What it reads
The DS record at your parent zone, and whether a validating resolver confirms a real answer. Signed and valid passes, signed but broken fails, unsigned is information.
Check 8 of 54 · Email authentication
DNSSEC, explained.
A seal that stops your DNS answers being forged. A broken seal counts as worse than none.
Engine 1.57.0, read 25 October 2026
Free checkScoredReliability: Definitive
Can someone send email as you?
What the check does, and where it stops.
Why it matters
Every other record here is only as trustworthy as the DNS that serves it. A broken DNSSEC chain can make your whole domain unreachable.
What a failure looks like
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
Where its limits are
Reports unknown when validation cannot complete.
ReliabilityDefinitive: reads a published value
Check 8 is one of 16 in Email authentication. See it in its row on the scanner page, beside the rest of Email authentication.
See how your domain does.
The free check includes this one and takes about 30 seconds. No account. Nothing to install.