DNSSEC chain inspection

GET /api/v1/dnssec/{domain}

Fetches DS and DNSKEY records, computes key tags and reports which DS entries match a published DNSKEY. status is “unsigned” (no DS), “valid” (resolver-validated and at least one DS matches) or “broken”.

Path parameters

Name	Type	Required	Description
domain	string	yes	-

Responses

Status	Type	Description
200	DnssecResult	DS/DNSKEY chain and status
400	object	Error
429	object	Error
502	object	Error

Response body

Field	Type	Required	Description
api	string	no	-
domain	string	no	-
status	string	no	(unsigned, valid, broken)
adValidated	boolean	no	The validating resolver set the AD flag for the zone
ds	object[]	no	-
dnskeys	object[]	no	-
links	object[]	no	-

Example

curl -X GET "https://dns-doctor.com/api/v1/dnssec/<domain>" \
  -H "Authorization: Bearer $REGFISH_API_KEY"

Build a request

Fill in values - the call below updates as you type. Nothing is sent: the API does not currently allow browser requests from this domain (CORS). The API key is not stored.