What this tool does
DNSSEC (Domain Name System Security Extensions) cryptographically signs a domain's DNS records, so a resolver can verify their authenticity before using them. This tool checks three things: whether the domain publishes a DS record with its registrar (the starting point of the chain of trust), whether it publishes its own DNSKEY records, and whether a DNSSEC-validating resolver actually accepts the signature — the only check that confirms everything works end to end, not just that the right pieces are present.
Why most domains don't have DNSSEC
Unlike HTTPS, whose adoption was pushed hard by browsers (visible warnings, search ranking penalties), nothing comparable exists on the DNSSEC side — most visitors and browsers never notice its absence. Enabling it also requires coordination between two separate parties (the registrar and the DNS host), which is more involved than a one-click SSL certificate. The result: DNSSEC remains a minority setup, even on domains that are otherwise well secured.
Not enabled isn't the same as invalid
A domain that's "not enabled" simply hasn't set up these protections — that's the default status quo, with no immediate consequence. A domain that's "invalid," on the other hand, started the setup but left it in an inconsistent state (often after a DNSSEC key rotation that fell out of sync between the registrar and the DNS host): resolvers that validate DNSSEC strictly will flatly refuse to resolve the domain, making it invisible to some of their visitors with no visible server-side error at all.
What this checker doesn't do
It doesn't reconstruct the full cryptographic chain (DS → DNSKEY → RRSIG) itself — it relies on the validation Cloudflare's public DNS resolver has already performed, the same approach most public DNSSEC checkers take. That's a deliberate trade-off: building end-to-end cryptographic validation in-house would be disproportionate work for a free tool, with no extra practical benefit for the end user.
Enabling DNSSEC on your own domain
Enabling it is a two-step process at most registrars: first turn on DNSSEC on the DNS host's side (which generates the keys and the DNSKEY/RRSIG records), then copy the generated DS record into the registrar's interface to publish the chain of trust. Order matters — publishing the DS record before the DNSKEY records are actually in place will temporarily produce the "invalid" status this tool can detect.