Free DNSSEC / DANE Checker
Validate DNSSEC Signing & DANE Records
Check any domain's DNSSEC status and DANE/TLSA records for its mail servers.
Verify your DNSSEC chain of trust and whether your MX hosts publish valid TLSA records.
About Free DNSSEC / DANE Checker by DMARKOFF
Our free DNSSEC & DANE Checker verifies whether your domain has DNSSEC enabled and whether your mail servers publish DANE/TLSA records.
It checks the DNSSEC chain of trust, determines whether a valid DS record is present, and looks for TLSA records at each MX host.
If an issue is found, you'll see exactly what's wrong or missing and how to fix it.
What Are DNSSEC and DANE?
DNSSEC (Domain Name System Security Extensions) protects DNS records from tampering by adding cryptographic signatures that allow resolvers to verify the data is authentic. It secures the DNS records email relies on, including SPF, DKIM, DMARC, and MX, helping protect email authentication from spoofing and DNS cache poisoning attacks.
DNSSEC works by creating a chain of trust between your domain and the DNS root. This requires both a DNSKEY record published by your DNS provider and a matching DS record published by your domain registrar. If either is missing or doesn't match, DNSSEC validation fails.
DANE (DNS-Based Authentication of Named Entities) is a security technology that builds on DNSSEC, allowing domains to publish TLSA records that specify which TLS certificates their mail servers should use. This helps protect SMTP connections against certificate substitution and downgrade attacks. Because DANE relies on authenticated DNS data, it only works when DNSSEC is properly configured.
What DNSSEC / DANE Checker Detects
✓ Confirms your domain exists and has valid name servers
✓ Checks whether DNSSEC is enabled for your domain
✓ Verifies the DNSSEC chain of trust, including DS record validation
✓ Checks every MX host for published DANE/TLSA records
✓ Validates TLSA record syntax, usage, selector, and matching type
✓ Explains missing or misconfigured records and provides the exact fix
Why Choose Free DNSSEC / DANE Checker
Free to use — no signup required for the DNSSEC / DANE check.
Instant results — a full DNSSEC / DANE lookup takes seconds.
Session history — check records for multiple domains and compare results on a single page.
FAQ
DNSSEC adds cryptographic signatures to DNS records so resolvers can verify they haven't been altered or spoofed in transit.
DANE relies on DNSSEC to authenticate TLSA records. Without DNSSEC, TLSA records can be spoofed, so receiving mail servers can't trust the certificate information they contain.
Yes. DANE relies on DNSSEC's chain of trust to guarantee the TLSA record itself is authentic. Publishing TLSA records without DNSSEC enabled provides no protection.
A DNSSEC chain of trust links your domain to the DNS root through matching DNSKEY and DS records. If either record is missing or doesn't match, DNSSEC validation fails even if your zone is signed.
First, make sure DNSSEC is enabled for your domain, since DANE depends on a valid DNSSEC chain of trust. Then publish a TLSA record at _25._tcp.
DNSSEC requires both a signed DNS zone and a matching DS record published by your domain registrar. If the DS record is missing, the DNSSEC chain of trust can't be established, and your domain will appear as not signed.
Many domains don't publish DANE/TLSA records because DANE requires DNSSEC to be enabled first. Once DNSSEC is configured, publish a TLSA record for each MX host so receiving mail servers can verify your SMTP certificates.