DNSSEC Status Look Up

The DNSSEC status look up combines the three questions that matter into one answer: does the zone publish signing keys (DNSKEY), does the parent zone anchor them (DS), and does a validating resolver actually authenticate the responses?

Domain name

What do you want to look up?

Blacklist Look Up

Looks up whether this domain's IP address (or the IP address you entered) appears on common email blacklists (DNSBL) — being listed can cause outgoing mail to be rejected or sent to spam.

Also look up blacklist status when I run this search

How to use this tool

Pick a lookup type from the dropdown, or type a shortcut straight into the field — e.g. mx:example.com, all:example.com, spf:example.com, whois:example.com — and press Enter.
Enter a domain name (e.g. example.com), or an IP address for PTR and blacklist look ups.
Toggle "Also look up blacklist status" above to include a DNSBL look up alongside your search.
Your last 20 look ups are saved in the History panel so you can revisit them anytime.

Why it matters

DNSSEC failures are uniquely punishing: a broken chain of trust doesn't degrade gracefully — validating resolvers (used by a large share of the internet, including 8.8.8.8 and 1.1.1.1) return SERVFAIL and the domain simply stops resolving for those users. This check distinguishes the three common states: not signed at all (fine, just unprotected), signed but not anchored (wasted effort), and signed but failing validation (an outage in progress).

Examples

Signed + anchored + validating: the healthy end state — DNS answers are cryptographically verified end to end.
DNSKEY present but no DS record: the signatures exist but nothing links them to the chain of trust — publish the DS through your registrar.
DS present but keys mismatched or signatures expired: validating resolvers reject the domain — this is the state that causes mysterious "site works for some people but not others" reports.