DE

↑ ↓ select, Enter open, Esc close

Check whether DNSSEC works for a domain

harmlessDNSdebian, ubuntu
Adjust the values, the command updates live
user@server
dig @1.1.1.1 +dnssec example.com SOA | grep -E "flags:|RRSIG|status:"

Sends the query to a validating resolver and filters out status, flags and signatures. If ad appears in the flags and an RRSIG is shown, the zone is signed and valid. A SERVFAIL status on an otherwise working domain points to broken DNSSEC, for example an outdated DS record at the registrar after a nameserver change.

Also searched as

  • check if dnssec is enabled
  • domain unreachable after enabling dnssec
  • servfail because of dnssec

Related one-liners

All in DNS

Check a domain's DKIM key in DNS

$dig +short default._domainkey.example.com TXT
harmlessDNS

Check DNS propagation across public resolvers

$for ns in 1.1.1.1 8.8.8.8 9.9.9.9 208.67.222.222; do echo "$ns: $(dig +short @$ns example.com A | tr '\n' ' ')"; done
harmlessDNS

Check if a server IP is on the Spamhaus blacklist

$dig +short $(echo 203.0.113.10 | awk -F. '{print $4"."$3"."$2"."$1}').zen.spamhaus.org
harmlessDNS

Check the CAA record of a domain

$dig +short example.com CAA
harmlessDNS

Compare the SOA serial on all nameservers

$for ns in $(dig +short example.com NS); do echo "$ns $(dig +short @$ns example.com SOA | awk '{print $3}')"; done
harmlessDNS

Look up the MX records of a domain

$dig +short example.com MX
harmlessDNS

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.