The DNSSEC chain walk the MCP dnssec_chain tool makes, root key set to the answer through one public resolver with checking disabled, a key set a break would rest on read again through a second: the api: link every dnssec_chain answer ends with. Rate-limited; no HEAD

Reads DS and DNSKEY at each zone cut from the root to the answer through one public resolver with checking disabled (Cloudflare's), reads a key set again through a second (Google's) before a break rests on it, and reports the first link that breaks or where the chain goes insecure. Key tags, DS digests and signature windows are compared; signature bytes and denial proofs are not (signaturesVerified and denialProofsChecked are always false). HEAD is not answered.

get/api/dnssec-chain

Request

  • Base URL: https://isitdns.net
  • URL: https://isitdns.net/api/dnssec-chain
  • Auth: none declared

Query parameters

namestring required
typestring

Response

Each signed zone cut, the first break, and every read of the walk (reads) with its time, rcode, flags and answer

completeboolean

No read failed, no label was skipped, and notChecked is empty

walkCompleteboolean

The walk reached the answer read with no failed read and no skipped label

dsMatchedboolean nullable

true: at every signed cut below the root a DS digest matched a DNSKEY a validator uses; false: at one cut every DS was computed against every key read and none matched a usable key (a match only to a revoked key, or to a key without the zone key bit, is false); null: the walk stopped before the target, no cut was read, or a match was not decided (a digest type not computed here, a DS or DNSKEY record not read, fewer keys read than the set holds). Each cut's own result is links[].dsMatch

signatureWindowsInspectedinteger

RRSIG windows compared with the read time

signaturesVerifiedfalse

Signature bytes are not checked against keys

denialProofsCheckedfalse

NSEC and NSEC3 records are counted, not checked

insecureAtstring nullable
notCheckedstring[]
notReadstring nullable

Changes

No recorded changes to this operation across all 1 revision of this API.