---
title: "The DNSSEC chain walk the MCP dnssec_chain tool makes, root key set to the answer through one public resolver with checking disabled, a key set a break would rest on read again through a second: the api: link every dnssec_chain answer ends with. Rate-limited; no HEAD"
method: GET
path: "/api/dnssec-chain"
---

# The DNSSEC chain walk the MCP dnssec_chain tool makes, root key set to the answer through one public resolver with checking disabled, a key set a break would rest on read again through a second: the api: link every dnssec_chain answer ends with. Rate-limited; no HEAD

`GET /api/dnssec-chain`

## Request

- Base URL: `https://isitdns.net`
- URL: `https://isitdns.net/api/dnssec-chain`
- Auth: none declared

Reads DS and DNSKEY at each zone cut from the root to the answer through one public resolver with checking disabled (Cloudflare's), reads a key set again through a second (Google's) before a break rests on it, and reports the first link that breaks or where the chain goes insecure. Key tags, DS digests and signature windows are compared; signature bytes and denial proofs are not (signaturesVerified and denialProofsChecked are always false). HEAD is not answered.

## Query parameters

- `name` string, required
- `type` string

## Response `200`

Each signed zone cut, the first break, and every read of the walk (reads) with its time, rcode, flags and answer

- object
  - `complete` boolean: No read failed, no label was skipped, and notChecked is empty
  - `walkComplete` boolean: The walk reached the answer read with no failed read and no skipped label
  - `dsMatched` boolean, nullable: true: at every signed cut below the root a DS digest matched a DNSKEY a validator uses; false: at one cut every DS was computed against every key read and none matched a usable key (a match only to a revoked key, or to a key without the zone key bit, is false); null: the walk stopped before the target, no cut was read, or a match was not decided (a digest type not computed here, a DS or DNSKEY record not read, fewer keys read than the set holds). Each cut's own result is links[].dsMatch
  - `links` object[]: One entry per zone cut read, root first
    - `dsMatch` 'matched' | 'none' | 'undecided' | 'null', nullable: This cut's DS to DNSKEY result, as dsMatched describes; null at the root
    - `readFrom` string[]: The resolvers this cut was read from: server, and a second when it answered a reading of this DNSKEY set
    - `problemsReadFrom` array[]: One per problems entry: the resolvers that problem rests on
      - string[]
    - `keyReadings` unknown[]: Present when the DNSKEY set was read twice: each reading's server, rcode (null when no DNS answer came back; notAsked when the read was never sent, http when the DoH server answered an HTTP error), keys (DNSKEY records at the zone), parsed (how many were read as keys) and answers (every record in the answer section)
      - unknown
  - `signatureWindowsInspected` integer: RRSIG windows compared with the read time
  - `signaturesVerified` false: Signature bytes are not checked against keys
  - `denialProofsChecked` false: NSEC and NSEC3 records are counted, not checked
  - `firstBreak` object, nullable
    - `at` string
    - `why` string
    - `readFrom` string[]: The resolvers the break rests on: the walk's resolver, and the second as well when the break rests on a key set both read alike (the readings are in that link's keyReadings)
  - `insecureAt` string, nullable
  - `notChecked` string[]
  - `notRead` string, nullable

---

[API](https://skmtc.dev/isitdns/apis/is-it-dns-api.md) · [All operations](https://skmtc.dev/isitdns/apis/is-it-dns-api/llms.txt) · [OpenAPI document](https://skmtc.dev/isitdns/apis/is-it-dns-api/revisions/d5257837c67b?raw)