DNSSEC chain inspection

GET /api/v1/dnssec/{domain}

Fetches DS and DNSKEY records, computes key tags and reports which DS entries match a published DNSKEY. status is “unsigned” (no DS), “valid” (resolver-validated and at least one DS matches) or “broken”.

Path parameters

Name	Type	Required	Description
domain	string	yes

Responses

Status	Type	Description
200	DnssecResult	DS/DNSKEY chain and status
400	object	Error
429	object	Error
502	object	Error

Response body

Field	Type	Required	Description
api	string	no
domain	string	no
status	string	no	(unsigned, valid, broken)
adValidated	boolean	no	The validating resolver set the AD flag for the zone
ds	object[]	no
dnskeys	object[]	no
links	object[]	no

Example

curl -X GET "https://dns-doctor.com/api/v1/dnssec/<domain>" \
  -H "Authorization: Bearer $REGFISH_API_KEY"

Build a request

Fill in values: the call below updates as you type. Nothing is sent: the API does not currently allow browser requests from this domain (CORS). The API key is not stored.