Privacy controls
CyberFurl can load analytics only after you opt in. Core product features work without analytics consent.
Verify DNSSEC (Domain Name System Security Extensions) status for any domain. Check signing status, algorithms, key tags, and DS records to ensure DNS integrity.
DNSSEC (Domain Name System Security Extensions) adds cryptographic signatures to DNS records to prevent attackers from spoofing DNS responses and redirecting traffic to malicious servers. It creates a chain of trust from the root DNS servers down to the authoritative name servers for a domain, ensuring that DNS responses are authentic and have not been tampered with.
Without DNSSEC, an attacker who compromises or poisons a DNS resolver can redirect your users to phishing sites, intercept email, or perform man-in-the-middle attacks. DNSSEC prevents this by cryptographically verifying every DNS response.
Not enabling DNSSEC at the registrar after signing the zone, using weak algorithms (RSA/SHA1 instead of RSA/SHA256 or ECDSA), failing to update DS records after key rollovers, and not monitoring for DNSSEC validation failures are common oversights.
Type the domain to check DNSSEC status.
We trace the DNSSEC chain of trust from root servers.
Zone signatures, DS records, and key tags are verified.
DNSSEC enabled/missing, algorithm, and key details are shown.
Verifies the complete DNSSEC chain from the root DNSKEY down to the target domain's DS and DNSKEY records. Detects broken trust chains and missing signatures.
Identifies the cryptographic algorithm used for signing (e.g., RSA/SHA-256, ECDSA P-256). Flags deprecated or weak algorithms that should be upgraded.
Validates the DS (Delegation Signer) record at the parent zone and checks the digest type and key tag. The DS record is what bootstraps DNSSEC trust for a domain.
Displays the key tag identifier and digest hash for the domain's DNSKEY. Use this to verify your registrar has published the correct DS record.
Confirms whether the DNS zone itself is signed with RRSIG records. Unsigned zones cannot benefit from DNSSEC protection regardless of DS record presence.
Provides a clear pass/fail summary indicating whether DNSSEC is properly configured and the chain of trust validates end-to-end from the root to your domain.
Automate DNSSEC chain validation, track key rollovers, detect algorithm deprecation, and get alerted when DNSSEC signatures expire or the chain of trust breaks.