The chain of trust, drawn from live answers
Type a signed domain. Your browser asks cloudflare-dns.com for the DNSKEY
and DS set at every label, root to leaf, and draws every key, DS, and signature that comes
back. It is one recursive answering per cut, not a referral walk from the root servers.
Hover or tap any box for the live values. Nothing on this page is canned;
every number was fetched by your browser seconds ago.
try
vantage: your browser → cloudflare-dns.com (1.1.1.1) over DoH, JSON API
How we walked it
- Computed here: key tags from each DNSKEY's rdata (RFC 4034 appendix B), DS digests recomputed with WebCrypto (SHA-1/256/384) and compared byte for byte against the parent's DS, and every RRSIG inception/expiration window checked against your clock.
- Not computed here: the signature bytes themselves. Verifying an RRSIG needs the canonical wire form of the whole RRset; this page does not do that math. Where a relation rests on the signature alone it is drawn dashed amber, and the resolver's AD (authenticated data) flag is shown as the validating resolver's own verdict.
- The root key is a trust anchor. The root DNSKEY RRset shown is fetched live, but trust in it comes from resolver configuration, not from this page. We do not fetch the IANA anchor file here.
- A different vantage can see a different chain mid-rollover. This one is your browser's.
Want the full professional graph with NSEC proofs and per-server responses? DNSViz is the reference tool; how to read its graphs is on the wiki, next to DNSSEC, signed and validated. Want less, not more? tldr-dnssec is this walk as one verdict line.