DNSSEC-check
We bevragen de DS-records in de bovenliggende zone, de DNSKEY-set van de zone en de handtekeningen, en vragen een validerende resolver of het antwoord valideert.
Deze tekst is nog niet beschikbaar in het Nederlands. Hij wordt in het Engels getoond tot er een vertaling is gepubliceerd.
DNSSEC lets a resolver verify that a DNS answer really comes from the zone’s owner. It works as a chain of trust: the parent zone (for example .tr) publishes a DS record that fingerprints the zone’s key-signing key; the zone publishes its keys as DNSKEY records and signs its data with RRSIG records; a validating resolver follows the chain down from the root and sets the AD flag on answers it could verify.
This check queries the DS records at the parent, the DNSKEY set and its signatures, and asks our resolver whether the answer validated. It also checks that a DS record’s key tag matches a key in the zone, the most common thing to break when keys are rolled or a domain moves to a new DNS host.
The .tr zone is signed (its DS record is in the root zone), but most Turkish domains are not: turkiye.gov.tr, btk.gov.tr and metu.edu.tr publish no DS record (checked 2026-11-07). An unsigned domain is not broken; it is simply not protected against forged answers.
Veelgestelde vragen
What does 'signed but not validating' mean?
The parent publishes DS records, but the resolver did not accept the zone's signatures. Validating resolvers then answer SERVFAIL, so the domain can disappear for users of those resolvers. A common cause is a DS record left behind after moving to a DNS host with different keys.
Do I need DNSSEC?
It protects against forged DNS answers (cache poisoning) and is required by some security mechanisms such as DANE. Your DNS host and registrar must both support it.
Why is the result for www.example.com.tr about example.com.tr?
DNSSEC is configured per zone. A host name inside a zone is covered by that zone's keys, so the check reports on the zone that contains the name.