey Deccio, VeriSign, Inc., AFNIC, the Swedish Internet Foundation (IIS), or the operators of internet.nl.