DNSSEC Readiness Checker

Evaluate supplied DNSKEY, DS, RRSIG, denial-of-existence, and signing-algorithm evidence for DNSSEC chain readiness.

Inputs

• domains
• maxDomains
• includeReport
• maxChargeUsd

{
  "domains": [
    {
      "domain": "cloudflare.com",
      "dnskeyFound": true,
      "dsFound": true,
      "rrsigFound": true,
      "nsecMode": "NSEC",
      "algorithms": [
        "ECDSAP256SHA256 (13)"
      ]
    }
  ],
  "maxDomains": 1,
  "includeReport": true,
  "maxChargeUsd": 1
}

The bundled exact input records authenticated DNSKEY, DS, RRSIG, and NSEC observations for cloudflare.com from Google DNS-over-HTTPS at 2026-07-12T05:17:40Z.

Dataset

The actor emits structured, actor-specific evidence rows. Empty source input produces no dataset rows.

Billing

This actor uses pay-per-event billing with platform usage included in the configured event prices:

• actor-start
• domain-audited
• record-extracted
• finding-emitted
• audit-report-generated

Every dataset row and report artifact is charge-gated. A zero-dollar cap stops before work with no paid output.

Use Cases

• Verify a complete DNSSEC chain
• Find a missing parent DS record
• Find missing DNSKEY evidence
• Check supplied DNSSEC signing algorithms
• Export DNSSEC chain readiness evidence

Limitations

The actor evaluates supplied DNSSEC observations and does not query authoritative or parent DNS. It reports chain components but does not cryptographically validate signatures.