DNSSEC Validator

Validates a domain's DNSSEC chain of trust in one API call. Checks DS delegation records at the parent zone, DNSKEY presence with KSK and ZSK classification, RRSIG coverage on common record types, and AD bit support from public recursive resolvers. Returns a readiness score, letter grade, and actionable recommendations.

Use cases

• Security audits for DNSSEC deployment across client domains.
• Compliance checks for DNS chain-of-trust standards.
• Onboarding validation when enabling DNSSEC on a new domain or registrar.
• Post-deploy monitoring for DNSSEC key rollovers and DS/DNSKEY drift.
• Email infrastructure checks pairing with SPF, DMARC, and DKIM audits.

Input

Field	Type	Required	Description
startUrl	string	Yes	Public domain or URL to validate. The actor extracts the hostname and checks DNS DS, DNSKEY, and RRSIG records. HTTP and HTTPS only. Private IP ranges are blocked.
recordTypes	array	No	Optional list of DNS record types to check for RRSIG coverage. If empty, the actor checks A, AAAA, MX, TXT, and DNSKEY.
timeoutSeconds	integer	No	Timeout for each DNS lookup. Default: 10, range: 3 to 30.

Output

Each run pushes one dataset item.

Field	Type	Description
inputUrl	string	Original input URL or domain.
domain	string	Extracted domain name used for DNS lookups.
checkedAt	string	ISO timestamp for the audit.
dsAtParent	object	DS delegation records at parent zone (see below).
dnskey	object	DNSKEY records at the zone with KSK/ZSK classification (see below).
rrsigCoverage	object	RRSIG coverage check results (see below).
adBitCheck	object	Recursive resolver AD bit support check.
score	integer	DNSSEC readiness score from 0 to 100.
grade	string	Letter grade from A to F.
issues	array	Human-readable issues found.
recommendations	array	Recommended fixes.
error	string or null	Error message, if any.

DS at parent object

Field	Type	Description
found	boolean	Whether DS records exist at the parent zone.
parentDomain	string	The parent domain where DS was queried.
recordCount	integer	Number of DS records found.
records	array	Parsed DS records with keyTag, algorithm, digestType, and truncated digest.
issues	array	DS-specific issues.

DNSKEY object

Field	Type	Description
found	boolean	Whether DNSKEY records exist at the zone.
keyCount	integer	Total number of DNSKEY records.
keySigningKeys	array	KSK records (flags bit 15 set, flags 257).
zoneSigningKeys	array	ZSK records (flags bit 7 set, flags 256).
records	array	All parsed DNSKEY records with flags, algorithm, keyTag, and truncated public key.
issues	array	DNSKEY-specific issues.

RRSIG coverage object

Field	Type	Description
checked	array	Record types checked for RRSIG coverage.
signed	array	Record types with RRSIG signatures present.
unsigned	array	Record types with answers but no RRSIG.
details	array	Per-type check results with hasAnswer and signed booleans.
issues	array	RRSIG-specific issues.

AD bit check object

Field	Type	Description
supported	boolean or null	Whether the recursive resolver returned the AD bit (DNSSEC validation enforced upstream).
issues	array	AD bit specific issues.

Example input

{
  "startUrl": "https://example.com",
  "recordTypes": [],
  "timeoutSeconds": 10
}

Example output

{
  "inputUrl": "https://example.com",
  "domain": "example.com",
  "checkedAt": "2026-08-11T00:00:00.000Z",
  "dsAtParent": {
    "found": true,
    "parentDomain": "com",
    "recordCount": 1,
    "records": [
      { "keyTag": 49822, "algorithm": 13, "digestType": 2, "digest": "2e9a5d3c..." }
    ],
    "issues": []
  },
  "dnskey": {
    "found": true,
    "keyCount": 2,
    "keySigningKeys": [
      { "flags": 257, "algorithm": 13, "keyTag": 49822, "protocol": 3, "publicKey": "MIIBIjANBgk..." }
    ],
    "zoneSigningKeys": [
      { "flags": 256, "algorithm": 13, "keyTag": 31406, "protocol": 3, "publicKey": "MIIBIjANBgk..." }
    ],
    "records": [
      { "flags": 257, "algorithm": 13, "keyTag": 49822, "protocol": 3, "publicKey": "MIIBIjANBgk..." },
      { "flags": 256, "algorithm": 13, "keyTag": 31406, "protocol": 3, "publicKey": "MIIBIjANBgk..." }
    ],
    "issues": []
  },
  "rrsigCoverage": {
    "checked": ["A", "AAAA", "MX", "TXT", "DNSKEY"],
    "signed": ["A", "AAAA", "MX", "TXT", "DNSKEY"],
    "unsigned": [],
    "details": [
      { "type": "A", "hasAnswer": true, "signed": true },
      { "type": "AAAA", "hasAnswer": true, "signed": true },
      { "type": "MX", "hasAnswer": true, "signed": true },
      { "type": "TXT", "hasAnswer": true, "signed": true },
      { "type": "DNSKEY", "hasAnswer": true, "signed": true }
    ],
    "issues": []
  },
  "adBitCheck": {
    "supported": true,
    "issues": []
  },
  "score": 100,
  "grade": "A",
  "issues": ["1 DS record(s) found at parent zone", "DNSSEC chain of trust appears complete: DS at parent, DNSKEY with KSK+ZSK, RRSIG on checked types"],
  "recommendations": [],
  "error": null
}

Security

• Accepts only public HTTP and HTTPS URLs or domains.
• Rejects URL credentials.
• Rejects localhost, private IPv4, private IPv6, link-local, and private DNS resolutions.
• Performs DNS DS, DNSKEY lookups and DNS-over-HTTPS RRSIG queries only; does not fetch URLs or require login.
• RRSIG queries use Cloudflare's public DNS-over-HTTPS endpoint (1.1.1.1) with no authentication.
• Does not collect credentials or private data.

Pricing

Suggested pay-per-event pricing:

Event	Price
Actor start	$0.005
Domain validated	$0.01

Typical one-domain run cost: about $0.015 before Apify platform charges. Apify keeps its standard commission and the actor owner receives the remainder.

FAQ

Does this perform full cryptographic DNSSEC validation?

No. It checks for the presence and coverage of DS records at the parent zone, DNSKEY records with KSK/ZSK classification, and RRSIG signatures on common record types. Full cryptographic chain validation (verifying RRSIG signatures against DNSKEY public keys) is not performed. This actor is designed for monitoring and alerting, not forensic validation.

What record types are checked for RRSIG coverage?

By default, A, AAAA, MX, TXT, and DNSKEY. You can pass custom record types via the recordTypes input.

How does the AD bit check work?

The actor queries a public DNS-over-HTTPS resolver (Cloudflare 1.1.1.1) and checks whether the response includes the AD (Authenticated Data) bit, which indicates the resolver validated the DNSSEC chain. This tells you whether upstream resolvers enforce DNSSEC validation.

Does it fetch the domain's website?

No. It only performs DNS lookups (DS, DNSKEY) and DNS-over-HTTPS queries (RRSIG, AD bit). The URL input is used to extract the domain name safely.

What is the scoring based on?

The score starts at 100 and is reduced for missing DS at parent (-35), missing DNSKEY (-35), missing KSK (-15), missing ZSK (-10), missing RRSIG coverage (up to -45), and missing AD bit support (-10).

Kill or keep metric

Keep this actor if it gets organic Store impressions, runs, revenue, or inbound questions within 60 to 90 days. Improve the listing or pricing if impressions arrive without runs. Archive it if there is no discovery or usage.