---
title: "DNSSEC validation"
method: GET
path: "/dns/dnssec"
tags: ["dns"]
---

# DNSSEC validation

`GET /dns/dnssec`

## Request

- Base URL: `https://intodns.ai/api`
- URL: `https://intodns.ai/api/dns/dnssec`
- Auth: none required

Validate DNSSEC chain of trust for a domain.

## Query parameters

- `domain` string, required

## Response `200`

DNSSEC validation result

- DNSSECResult
  - `domain` string
  - `signed` boolean: Whether the domain has DNSKEY records (DNSSEC enabled)
  - `valid` boolean: Whether DNSSEC validation passes (AD flag set by resolver)
  - `chain` object[]: DNSKEY and DS records forming the chain of trust
    - `domain` string
    - `algorithm` integer
    - `digestType` integer: 0 for DNSKEY, 1=SHA-1, 2=SHA-256, 4=SHA-384 for DS
    - `digest` string
    - `flags` integer: DNSKEY flags (256=ZSK, 257=KSK)
    - `protocol` integer
    - `publicKey` string
  - `nsec3param` object: NSEC3 parameter check results
    - `exists` boolean
    - `hashAlgorithm` integer
    - `flags` integer
    - `iterations` integer
    - `salt` string
    - `rfc9276Compliant` boolean
    - `issues` object[]
  - `rrsig` object: RRSIG signature check results
    - `exists` boolean
    - `records` object[]
      - `typeCovered` string
      - `algorithm` integer
      - `originalTTL` integer
      - `daysUntilExpiry` integer
      - `isExpired` boolean
    - `algorithmSecurity` 'modern' | 'acceptable' | 'deprecated' | 'insecure' | 'unknown'
    - `issues` object[]
  - `errors` string[]

## Other responses

- `400`: Invalid request

---

[API](https://skmtc.dev/intodns/apis/intodns-ai-api.md) · [All operations](https://skmtc.dev/intodns/apis/intodns-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/intodns/apis/intodns-ai-api/revisions/c6c196b2fb4c?raw)