Skip to content
regfish Docs

DNSSEC chain inspection

GET /api/v1/dnssec/{domain}

Fetches DS and DNSKEY records, computes key tags and reports which DS entries match a published DNSKEY. status is “unsigned” (no DS), “valid” (resolver-validated and at least one DS matches) or “broken”.

Path parameters

Section titled “Path parameters”
Name Type Required Description
domain string yes —

Responses

Section titled “Responses”
Status Type Description
200 DnssecResult DS/DNSKEY chain and status
400 object Error
429 object Error
502 object Error

Response body

Section titled “Response body”
Field Type Required Description
api string no —
domain string no —
status string no (unsigned, valid, broken)
adValidated boolean no The validating resolver set the AD flag for the zone
ds object[] no —
dnskeys object[] no —
links object[] no —

Example

Section titled “Example”
Terminal-Fenster
curl -X GET "https://dns-doctor.com/api/v1/dnssec/<domain>" \
  -H "Authorization: Bearer $REGFISH_API_KEY"

Build a request

Section titled “Build a request”

Fill in values — the call below updates as you type. Nothing is sent: the API does not currently allow browser requests from this domain (CORS). The API key is not stored.