chain breaks， NXDOMAIN。

one per line or comma-separated. Click Validate. You'll be taken to a results page showing the validation status for each domain. For domains that fail validation， misconfigured keys. error — A query or resolver error occurred (timeout。

expand "DNSViz details" and use "Download raw JSON" to save the full diagnostic output. Learn moreBallot SC-085v2 The CA/Browser Forum ballot SC-085v2 (Require Validation of DNSSEC for CAA and DCV Lookups) mandates that Certificate Authorities validate DNSSEC when present when retrieving CAA records and performing DNS-based Domain Control Validation (DCV). CAs treat domains with no DNSSEC (insecure) as simply unsigned and still proceed with DCV and CAA checks. This reduces risk from DNS spoofing and BGP hijacking. The ballot is effective 15 March 2026. Domain owners who enable DNSSEC can better harden their DCV process. 。

CAs interpret "insecure" as no DNSSEC configured and continue with DCV or CAA checks. bogus — DNSSEC validation failed; do not trust the response. Possible causes: expired signatures。

additional diagnostics are available in the DNSViz details section. UltraDNS customers: DNSSEC setup guide. Status meanings secure — DNSSEC validation succeeded; the domain's DNS records are properly signed and verified. insecure — The domain is not signed with DNSSEC， etc.). Results Download the full results as JSON. For domains that fail validation， the checker reports insecure. When ordering certificates for that domain， What is DNSSEC Health? DNSSEC Health validates DNSSEC for domain names. DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records so resolvers can verify that responses haven't been tampered with. This tool checks whether domains are properly signed and reports validation status and diagnostics. How to use Enter fully qualified domain names (e.g. example.com or sub.example.com)， or the resolver couldn't verify it (e.g. no AD bit). If you don't configure DNSSEC for a domain，。